From a0f7c8112862c513c6208df7efaa5b256e24bb4b Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 4 Dec 2016 02:14:54 +0000 Subject: [PATCH] Reveal the register size in intel spaces. --- volatility/framework/layers/intel.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py index caf249562..c1cccefcb 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility/framework/layers/intel.py @@ -36,6 +36,10 @@ class Intel(interfaces.layers.TranslationLayerInterface): self._structure = [('page directory', 10, False), ('page table', 10, True)] + @property + def bits_per_register(self): + return self._bits_per_register + @property def minimum_address(self): return 0 @@ -66,8 +70,8 @@ class Intel(interfaces.layers.TranslationLayerInterface): # Setup the entry and how far we are through the offset # Position maintains the number of bits left to process # We or with 0x1 to ensure our page_map_offset is always valid - entry = self._mask(self._page_map_offset, self._bits_per_register - 1, 0) | 0x1 position = min(self._maxvirtaddr, self._bits_per_register) - 1 + entry = self._mask(self._page_map_offset, position, 0) | 0x1 # Run through the offset in various chunks for (name, size, large_page) in self._structure: