WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-28 20:44:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ensure all offsets are normalized to fall within their layer's address range.

Browse Source
This commit is contained in:
Mike Auty
2016-12-07 00:07:57 +00:00
parent 20d0e83e1d
commit 6cb5d06d6d
3 changed files with 19 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/objects/__init__.py
+10 -4
View File
@@ -5,6 +5,7 @@ Created on 17 Feb 2013
"""
import collections
import math
import struct
from volatility.framework import interfaces
@@ -163,10 +164,12 @@ class Pointer(Integer):
"""
if layer_name is None:
layer_name = self.vol.layer_name
mask = (1 << int(math.ceil(math.log2(self._context.memory[layer_name].maximum_address)))) - 1
offset = self & mask
return self.vol.subtype(context = self._context,
object_info = interfaces.objects.ObjectInformation(
layer_name = layer_name,
offset = self,
offset = offset,
parent = self))
def __getattr__(self, attr):
@@ -273,6 +276,7 @@ class Array(interfaces.objects.ObjectInterface, collections.Sequence):
def __getitem__(self, i):
"""Returns the i-th item from the array"""
result = []
mask = (1 << int(math.ceil(math.log2(self._context.memory[self.vol.layer_name].maximum_address)))) - 1
if isinstance(i, slice):
if i.step:
series = range(i.start, i.stop, i.step)
@@ -282,13 +286,13 @@ class Array(interfaces.objects.ObjectInterface, collections.Sequence):
series = range(i.stop)
for index in series:
object_info = ObjectInformation(layer_name = self.vol.layer_name,
offset = self.vol.offset + (self.vol.subtype.size * index),
offset = mask & (self.vol.offset + (self.vol.subtype.size * index)),
parent = self)
result += [self.vol.subtype(context = self._context, object_info = object_info)]
else:
index = i
object_info = ObjectInformation(layer_name = self.vol.layer_name,
offset = self.vol.offset + (self.vol.subtype.size * index),
offset = mask & (self.vol.offset + (self.vol.subtype.size * index)),
parent = self)
result = self.vol.subtype(context = self._context, object_info = object_info)
return result
@@ -367,10 +371,12 @@ class Struct(interfaces.objects.ObjectInterface):
if attr in self._concrete_members:
return self._concrete_members[attr]
elif attr in self.vol.members:
mask = (1 << int(math.ceil(math.log2(self._context.memory[self.vol.layer_name].maximum_address)))) - 1
relative_offset, member = self.vol.members[attr]
member = member(context = self._context,
object_info = interfaces.objects.ObjectInformation(layer_name = self.vol.layer_name,
offset = self.vol.offset + relative_offset,
offset = mask & (
self.vol.offset + relative_offset),
member_name = attr,
parent = self))
self._concrete_members[attr] = member