diff --git a/volatility/framework/exceptions.py b/volatility/framework/exceptions.py index ee5e2bb74..8bfbb68f5 100644 --- a/volatility/framework/exceptions.py +++ b/volatility/framework/exceptions.py @@ -16,6 +16,11 @@ class SymbolError(VolatilityException): class InvalidAddressException(VolatilityException): """Thrown when an address is not valid in the space it was requested""" + def __init__(self, layer_name, invalid_address, *args, **kwargs): + VolatilityException.__init__(self, *args, **kwargs) + self.invalid_address = invalid_address + self.layer_name = layer_name + class SymbolSpaceError(VolatilityException): """Thrown when an error occurs dealing with Symbols and Symbolspaces""" diff --git a/volatility/framework/interfaces/layers.py b/volatility/framework/interfaces/layers.py index cfe88423c..04be40858 100644 --- a/volatility/framework/interfaces/layers.py +++ b/volatility/framework/interfaces/layers.py @@ -115,7 +115,8 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): output = [] for (offset, mapped_offset, length, layer) in self.mapping(offset, length): if not pad and offset > current_offset: - raise exceptions.InvalidAddressException("Layer " + self.name + " cannot map offset " + + raise exceptions.InvalidAddressException(self.name, current_offset, + "Layer " + self.name + " cannot map offset " + str(current_offset)) elif offset > current_offset: output += [b"\x00" * (current_offset - offset)] diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py index 2e9a73979..949ebeee7 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility/framework/layers/intel.py @@ -72,7 +72,8 @@ class Intel(interfaces.layers.TranslationLayerInterface): for (name, size, large_page) in self._structure: # Check we're valid if not self._page_is_valid(entry): - raise exceptions.InvalidAddressException("Page Fault at entry " + hex(entry) + " in table " + name) + raise exceptions.InvalidAddressException(self.name, offset, + "Page Fault at entry " + hex(entry) + " in table " + name) # Check if we're a large page if large_page and (entry & (1 << 7)): # We're a large page, the rest is finished below @@ -93,7 +94,8 @@ class Intel(interfaces.layers.TranslationLayerInterface): # Now we're done if not self._page_is_valid(entry): - raise exceptions.InvalidAddressException("Page Fault at entry " + hex(entry) + " in page entry") + raise exceptions.InvalidAddressException(self.name, offset, + "Page Fault at entry " + hex(entry) + " in page entry") page = self._mask(entry, self._maxphyaddr - 1, position + 1) | self._mask(offset, position, 0) return page, 1 << (position + 1) diff --git a/volatility/framework/layers/lime.py b/volatility/framework/layers/lime.py index c12539041..72abb4a1f 100644 --- a/volatility/framework/layers/lime.py +++ b/volatility/framework/layers/lime.py @@ -93,8 +93,7 @@ class LimeLayer(interfaces.layers.TranslationLayerInterface): if offset >= logical_start and offset < (logical_start + size): return (logical_start, base_start, size) - raise exceptions.InvalidAddressException("Lime fault at address " + hex(offset)) - + raise exceptions.InvalidAddressException(self.name, offset, "Lime fault at address " + hex(offset)) def is_valid(self, offset, length = 1): """Returns whether the address offset can be translated to a valid address""" diff --git a/volatility/framework/layers/physical.py b/volatility/framework/layers/physical.py index 2cb600f14..aa3c4122e 100644 --- a/volatility/framework/layers/physical.py +++ b/volatility/framework/layers/physical.py @@ -38,7 +38,11 @@ class BufferDataLayer(interfaces.layers.DataLayerInterface): def read(self, address, length, pad = False): """Reads the data from the buffer""" if not self.is_valid(address, length): - raise exceptions.InvalidAddressException("Offset outside of the buffer boundaries") + invalid_address = address + if self.minimum_address < address and address <= self.maximum_address: + invalid_address = self.maximum_address + 1 + raise exceptions.InvalidAddressException(self.name, invalid_address, + "Offset outside of the buffer boundaries") return self._buffer[address:address + length] def write(self, address, data): @@ -88,14 +92,19 @@ class FileLayer(interfaces.layers.DataLayerInterface): def read(self, offset, length, pad = False): """Reads from the file at offset for length""" if not self.is_valid(offset, length): - raise exceptions.InvalidAddressException("Offset outside of the " + self.name + " file boundaries") + invalid_address = offset + if self.minimum_address < offset and offset <= self.maximum_address: + invalid_address = self.maximum_address + 1 + raise exceptions.InvalidAddressException(self.name, invalid_address, + "Offset outside of the buffer boundaries") self._file.seek(offset) data = self._file.read(length) if len(data) < length: if pad: data += (b"\x00" * (length - len(data))) else: - raise exceptions.InvalidAddressException("Could not read sufficient bytes from the " + + raise exceptions.InvalidAddressException(self.name, offset + len(data), + "Could not read sufficient bytes from the " + self.name + " file") return data @@ -105,7 +114,11 @@ class FileLayer(interfaces.layers.DataLayerInterface): This will technically allow writes beyond the extent of the file """ if not self.is_valid(offset, len(data)): - raise exceptions.InvalidAddressException("Data segment outside of the " + self.name + " file boundaries") + invalid_address = offset + if self.minimum_address < offset and offset <= self.maximum_address: + invalid_address = self.maximum_address + 1 + raise exceptions.InvalidAddressException(self.name, invalid_address, + "Data segment outside of the " + self.name + " file boundaries") self._file.seek(offset) self._file.write(data)