diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 037ca1f6b..22eb46460 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -191,20 +191,27 @@ class module(generic.GenericIntelProcess): else: arr_offset = grp.attrs - symbol_table_name = self.get_symbol_table_name() - arr = self._context.object( - symbol_table_name + constants.BANG + "array", - layer_name=self.vol.layer_name, - offset=arr_offset, - subtype=self._context.symbol_space.get_type( - symbol_table_name + constants.BANG + "pointer" - ), - count=50, - ) + if not arr_offset.is_readable(): + vollog.log( + constants.LOGLEVEL_V, + f"Cannot dereference the pointer to the NULL-terminated list of binary attributes for module at offset {self.vol.offset:#x}", + ) + return 0 + entry = arr_offset.dereference() + symbol_table_name = self.get_symbol_table_name() idx = 0 - while arr[idx] and arr[idx].is_readable(): - idx = idx + 1 + while entry.is_readable(): + idx += 1 + entry = self._context.object( + symbol_table_name + constants.BANG + "pointer", + layer_name=self.vol.layer_name, + offset=entry.vol.offset + + self._context.symbol_space.get_type( + symbol_table_name + constants.BANG + "pointer" + ).size, + ) + return idx @functools.cached_property