From 641e008caf34b93b3c12360115066e1e291500ca Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 27 Nov 2024 15:06:33 +1100 Subject: [PATCH] Linux: intel: The non-present mapping shouldn't be inverted --- volatility3/framework/layers/intel.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index dc88c20bf..6d0aa6746 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -563,8 +563,9 @@ class LinuxMixin(Intel): return self._is_pte_present(entry) def _pte_needs_invert(self, entry) -> bool: - # Entries that were set to PROT_NONE (PAGE_PRESENT/PAGE_GLOBAL) are inverted - return not (entry & self._PAGE_PRESENT) + # Entries that were set to PROT_NONE (PAGE_PRESENT) are inverted + # A clear PTE shouldn't be inverted. See f19f5c4 + return entry and not (entry & self._PAGE_PRESENT) def _protnone_mask(self, entry: int) -> int: """Gets a mask to XOR with the page table entry to get the correct PFN"""