From 3d7d11b3407cbc48f36fead2524da490b1dfe5b3 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 1 Aug 2018 14:08:59 -0500 Subject: [PATCH] Make the symbol table masking use the correct bit mask and ASLR aware --- volatility/framework/symbols/utility.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility/framework/symbols/utility.py b/volatility/framework/symbols/utility.py index 36756ada2..28afe8d0b 100644 --- a/volatility/framework/symbols/utility.py +++ b/volatility/framework/symbols/utility.py @@ -4,7 +4,8 @@ from volatility.framework import interfaces, constants def mask_symbol_table(symbol_table: interfaces.symbols.SymbolTableInterface, - address_mask: int = 0): + address_mask: int = 0, + table_aslr_shift: int = 0): """Alters a symbol table, such that all symbols returned have their address masked by the address mask""" original_get_symbol = symbol_table.get_symbol cached_symbols = {} # type: typing.Dict[interfaces.symbols.SymbolInterface, interfaces.symbols.SymbolInterface] @@ -15,7 +16,7 @@ def mask_symbol_table(symbol_table: interfaces.symbols.SymbolTableInterface, if symbol in cached_symbols: return cached_symbols[symbol] new_symbol = interfaces.symbols.SymbolInterface(name = symbol.name, - address = address_mask & symbol.address, + address = address_mask & (symbol.address + table_aslr_shift), type = symbol.type, constant_data = symbol.constant_data) cached_symbols[symbol] = new_symbol