linux: VMCoreInfo API: Integrate support for value parsing within the VMCoreInfo API

volatility3/framework/automagic/linux.py

@@ -373,8 +373,8 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface):
 
     @staticmethod
     def _vmcoreinfo_find_aslr(vmcoreinfo) -> Tuple[int, int]:
-        phys_base_str = vmcoreinfo.get("NUMBER(phys_base)")
-        if phys_base_str is None:
+        phys_base = vmcoreinfo.get("NUMBER(phys_base)")
+        if phys_base is None:
             # In kernel < 4.10, there may be a SYMBOL(phys_base), but as noted in the
             # c401721ecd1dcb0a428aa5d6832ee05ffbdbffbbe commit comment, this value
             # isn't useful for calculating the physical address.
@@ -383,15 +383,15 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface):
             return None
 
         # kernels 3.14 (b6085a865762236bb84934161273cdac6dd11c2d) KERNELOFFSET was added
-        kerneloffset_str = vmcoreinfo.get("KERNELOFFSET")
-        if kerneloffset_str is None:
+        kerneloffset = vmcoreinfo.get("KERNELOFFSET")
+        if kerneloffset is None:
             # kernels < 3.14 if KERNELOFFSET is missing, KASLR might not be implemented.
             # Oddly, NUMBER(phys_base) is present without it. To be safe, proceed only
             # if both are present.
             return None
 
-        aslr_shift = int(kerneloffset_str, 16)
-        kaslr_shift = int(phys_base_str) + aslr_shift
+        aslr_shift = kerneloffset
+        kaslr_shift = phys_base + aslr_shift
 
         return kaslr_shift, aslr_shift
 
@@ -403,7 +403,11 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface):
         # in kernels 4.13 in 65ade2f872b474fa8a04c2d397783350326634e6) to init_top_pgt.
         # In x86-32, the pgd is swapper_pg_dir. So, in any case, for VMCOREINFO
         # SYMBOL(swapper_pg_dir) will always have the right value.
-        dtb_vaddr = int(vmcoreinfo["SYMBOL(swapper_pg_dir)"], 16)
+        dtb_vaddr = vmcoreinfo.get("SYMBOL(swapper_pg_dir)")
+        if dtb_vaddr is None:
+            # Abort, it should be present
+            return None
+
         dtb_paddr = (
             LinuxIntelStacker.virtual_to_physical_address(dtb_vaddr)
             - aslr_shift
@@ -420,7 +424,7 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface):
             is_32bit = True
         else:
             # Check the swapper_pg_dir virtual address size
-            dtb_vaddr = int(vmcoreinfo["SYMBOL(swapper_pg_dir)"], 16)
+            dtb_vaddr = vmcoreinfo["SYMBOL(swapper_pg_dir)"]
             is_32bit = dtb_vaddr <= 2**32
 
         return is_32bit, is_pae

volatility3/framework/plugins/linux/vmcoreinfo.py

@@ -38,6 +38,11 @@ class VMCoreInfo(plugins.PluginInterface):
             layer_name=layer_name,
         ):
             for key, value in vmcoreinfo.items():
+                if key.startswith("SYMBOL(") or key == "KERNELOFFSET":
+                    value = f"0x{value:x}"
+                else:
+                    value = str(value)
+
                 yield 0, (format_hints.Hex(vmcoreinfo_offset), key, value)
 
     def run(self):

volatility3/framework/symbols/linux/__init__.py

@@ -842,8 +842,9 @@ class VMCoreInfo(interfaces.configuration.VersionableInterface):
 
     _version = (1, 0, 0)
 
-    @staticmethod
+    @classmethod
     def _vmcoreinfo_data_to_dict(
+        cls,
         vmcoreinfo_data,
     ) -> Optional[Dict[str, str]]:
         """Converts the input VMCoreInfo data buffer into a dictionary"""
@@ -859,10 +860,22 @@ class VMCoreInfo(interfaces.configuration.VersionableInterface):
                 break
 
             key, value = line.split("=", 1)
-            vmcoreinfo_dict[key] = value
+            vmcoreinfo_dict[key] = cls._parse_value(key, value)
 
         return vmcoreinfo_dict
 
+    @classmethod
+    def _parse_value(cls, key, value):
+        if key.startswith("SYMBOL(") or key == "KERNELOFFSET":
+            return int(value, 16)
+        elif key.startswith(("NUMBER(", "LENGTH(", "SIZE(", "OFFSET(")):
+            return int(value)
+        elif key == "PAGESIZE":
+            return int(value)
+
+        # Default, as string
+        return value
+
     @classmethod
     def search_vmcoreinfo_elf_note(
         cls,