mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-08 02:37:39 +02:00
Fix the truncation of strings
MHL kindly pointed out that the string wasn't truncating, and it turns out I misread the struct documentation, which truncates or pads with \x00s to ensure the appropriate length. We now truncate to the first null we find.
This commit is contained in:
@@ -140,7 +140,8 @@ class String(PrimitiveObject, str):
|
||||
layer_name = object_info.layer_name,
|
||||
offset = object_info.offset),
|
||||
**params)
|
||||
# We don't truncate on "\x00" because the string decoder does that for us
|
||||
if value.find('\x00') >= 0:
|
||||
value = value[:value.find('\x00')]
|
||||
return value
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user