diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index e675a9479..41993b81e 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -177,7 +177,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): if context.memory[virtual_layer_name].bits_per_register == 64: # The kernel starts in a chunk towards the end of the space kvo = kernel['mz_offset'] + ( - 31 << int(round(math.log(context.memory[virtual_layer_name].maximum_address + 1, 2)) - 5)) + 31 << int(math.ceil(math.log2(context.memory[virtual_layer_name].maximum_address + 1)) - 5)) else: # The kernel starts exactly halfway through the address space, so shift the maximum_address down by 1 kvo = kernel['mz_offset'] + (1 << (context.memory[virtual_layer_name].bits_per_register - 1)) diff --git a/volatility/framework/interfaces/objects.py b/volatility/framework/interfaces/objects.py index 7ce5f5358..091b8ff90 100644 --- a/volatility/framework/interfaces/objects.py +++ b/volatility/framework/interfaces/objects.py @@ -6,6 +6,7 @@ Created on 6 May 2013 import collections import collections.abc +import math from abc import ABCMeta, abstractmethod from volatility.framework import validity @@ -66,7 +67,13 @@ class ObjectInterface(validity.ValidityRoutines, metaclass = ABCMeta): # This allows objects to MASSIVELY MESS with their own internal representation!!! # Changes to offset, type_name, etc should NEVER be done # - self._vol = collections.ChainMap({}, object_info, {'type_name': type_name}, kwargs) + + # Normalize offsets + mask = (1 << int(math.ceil(math.log2(context.memory[object_info.layer_name].maximum_address)))) - 1 + normalized_offset = object_info.offset & mask + + self._vol = collections.ChainMap({}, object_info, {'type_name': type_name}, {'offset': normalized_offset}, + kwargs) self._context = context @property diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index 6ddb22d5e..9a64d8588 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -5,6 +5,7 @@ Created on 17 Feb 2013 """ import collections +import math import struct from volatility.framework import interfaces @@ -163,10 +164,12 @@ class Pointer(Integer): """ if layer_name is None: layer_name = self.vol.layer_name + mask = (1 << int(math.ceil(math.log2(self._context.memory[layer_name].maximum_address)))) - 1 + offset = self & mask return self.vol.subtype(context = self._context, object_info = interfaces.objects.ObjectInformation( layer_name = layer_name, - offset = self, + offset = offset, parent = self)) def __getattr__(self, attr): @@ -273,6 +276,7 @@ class Array(interfaces.objects.ObjectInterface, collections.Sequence): def __getitem__(self, i): """Returns the i-th item from the array""" result = [] + mask = (1 << int(math.ceil(math.log2(self._context.memory[self.vol.layer_name].maximum_address)))) - 1 if isinstance(i, slice): if i.step: series = range(i.start, i.stop, i.step) @@ -282,13 +286,13 @@ class Array(interfaces.objects.ObjectInterface, collections.Sequence): series = range(i.stop) for index in series: object_info = ObjectInformation(layer_name = self.vol.layer_name, - offset = self.vol.offset + (self.vol.subtype.size * index), + offset = mask & (self.vol.offset + (self.vol.subtype.size * index)), parent = self) result += [self.vol.subtype(context = self._context, object_info = object_info)] else: index = i object_info = ObjectInformation(layer_name = self.vol.layer_name, - offset = self.vol.offset + (self.vol.subtype.size * index), + offset = mask & (self.vol.offset + (self.vol.subtype.size * index)), parent = self) result = self.vol.subtype(context = self._context, object_info = object_info) return result @@ -367,10 +371,12 @@ class Struct(interfaces.objects.ObjectInterface): if attr in self._concrete_members: return self._concrete_members[attr] elif attr in self.vol.members: + mask = (1 << int(math.ceil(math.log2(self._context.memory[self.vol.layer_name].maximum_address)))) - 1 relative_offset, member = self.vol.members[attr] member = member(context = self._context, object_info = interfaces.objects.ObjectInformation(layer_name = self.vol.layer_name, - offset = self.vol.offset + relative_offset, + offset = mask & ( + self.vol.offset + relative_offset), member_name = attr, parent = self)) self._concrete_members[attr] = member