From 69ca85b50a1ee3a319920d178f34f0fd50a47efc Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 27 Jan 2021 12:28:35 +0000 Subject: [PATCH] Layers: Add in check and document scanner behaviour --- volatility/framework/interfaces/layers.py | 3 +++ volatility/framework/layers/scanners/__init__.py | 2 ++ 2 files changed, 5 insertions(+) diff --git a/volatility/framework/interfaces/layers.py b/volatility/framework/interfaces/layers.py index 49d6920aa..75f900a9f 100644 --- a/volatility/framework/interfaces/layers.py +++ b/volatility/framework/interfaces/layers.py @@ -328,6 +328,9 @@ class DataLayerInterface(interfaces.configuration.ConfigurableInterface, metacla vollog.debug("Invalid address in layer {} found scanning {} at address {:x}".format( layer_name, self.name, address)) + if len(data) > scanner.chunk_size + scanner.overlap: + vollog.debug("Scan chunk too large: {}".format(hex(len(data)))) + progress.value = chunk_end return list(scanner(data, chunk_end - len(data))) diff --git a/volatility/framework/layers/scanners/__init__.py b/volatility/framework/layers/scanners/__init__.py index 45208161d..6ac8fc915 100644 --- a/volatility/framework/layers/scanners/__init__.py +++ b/volatility/framework/layers/scanners/__init__.py @@ -21,6 +21,8 @@ class BytesScanner(layers.ScannerInterface): where the needle is found.""" find_pos = data.find(self.needle) while find_pos >= 0: + # Ensure that if we're in the overlap, we don't report it + # It'll be returned when the next block is scanned if find_pos < self.chunk_size: yield find_pos + data_offset find_pos = data.find(self.needle, find_pos + 1)