diff --git a/volatility/framework/layers/elf.py b/volatility/framework/layers/elf.py index 89d7e33fb..3e7b00947 100644 --- a/volatility/framework/layers/elf.py +++ b/volatility/framework/layers/elf.py @@ -1,14 +1,16 @@ # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # - +import logging import struct -from typing import Tuple, Optional +from typing import Optional from volatility.framework import exceptions, interfaces, constants from volatility.framework.layers import segmented from volatility.framework.symbols import intermed +vollog = logging.getLogger(__name__) + class ElfFormatException(exceptions.LayerException): """Thrown when an error occurs with the underlying ELF file format.""" @@ -48,7 +50,7 @@ class Elf64Layer(segmented.SegmentedLayer): self._segments = segments @classmethod - def _check_header(cls, base_layer: interfaces.layers.DataLayerInterface, offset: int = 0) -> Tuple[int, int]: + def _check_header(cls, base_layer: interfaces.layers.DataLayerInterface, offset: int = 0) -> bool: try: header_data = base_layer.read(offset, cls._header_struct.size) except exceptions.InvalidAddressException: @@ -59,9 +61,8 @@ class Elf64Layer(segmented.SegmentedLayer): raise ElfFormatException(base_layer.name, "Bad magic 0x{:x} at file offset 0x{:x}".format(magic, offset)) if elf_class != cls.ELF_CLASS: raise ElfFormatException(base_layer.name, "ELF class is not 64-bit (2): {:d}".format(elf_class, offset)) - if elf_version != 1: - raise ElfFormatException(base_layer.name, "ELF version is not 1: {:d}".format(elf_class, offset)) - return 0, 0 + # Virtualbox uses an ELF version of 0, which isn't to specification, but is ok to deal with + return True class Elf64Stacker(interfaces.automagic.StackerLayerInterface): @@ -73,8 +74,10 @@ class Elf64Stacker(interfaces.automagic.StackerLayerInterface): layer_name: str, progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]: try: - Elf64Layer._check_header(context.layers[layer_name]) - except ElfFormatException: + if not Elf64Layer._check_header(context.layers[layer_name]): + return None + except ElfFormatException as excp: + vollog.log(constants.LOGLEVEL_VVVV, "Exception: {}".format(excp)) return None new_name = context.layers.free_layer_name("Elf64Layer") context.config[interfaces.configuration.path_join(new_name, "base_layer")] = layer_name