From bb0a17004f004b6eac4113a3e9377acdc4bc6e6c Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 14 Mar 2025 20:59:15 +0000 Subject: [PATCH] Add return_truncated for plugin-specified handling of truncated strings --- volatility3/framework/objects/utility.py | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index f1ee701bf..a29b65875 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -150,8 +150,19 @@ def gather_contiguous_bytes_from_address( ) -def bytes_to_decoded_string(data: bytes, encoding: str, errors: str) -> bytes: +def bytes_to_decoded_string( + data: bytes, encoding: str, errors: str, return_truncated: bool = True +) -> bytes: """ + Args: + data: The `bytes` buffer containing the string of a string at offset 0 + encoding: An encoding value for the encoding paramater of `bytes.decode` + errors: An errors value for the errors parameter of `bytes.decode` + return_truncated: Dictates whether truncated strings should be returned or + if a ValueError should be thrown if a truncated (broken) string was decoded + Returns: + bytes: The decoded string starting at offset of data + This function takes a bytes buffer that contains at a string of unknown length starting at the first byte, and returns the properly decoded string @@ -173,7 +184,12 @@ def bytes_to_decoded_string(data: bytes, encoding: str, errors: str) -> bytes: try: idx = termination_re.search(full_decoded_string).start() except AttributeError: - idx = len(full_decoded_string) + if return_truncated: + idx = len(full_decoded_string) + else: + raise ValueError( + "return_truncated set to False and truncated string decoded." + ) # cut at terminating byte, if found data = data[:idx]