diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 67f6595b1..d5528a8b5 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -849,7 +849,7 @@ class maple_tree(objects.StructType): expected_maple_tree_depth, seen=None, current_depth=1, - ): + ) -> Optional[int]: """Recursively parse Maple Tree Nodes and yield all non empty slots""" # Create seen set if it does not exist, e.g. on the first call into this recursive function. This @@ -898,7 +898,8 @@ class maple_tree(objects.StructType): node_parent_pointer = node_parent_mte & ~(self.MAPLE_NODE_POINTER_MASK) # verify that the node_parent_pointer correctly points to the parent - assert node_parent_pointer == parent + if node_parent_pointer != parent: + return None # create a node object node = self._context.object( @@ -1008,15 +1009,21 @@ class mm_struct(objects.StructType): ) symbol_table_name = self.get_symbol_table_name() for vma_pointer in self.mm_mt.get_slot_iter(): - # Convert pointer to vm_area_struct and yield - vma_object = self._context.object( - symbol_table_name + constants.BANG + "vm_area_struct", - layer_name=self.vol.native_layer_name, - offset=vma_pointer, - ) + try: + vma_object = vma_pointer.dereference().cast( + symbol_table_name + constants.BANG + "vm_area_struct" + ) + except exceptions.InvalidAddressException: + continue + + # The slots will hold values related to their slot if they are invalid + # Before this check, this function was returning objects on the first page of memory... + if vma_object.vol.offset < 0x1000: + continue + yield vma_object - def get_vma_iter(self) -> Iterable[interfaces.objects.ObjectInterface]: + def _do_get_vma_iter(self) -> Iterable[interfaces.objects.ObjectInterface]: """Returns an iterator for the VMAs in an mm_struct. Automatically choosing the mmap or mm_mt as required. @@ -1033,6 +1040,23 @@ class mm_struct(objects.StructType): else: raise AttributeError("Unable to find mmap or mm_mt in mm_struct") + def get_vma_iter(self) -> Iterable[interfaces.objects.ObjectInterface]: + """Returns an iterator for the VMAs in an mm_struct. + Automatically choosing the mmap or mm_mt as required. + + Yields: + vm_area_struct objects + """ + for vma in self._do_get_vma_iter(): + try: + vma.vm_start + vma.vm_end + vma.get_protection() + + yield vma + except exceptions.InvalidAddressException: + vollog.debug(f"Skipping invalid vm_area_struct at {vma.vol.offset:#x}") + class super_block(objects.StructType): # include/linux/kdev_t.h