WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-11 20:27:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Layers: Qemu only record segment data for pc.ram

Browse Source
This commit is contained in:
Mike Auty
2020-06-10 20:22:35 +01:00
committed by ikelos
parent 6564f0a3a4
commit 880bd0a2e0
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/layers/qemu.py
+7 -2
View File
@@ -66,6 +66,7 @@ class QemuSuspendLayer(segmented.SegmentedLayer):
segments = []
base_layer = self.context.layers[self._base_layer]
read_pcram = False
while not done:
addr = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned long long',
@@ -94,12 +95,16 @@ class QemuSuspendLayer(segmented.SegmentedLayer):
namelen = self._context.object(self._qemu_table_name + constants.BANG + 'unsigned char',
offset = index,
layer_name = self._base_layer)
read_pcram = (base_layer.read(index + 1, namelen) == b'pc.ram')
index += 1 + namelen
if flags & self.SEGMENT_FLAG_COMPRESS:
segments.append((addr, index, 1))
if read_pcram:
segments.append((addr, index, 1))
self._compressed.add(addr)
index += 1
else:
segments.append((addr, index, page_size))
if read_pcram:
segments.append((addr, index, page_size))
index += page_size
if flags & self.SEGMENT_FLAG_XBZRLE:
raise exceptions.LayerException(self.name, "XBZRLE compression not supported")