From 36327a4315640b914cea0d300aa00fa28ff2096d Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 14 Nov 2023 17:20:16 +0100 Subject: [PATCH] check if symbol name is empty after strip --- volatility3/framework/symbols/linux/extensions/__init__.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index b0190e0f9..c37223d4d 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -139,12 +139,12 @@ class module(generic.GenericIntelProcess): except exceptions.PagedInvalidAddressException: continue - if sym_name: + # Stop at first null byte (strtab is a null terminated strings list) + sym_name = sym_name.split(b"\x00")[0].decode("latin-1") + if sym_name != "": # Normalize sym_value mask = self._context.layers[self.vol.layer_name].address_mask sym_value = sym.st_value & mask - # Stop at first null byte (strtab is a null terminated strings list) - sym_name = sym_name.split(b"\x00")[0].decode("latin-1") yield (sym_name, sym_value, sym_offset) def get_symbol(self, wanted_sym_name):