Ensure all offsets are normalized to fall within their layer's address range.

volatility/framework/automagic/pdbscan.py

@@ -177,7 +177,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
                     if context.memory[virtual_layer_name].bits_per_register == 64:
                         # The kernel starts in a chunk towards the end of the space
                         kvo = kernel['mz_offset'] + (
-                            31 << int(round(math.log(context.memory[virtual_layer_name].maximum_address + 1, 2)) - 5))
+                            31 << int(math.ceil(math.log2(context.memory[virtual_layer_name].maximum_address + 1)) - 5))
                     else:
                         # The kernel starts exactly halfway through the address space, so shift the maximum_address down by 1
                         kvo = kernel['mz_offset'] + (1 << (context.memory[virtual_layer_name].bits_per_register - 1))

volatility/framework/interfaces/objects.py

@@ -6,6 +6,7 @@ Created on 6 May 2013
 
 import collections
 import collections.abc
+import math
 from abc import ABCMeta, abstractmethod
 
 from volatility.framework import validity
@@ -66,7 +67,13 @@ class ObjectInterface(validity.ValidityRoutines, metaclass = ABCMeta):
         # This allows objects to MASSIVELY MESS with their own internal representation!!!
         # Changes to offset, type_name, etc should NEVER be done
         #
-        self._vol = collections.ChainMap({}, object_info, {'type_name': type_name}, kwargs)
+
+        # Normalize offsets
+        mask = (1 << int(math.ceil(math.log2(context.memory[object_info.layer_name].maximum_address)))) - 1
+        normalized_offset = object_info.offset & mask
+
+        self._vol = collections.ChainMap({}, object_info, {'type_name': type_name}, {'offset': normalized_offset},
+                                         kwargs)
         self._context = context
 
     @property

volatility/framework/objects/__init__.py

@@ -5,6 +5,7 @@ Created on 17 Feb 2013
 """
 
 import collections
+import math
 import struct
 
 from volatility.framework import interfaces
@@ -163,10 +164,12 @@ class Pointer(Integer):
         """
         if layer_name is None:
             layer_name = self.vol.layer_name
+        mask = (1 << int(math.ceil(math.log2(self._context.memory[layer_name].maximum_address)))) - 1
+        offset = self & mask
         return self.vol.subtype(context = self._context,
                                 object_info = interfaces.objects.ObjectInformation(
                                     layer_name = layer_name,
-                                    offset = self,
+                                    offset = offset,
                                     parent = self))
 
     def __getattr__(self, attr):
@@ -273,6 +276,7 @@ class Array(interfaces.objects.ObjectInterface, collections.Sequence):
     def __getitem__(self, i):
         """Returns the i-th item from the array"""
         result = []
+        mask = (1 << int(math.ceil(math.log2(self._context.memory[self.vol.layer_name].maximum_address)))) - 1
         if isinstance(i, slice):
             if i.step:
                 series = range(i.start, i.stop, i.step)
@@ -282,13 +286,13 @@ class Array(interfaces.objects.ObjectInterface, collections.Sequence):
                 series = range(i.stop)
             for index in series:
                 object_info = ObjectInformation(layer_name = self.vol.layer_name,
-                                                offset = self.vol.offset + (self.vol.subtype.size * index),
+                                                offset = mask & (self.vol.offset + (self.vol.subtype.size * index)),
                                                 parent = self)
                 result += [self.vol.subtype(context = self._context, object_info = object_info)]
         else:
             index = i
             object_info = ObjectInformation(layer_name = self.vol.layer_name,
-                                            offset = self.vol.offset + (self.vol.subtype.size * index),
+                                            offset = mask & (self.vol.offset + (self.vol.subtype.size * index)),
                                             parent = self)
             result = self.vol.subtype(context = self._context, object_info = object_info)
         return result
@@ -367,10 +371,12 @@ class Struct(interfaces.objects.ObjectInterface):
         if attr in self._concrete_members:
             return self._concrete_members[attr]
         elif attr in self.vol.members:
+            mask = (1 << int(math.ceil(math.log2(self._context.memory[self.vol.layer_name].maximum_address)))) - 1
             relative_offset, member = self.vol.members[attr]
             member = member(context = self._context,
                             object_info = interfaces.objects.ObjectInformation(layer_name = self.vol.layer_name,
-                                                                               offset = self.vol.offset + relative_offset,
+                                                                               offset = mask & (
+                                                                                   self.vol.offset + relative_offset),
                                                                                member_name = attr,
                                                                                parent = self))
             self._concrete_members[attr] = member