From 18abe9c50815b2e6186f0cf6201b2411b617272f Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 17 Mar 2025 15:25:43 +0000 Subject: [PATCH 1/2] Fix first set of ELF parsing unhandled smear protection --- .../framework/symbols/linux/extensions/__init__.py | 8 ++++++-- volatility3/framework/symbols/linux/extensions/elf.py | 5 ++++- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 39605cf52..dd0f23d34 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -256,14 +256,18 @@ class module(generic.GenericIntelProcess): elf_sym_obj.cached_strtab = self.section_strtab yield elf_sym_obj - def get_symbols_names_and_addresses(self) -> Iterable[Tuple[str, int]]: + def get_symbols_names_and_addresses(self, max_symbols: int = 4096) -> Iterable[Tuple[str, int]]: """Get names and addresses for each symbol of the module Yields: A tuple for each symbol containing the symbol name and its corresponding value """ layer = self._context.layers[self.vol.layer_name] - for elf_sym_obj in self.get_symbols(): + for iteration_counter, elf_sym_obj in enumerate(self.get_symbols()): + if iteration_counter > max_symbols: + vollog.debug(f"Hit maximum symbols ({max_symbols}) for ELF at {self.vol.offset:#x} in layer {self.vol.layer_name}") + return + sym_name = elf_sym_obj.get_name() if not sym_name: continue diff --git a/volatility3/framework/symbols/linux/extensions/elf.py b/volatility3/framework/symbols/linux/extensions/elf.py index 7105a05ea..564439c64 100644 --- a/volatility3/framework/symbols/linux/extensions/elf.py +++ b/volatility3/framework/symbols/linux/extensions/elf.py @@ -329,7 +329,10 @@ class elf_sym(objects.StructType): def get_name(self) -> Optional[str]: """Returns the symbol name""" - addr = self._cached_strtab + self.st_name + try: + addr = self._cached_strtab + self.st_name + except exceptions.InvalidAddressException: + return None layer = self._context.layers[self.vol.layer_name] name_bytes = layer.read(addr, self._MAX_NAME_LENGTH, pad=True) From 4b403d50ef291920cb50aa7008ab6ce96c1280d9 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 17 Mar 2025 15:29:28 +0000 Subject: [PATCH 2/2] Fix first set of ELF parsing unhandled smear protection --- .../framework/symbols/linux/extensions/__init__.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index dd0f23d34..2094d63da 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -256,7 +256,9 @@ class module(generic.GenericIntelProcess): elf_sym_obj.cached_strtab = self.section_strtab yield elf_sym_obj - def get_symbols_names_and_addresses(self, max_symbols: int = 4096) -> Iterable[Tuple[str, int]]: + def get_symbols_names_and_addresses( + self, max_symbols: int = 4096 + ) -> Iterable[Tuple[str, int]]: """Get names and addresses for each symbol of the module Yields: @@ -265,7 +267,9 @@ class module(generic.GenericIntelProcess): layer = self._context.layers[self.vol.layer_name] for iteration_counter, elf_sym_obj in enumerate(self.get_symbols()): if iteration_counter > max_symbols: - vollog.debug(f"Hit maximum symbols ({max_symbols}) for ELF at {self.vol.offset:#x} in layer {self.vol.layer_name}") + vollog.debug( + f"Hit maximum symbols ({max_symbols}) for ELF at {self.vol.offset:#x} in layer {self.vol.layer_name}" + ) return sym_name = elf_sym_obj.get_name()