diff --git a/volatility3/framework/layers/physical.py b/volatility3/framework/layers/physical.py index 7e4e76a6e..6010725bd 100644 --- a/volatility3/framework/layers/physical.py +++ b/volatility3/framework/layers/physical.py @@ -1,6 +1,7 @@ # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # +import logging import threading from typing import Any, Dict, IO, List, Optional, Union @@ -8,6 +9,8 @@ from volatility3.framework import exceptions, interfaces, constants from volatility3.framework.configuration import requirements from volatility3.framework.layers import resources +vollog = logging.getLogger(__name__) + class BufferDataLayer(interfaces.layers.DataLayerInterface): """A DataLayer class backed by a buffer in memory, designed for testing and @@ -80,6 +83,7 @@ class FileLayer(interfaces.layers.DataLayerInterface): metadata: Optional[Dict[str, Any]] = None) -> None: super().__init__(context = context, config_path = config_path, name = name, metadata = metadata) + self._write_warning = False self._location = self.config["location"] self._accessor = resources.ResourceAccessor() self._file_ = None # type: Optional[IO[Any]] @@ -157,6 +161,11 @@ class FileLayer(interfaces.layers.DataLayerInterface): This will technically allow writes beyond the extent of the file """ + if not self._file.writable(): + if not self._write_warning: + self._write_warning = True + vollog.warning("Try to write to unwritable layer: {}".format(self.name)) + return None if not self.is_valid(offset, len(data)): invalid_address = offset if self.minimum_address < offset <= self.maximum_address: