From ae08c8ecfc8dd85f3c33af3a4307dd1cd86df243 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 5 May 2025 13:14:19 +0100 Subject: [PATCH] Support setting the breakpoint on the lowest layer --- volatility3/cli/volshell/generic.py | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 7ff30909f..20fbae417 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -799,7 +799,9 @@ class Volshell(interfaces.plugins.PluginInterface): return constructed - def breakpoint(self, address: int, layer_name: Optional[str] = None) -> None: + def breakpoint( + self, address: int, layer_name: Optional[str] = None, lowest: bool = False + ) -> None: """Sets a breakpoint on a particular address (within a specific layer)""" if layer_name is None: if self.current_layer is None: @@ -807,6 +809,18 @@ class Volshell(interfaces.plugins.PluginInterface): layer_name = self.current_layer layer: interfaces.layers.DataLayerInterface = self.context.layers[layer_name] + + if lowest: + while isinstance(layer, interfaces.layers.TranslationLayerInterface): + mapping = layer.mapping(address, 1) + if not mapping: + raise ValueError( + "Offset cannot be mapped lower, cannot break at lowest layer" + ) + _, _, mapped_offset, _, mapped_layer_name = next(mapping) + layer = self.context.layers[mapped_layer_name] + address = mapped_offset + # Check if the read value is already overloaded if not hasattr(layer.read, "breakpoints"): # Layer read is not yet wrapped @@ -825,6 +839,7 @@ class Volshell(interfaces.plugins.PluginInterface): setattr(layer, "read", wrapped_read) # Add the new breakpoint + print(f"Setting breakpoint {address:x} on {layer.name}") breakpoints = getattr(layer.read, "breakpoints") breakpoints.add(address) setattr(layer.read, "breakpoints", breakpoints)