From 2c02df125ae43248fac5564a9ae8b104337aa71b Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 13 Dec 2016 20:41:09 +0000 Subject: [PATCH] Fix the truncation of strings MHL kindly pointed out that the string wasn't truncating, and it turns out I misread the struct documentation, which truncates or pads with \x00s to ensure the appropriate length. We now truncate to the first null we find. --- volatility/framework/objects/__init__.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index 4dd712ab7..1770a04fd 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -140,7 +140,8 @@ class String(PrimitiveObject, str): layer_name = object_info.layer_name, offset = object_info.offset), **params) - # We don't truncate on "\x00" because the string decoder does that for us + if value.find('\x00') >= 0: + value = value[:value.find('\x00')] return value