diff --git a/volatility/framework/interfaces/layers.py b/volatility/framework/interfaces/layers.py index 788a85f9b..7f265190d 100644 --- a/volatility/framework/interfaces/layers.py +++ b/volatility/framework/interfaces/layers.py @@ -5,6 +5,7 @@ Created on 4 May 2013 """ import collections import collections.abc +import math from abc import ABCMeta, abstractmethod, abstractproperty from volatility.framework import exceptions, validity @@ -85,6 +86,11 @@ class DataLayerInterface(configuration.ConfigurableInterface, validity.ValidityR def minimum_address(self): """Returns the minimum valid address of the space""" + @property + def address_mask(self): + """Returns a mask which encapsulates all the actives bit of an address for this layer""" + return (1 << int(math.ceil(math.log2(self.maximum_address)))) - 1 + @abstractmethod def is_valid(self, offset, length = 1): """Returns a boolean based on whether the offset is valid or not""" diff --git a/volatility/framework/interfaces/objects.py b/volatility/framework/interfaces/objects.py index 091b8ff90..598069968 100644 --- a/volatility/framework/interfaces/objects.py +++ b/volatility/framework/interfaces/objects.py @@ -6,7 +6,6 @@ Created on 6 May 2013 import collections import collections.abc -import math from abc import ABCMeta, abstractmethod from volatility.framework import validity @@ -69,7 +68,7 @@ class ObjectInterface(validity.ValidityRoutines, metaclass = ABCMeta): # # Normalize offsets - mask = (1 << int(math.ceil(math.log2(context.memory[object_info.layer_name].maximum_address)))) - 1 + mask = context.memory[object_info.layer_name].address_mask normalized_offset = object_info.offset & mask self._vol = collections.ChainMap({}, object_info, {'type_name': type_name}, {'offset': normalized_offset}, diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index 9a64d8588..4332a3776 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -5,7 +5,6 @@ Created on 17 Feb 2013 """ import collections -import math import struct from volatility.framework import interfaces @@ -164,7 +163,7 @@ class Pointer(Integer): """ if layer_name is None: layer_name = self.vol.layer_name - mask = (1 << int(math.ceil(math.log2(self._context.memory[layer_name].maximum_address)))) - 1 + mask = self._context.memory[layer_name].address_mask offset = self & mask return self.vol.subtype(context = self._context, object_info = interfaces.objects.ObjectInformation( @@ -276,7 +275,7 @@ class Array(interfaces.objects.ObjectInterface, collections.Sequence): def __getitem__(self, i): """Returns the i-th item from the array""" result = [] - mask = (1 << int(math.ceil(math.log2(self._context.memory[self.vol.layer_name].maximum_address)))) - 1 + mask = self._context.memory[self.vol.layer_name].address_mask if isinstance(i, slice): if i.step: series = range(i.start, i.stop, i.step) @@ -371,7 +370,7 @@ class Struct(interfaces.objects.ObjectInterface): if attr in self._concrete_members: return self._concrete_members[attr] elif attr in self.vol.members: - mask = (1 << int(math.ceil(math.log2(self._context.memory[self.vol.layer_name].maximum_address)))) - 1 + mask = self._context.memory[self.vol.layer_name].address_mask relative_offset, member = self.vol.members[attr] member = member(context = self._context, object_info = interfaces.objects.ObjectInformation(layer_name = self.vol.layer_name,