Move the memory page parameters to the Intel layer

volatility3/framework/constants/linux/__init__.py

@@ -9,11 +9,6 @@ from enum import IntEnum
 
 KERNEL_NAME = "__kernel__"
 
-# arch/x86/include/asm/page_types.h
-PAGE_SHIFT = 12
-PAGE_SIZE = 1 << PAGE_SHIFT
-PAGE_MASK = ~(PAGE_SIZE - 1)
-
 """The value hard coded from the Linux Kernel (hence not extracted from the layer itself)"""
 
 # include/linux/sched.h

volatility3/framework/layers/intel.py

@@ -67,6 +67,12 @@ class Intel(linear.LinearlyMappedLayer):
             math.ceil(math.log2(struct.calcsize(self._entry_format)))
         )
 
+    @classproperty
+    @functools.lru_cache()
+    def page_shift(cls) -> int:
+        """Page shift for the intel memory layers."""
+        return cls._page_size_in_bits
+
     @classproperty
     @functools.lru_cache()
     def page_size(cls) -> int:
@@ -76,6 +82,12 @@ class Intel(linear.LinearlyMappedLayer):
         """
         return 1 << cls._page_size_in_bits
 
+    @classproperty
+    @functools.lru_cache()
+    def page_mask(cls) -> int:
+        """Page mask for the intel memory layers."""
+        return ~(cls.page_size - 1)
+
     @classproperty
     @functools.lru_cache()
     def bits_per_register(cls) -> int:

volatility3/framework/plugins/linux/elfs.py

@@ -14,11 +14,7 @@ from volatility3.framework.objects import utility
 from volatility3.framework.renderers import format_hints
 from volatility3.framework.symbols import intermed
 from volatility3.framework.symbols.linux.extensions import elf
-from volatility3.framework.constants.linux import (
-    PAGE_SIZE,
-    PAGE_MASK,
-    ELF_MAX_EXTRACTION_SIZE,
-)
+from volatility3.framework.constants.linux import ELF_MAX_EXTRACTION_SIZE
 from volatility3.plugins.linux import pslist
 
 
@@ -106,11 +102,11 @@ class Elfs(plugins.PluginInterface):
             # Use complete memory pages for dumping
             # If start isn't a multiple of a page, stick to the highest multiple < start
             # If end isn't a multiple of a page, stick to the lowest multiple > end
-            if start % PAGE_SIZE:
-                start = start & PAGE_MASK
+            if start % proc_layer.page_size:
+                start = start & proc_layer.page_mask
 
-            if end % PAGE_SIZE:
-                end = (end & PAGE_MASK) + PAGE_SIZE
+            if end % proc_layer.page_size:
+                end = (end & proc_layer.page_mask) + proc_layer.page_size
 
             real_size = end - start
 

volatility3/framework/symbols/linux/extensions/__init__.py

@@ -640,7 +640,7 @@ class vm_area_struct(objects.StructType):
         elif flags_str == "r-x" and self.vm_file.dereference().vol.offset == 0:
             ret = True
         elif proclayer and "x" in flags_str:
-            for i in range(self.vm_start, self.vm_end, 1 << constants.linux.PAGE_SHIFT):
+            for i in range(self.vm_start, self.vm_end, proclayer.page_size):
                 try:
                     if proclayer.is_dirty(i):
                         vollog.warning(