WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 21:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Make the symbol table masking use the correct bit mask and ASLR aware

Browse Source
This commit is contained in:
Andrew Case
2018-11-08 00:19:17 +00:00
committed by ikelos
parent af496d4741
commit 3d7d11b340
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/utility.py
+3 -2
View File
@@ -4,7 +4,8 @@ from volatility.framework import interfaces, constants
def mask_symbol_table(symbol_table: interfaces.symbols.SymbolTableInterface,
address_mask: int = 0):
address_mask: int = 0,
table_aslr_shift: int = 0):
"""Alters a symbol table, such that all symbols returned have their address masked by the address mask"""
original_get_symbol = symbol_table.get_symbol
cached_symbols = {} # type: typing.Dict[interfaces.symbols.SymbolInterface, interfaces.symbols.SymbolInterface]
@@ -15,7 +16,7 @@ def mask_symbol_table(symbol_table: interfaces.symbols.SymbolTableInterface,
if symbol in cached_symbols:
return cached_symbols[symbol]
new_symbol = interfaces.symbols.SymbolInterface(name = symbol.name,
address = address_mask & symbol.address,
address = address_mask & (symbol.address + table_aslr_shift),
type = symbol.type,
constant_data = symbol.constant_data)
cached_symbols[symbol] = new_symbol