diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 39605cf52..2094d63da 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -256,14 +256,22 @@ class module(generic.GenericIntelProcess): elf_sym_obj.cached_strtab = self.section_strtab yield elf_sym_obj - def get_symbols_names_and_addresses(self) -> Iterable[Tuple[str, int]]: + def get_symbols_names_and_addresses( + self, max_symbols: int = 4096 + ) -> Iterable[Tuple[str, int]]: """Get names and addresses for each symbol of the module Yields: A tuple for each symbol containing the symbol name and its corresponding value """ layer = self._context.layers[self.vol.layer_name] - for elf_sym_obj in self.get_symbols(): + for iteration_counter, elf_sym_obj in enumerate(self.get_symbols()): + if iteration_counter > max_symbols: + vollog.debug( + f"Hit maximum symbols ({max_symbols}) for ELF at {self.vol.offset:#x} in layer {self.vol.layer_name}" + ) + return + sym_name = elf_sym_obj.get_name() if not sym_name: continue diff --git a/volatility3/framework/symbols/linux/extensions/elf.py b/volatility3/framework/symbols/linux/extensions/elf.py index 7105a05ea..564439c64 100644 --- a/volatility3/framework/symbols/linux/extensions/elf.py +++ b/volatility3/framework/symbols/linux/extensions/elf.py @@ -329,7 +329,10 @@ class elf_sym(objects.StructType): def get_name(self) -> Optional[str]: """Returns the symbol name""" - addr = self._cached_strtab + self.st_name + try: + addr = self._cached_strtab + self.st_name + except exceptions.InvalidAddressException: + return None layer = self._context.layers[self.vol.layer_name] name_bytes = layer.read(addr, self._MAX_NAME_LENGTH, pad=True)