From 880bd0a2e0027d66bf0f7b9a5cd0b398cb0bc811 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 27 Jan 2020 02:05:21 +0000 Subject: [PATCH] Layers: Qemu only record segment data for pc.ram --- volatility/framework/layers/qemu.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/volatility/framework/layers/qemu.py b/volatility/framework/layers/qemu.py index cc3d09648..5d31bc922 100644 --- a/volatility/framework/layers/qemu.py +++ b/volatility/framework/layers/qemu.py @@ -66,6 +66,7 @@ class QemuSuspendLayer(segmented.SegmentedLayer): segments = [] base_layer = self.context.layers[self._base_layer] + read_pcram = False while not done: addr = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned long long', @@ -94,12 +95,16 @@ class QemuSuspendLayer(segmented.SegmentedLayer): namelen = self._context.object(self._qemu_table_name + constants.BANG + 'unsigned char', offset = index, layer_name = self._base_layer) + read_pcram = (base_layer.read(index + 1, namelen) == b'pc.ram') index += 1 + namelen if flags & self.SEGMENT_FLAG_COMPRESS: - segments.append((addr, index, 1)) + if read_pcram: + segments.append((addr, index, 1)) + self._compressed.add(addr) index += 1 else: - segments.append((addr, index, page_size)) + if read_pcram: + segments.append((addr, index, page_size)) index += page_size if flags & self.SEGMENT_FLAG_XBZRLE: raise exceptions.LayerException(self.name, "XBZRLE compression not supported")