mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-30 05:24:52 +02:00
make binary attributes iteration NULL terminated
This commit is contained in:
@@ -191,20 +191,27 @@ class module(generic.GenericIntelProcess):
|
||||
else:
|
||||
arr_offset = grp.attrs
|
||||
|
||||
symbol_table_name = self.get_symbol_table_name()
|
||||
arr = self._context.object(
|
||||
symbol_table_name + constants.BANG + "array",
|
||||
layer_name=self.vol.layer_name,
|
||||
offset=arr_offset,
|
||||
subtype=self._context.symbol_space.get_type(
|
||||
symbol_table_name + constants.BANG + "pointer"
|
||||
),
|
||||
count=50,
|
||||
)
|
||||
if not arr_offset.is_readable():
|
||||
vollog.log(
|
||||
constants.LOGLEVEL_V,
|
||||
f"Cannot dereference the pointer to the NULL-terminated list of binary attributes for module at offset {self.vol.offset:#x}",
|
||||
)
|
||||
return 0
|
||||
|
||||
entry = arr_offset.dereference()
|
||||
symbol_table_name = self.get_symbol_table_name()
|
||||
idx = 0
|
||||
while arr[idx] and arr[idx].is_readable():
|
||||
idx = idx + 1
|
||||
while entry.is_readable():
|
||||
idx += 1
|
||||
entry = self._context.object(
|
||||
symbol_table_name + constants.BANG + "pointer",
|
||||
layer_name=self.vol.layer_name,
|
||||
offset=entry.vol.offset
|
||||
+ self._context.symbol_space.get_type(
|
||||
symbol_table_name + constants.BANG + "pointer"
|
||||
).size,
|
||||
)
|
||||
|
||||
return idx
|
||||
|
||||
@functools.cached_property
|
||||
|
||||
Reference in New Issue
Block a user