WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-09 19:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Layers: Change mapping signature to return domain length

Browse Source
This commit is contained in:
Mike Auty
2020-03-04 20:29:42 +00:00
committed by ikelos
parent a2ac55ba0b
commit 77be83edc4
11 changed files with 109 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/strings.py
+2 -2
View File
@@ -84,7 +84,7 @@ class Strings(interfaces.plugins.PluginInterface):
if isinstance(layer, intel.Intel):
# We don't care about errors, we just wanted chunks that map correctly
for mapval in layer.mapping(0x0, layer.maximum_address, ignore_errors = True):
vpage, kpage, page_size, maplayer = mapval
vpage, _, kpage, page_size, maplayer = mapval
for val in range(kpage, kpage + page_size, 0x1000):
cur_set = reverse_map.get(kpage >> 12, set())
cur_set.add(("kernel", vpage))
@@ -107,7 +107,7 @@ class Strings(interfaces.plugins.PluginInterface):
proc_layer = self.context.layers[proc_layer_name]
if isinstance(proc_layer, linear.LinearlyMappedLayer):
for mapval in proc_layer.mapping(0x0, proc_layer.maximum_address, ignore_errors = True):
kpage, vpage, page_size, maplayer = mapval
kpage, _, vpage, page_size, maplayer = mapval
for val in range(kpage, kpage + page_size, 0x1000):
cur_set = reverse_map.get(kpage >> 12, set())
cur_set.add(("Process {}".format(process.UniqueProcessId), vpage))