From 5ab0e4f83f7feb5444ce8d691e58bf56e495db1a Mon Sep 17 00:00:00 2001 From: Eve Date: Tue, 14 Nov 2023 07:22:00 +0000 Subject: [PATCH] Linux: remove _valid_magic from linux elf extension, check for _type_prefix and _hdr attrs instead --- volatility3/framework/symbols/linux/extensions/elf.py | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/elf.py b/volatility3/framework/symbols/linux/extensions/elf.py index 8b42b3075..629a05da5 100644 --- a/volatility3/framework/symbols/linux/extensions/elf.py +++ b/volatility3/framework/symbols/linux/extensions/elf.py @@ -49,15 +49,11 @@ class elf(objects.StructType): vollog.debug( f"Unable to check magic bytes for ELF file at offset {hex(object_info.offset)} in layer {layer_name}: {excp}" ) - self._valid_magic = False return None # Check validity if magic != 0x464C457F: # e.g. ELF - self._valid_magic = False return None - else: - self._valid_magic = True # We need to read the EI_CLASS (0x4 offset) ei_class = self._context.object( @@ -88,7 +84,7 @@ class elf(objects.StructType): """ Determine whether it is a valid object """ - if self._valid_magic: + if hasattr(self, "_type_prefix") and hasattr(self, "_hdr"): return self._type_prefix is not None and self._hdr is not None else: return False