From 56ff75a74bde6ea8bf3eebfb71b7b5188a1d0793 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 10 Dec 2020 12:18:14 +0000 Subject: [PATCH] Layers: Add internal intel debugging flag --- volatility/framework/layers/intel.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py index bf9b597ff..cc5aa98aa 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility/framework/layers/intel.py @@ -10,12 +10,14 @@ import struct from typing import Any, Dict, Iterable, List, Optional, Tuple from volatility import classproperty -from volatility.framework import exceptions, interfaces +from volatility.framework import exceptions, interfaces, constants from volatility.framework.configuration import requirements from volatility.framework.layers import linear vollog = logging.getLogger(__name__) +INTEL_TRANSLATION_DEBUGGING = False + class Intel(linear.LinearlyMappedLayer): """Translation Layer for the Intel IA32 memory mapping.""" @@ -144,6 +146,11 @@ class Intel(linear.LinearlyMappedLayer): # Read the data for the next entry entry_data = table[(index << self._index_shift):(index << self._index_shift) + self._entry_size] + if INTEL_TRANSLATION_DEBUGGING: + vollog.log( + constants.LOGLEVEL_VVVV, "Entry {} at index {} gives data {} as {}".format( + hex(entry), hex(index), hex(struct.unpack(self._entry_format, entry_data)[0]), name)) + # Read out the new entry from memory entry, = struct.unpack(self._entry_format, entry_data)