WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-30 13:34:53 +02:00
Code Issues Packages Projects Releases Wiki Activity

Linux: intel: The non-present mapping shouldn't be inverted

Browse Source
This commit is contained in:
Gustavo Moreira
2024-11-27 15:06:33 +11:00
parent 173e35105a
commit 641e008caf
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/layers/intel.py
+3 -2
View File
@@ -563,8 +563,9 @@ class LinuxMixin(Intel):
return self._is_pte_present(entry)
def _pte_needs_invert(self, entry) -> bool:
# Entries that were set to PROT_NONE (PAGE_PRESENT/PAGE_GLOBAL) are inverted
return not (entry & self._PAGE_PRESENT)
# Entries that were set to PROT_NONE (PAGE_PRESENT) are inverted
# A clear PTE shouldn't be inverted. See f19f5c4
return entry and not (entry & self._PAGE_PRESENT)
def _protnone_mask(self, entry: int) -> int:
"""Gets a mask to XOR with the page table entry to get the correct PFN"""