From 3b723f8be38596623b5a50fd5d8139960c7c5598 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 10 Apr 2025 15:43:21 -0500 Subject: [PATCH 1/5] Linux pagecache.Files: Memory Usage Converts `objects.Pointer` to `int` before storing them in the set. This should have a substantial impact on memory, similar to those in #1758 --- volatility3/framework/plugins/linux/mountinfo.py | 4 ++-- volatility3/framework/plugins/linux/pagecache.py | 13 +++++++------ 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/plugins/linux/mountinfo.py b/volatility3/framework/plugins/linux/mountinfo.py index 668b039db..9790c4b57 100644 --- a/volatility3/framework/plugins/linux/mountinfo.py +++ b/volatility3/framework/plugins/linux/mountinfo.py @@ -279,9 +279,9 @@ class MountInfo(plugins.PluginInterface): if not (sb_ptr and sb_ptr.is_readable()): continue - if sb_ptr in seen_sb_ptr: + if int(sb_ptr) in seen_sb_ptr: continue - seen_sb_ptr.add(sb_ptr) + seen_sb_ptr.add(int(sb_ptr)) superblock = sb_ptr.dereference() diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 60b8b066b..6c27c94b2 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -204,10 +204,10 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): if dentry_addr == root_dentry.vol.offset: continue - if dentry_addr in seen_dentries: + if int(dentry_addr) in seen_dentries: continue - seen_dentries.add(dentry_addr) + seen_dentries.add(int(dentry_addr)) inode_ptr = dentry.d_inode if not (inode_ptr and inode_ptr.is_readable()): @@ -283,9 +283,10 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): continue # Inode already processed? - if root_inode_ptr in seen_inodes: + if int(root_inode_ptr) in seen_inodes: continue - seen_inodes.add(root_inode_ptr) + + seen_inodes.add(int(root_inode_ptr)) root_path = mountpoint @@ -318,9 +319,9 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): continue # Inode already processed? - if file_inode_ptr in seen_inodes: + if int(file_inode_ptr) in seen_inodes: continue - seen_inodes.add(file_inode_ptr) + seen_inodes.add(int(file_inode_ptr)) if follow_symlinks: file_path = cls._follow_symlink(file_inode_ptr, file_path) From c641690c5366bd0c65864438e87157b6dc9218ce Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 09:10:38 -0500 Subject: [PATCH 2/5] Pagecache: revert cast to int `dentry.vol.offset` is already a basic Python `int`. --- volatility3/framework/plugins/linux/pagecache.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 6c27c94b2..7da42255d 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -204,10 +204,10 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): if dentry_addr == root_dentry.vol.offset: continue - if int(dentry_addr) in seen_dentries: + if dentry_addr in seen_dentries: continue - seen_dentries.add(int(dentry_addr)) + seen_dentries.add(dentry_addr) inode_ptr = dentry.d_inode if not (inode_ptr and inode_ptr.is_readable()): From 9ceec51b76711419d89ccf5ff1ae0b25a5b36f68 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 09:11:24 -0500 Subject: [PATCH 3/5] Pagecache: Add comments explaining cast Adds a couple of comments explaining why we're doing a lossy conversion to Python `int` (saving memory). --- volatility3/framework/plugins/linux/pagecache.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 7da42255d..87bd20b68 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -283,6 +283,10 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): continue # Inode already processed? + # Store a primitive int (instead of the pointer value) to track + # addresses we've already seen. Storing the full `objects.Pointer` + # uses too much memory, and we don't need all of the information + # that it contains. if int(root_inode_ptr) in seen_inodes: continue @@ -319,6 +323,10 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): continue # Inode already processed? + # Store a primitive int (instead of the pointer value) to track + # addresses we've already seen. Storing the full `objects.Pointer` + # uses too much memory, and we don't need all of the information + # that it contains. if int(file_inode_ptr) in seen_inodes: continue seen_inodes.add(int(file_inode_ptr)) From a236c0dd40a640850e6e9408c1dfbce502c4346b Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 18:30:19 -0500 Subject: [PATCH 4/5] linux.pagecache.Files: Trim unneeded cast Removes casts to `int` performed before checking set membership, since the computed `__hash__` value will be the same for both the Python primitive and the volatility `objects.Pointer`. --- volatility3/framework/plugins/linux/pagecache.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 87bd20b68..1fd96d5d2 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -287,7 +287,7 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): # addresses we've already seen. Storing the full `objects.Pointer` # uses too much memory, and we don't need all of the information # that it contains. - if int(root_inode_ptr) in seen_inodes: + if root_inode_ptr in seen_inodes: continue seen_inodes.add(int(root_inode_ptr)) @@ -327,7 +327,7 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): # addresses we've already seen. Storing the full `objects.Pointer` # uses too much memory, and we don't need all of the information # that it contains. - if int(file_inode_ptr) in seen_inodes: + if file_inode_ptr in seen_inodes: continue seen_inodes.add(int(file_inode_ptr)) From d29be5cbdea0ac75d4895588f98e92198408d5e0 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 18:38:47 -0500 Subject: [PATCH 5/5] Linux MountInfo: Remove unneeded cast --- volatility3/framework/plugins/linux/mountinfo.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/mountinfo.py b/volatility3/framework/plugins/linux/mountinfo.py index 9790c4b57..f00733a54 100644 --- a/volatility3/framework/plugins/linux/mountinfo.py +++ b/volatility3/framework/plugins/linux/mountinfo.py @@ -279,7 +279,7 @@ class MountInfo(plugins.PluginInterface): if not (sb_ptr and sb_ptr.is_readable()): continue - if int(sb_ptr) in seen_sb_ptr: + if sb_ptr in seen_sb_ptr: continue seen_sb_ptr.add(int(sb_ptr))