WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 02:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1541 from volatilityfoundation/revert-1539-mac

Browse Source 
Revert "Small readability improvements"
This commit is contained in:
ikelos
2025-01-10 21:10:38 +00:00
committed by GitHub
parent b96a758809 7913fb2bb0
commit bedcaa24cd
1 changed files with 14 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/automagic/mac.py
+14 -11
View File
@@ -101,7 +101,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
except exceptions.InvalidAddressException:
vollog.log(
constants.LOGLEVEL_VVVV,
f"Skipping invalid idlepml4_ptr: {idlepml4_ptr:#x}",
f"Skipping invalid idlepml4_ptr: 0x{idlepml4_ptr:0x}",
)
continue
@@ -112,7 +112,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
if tmp_dtb % 4096:
vollog.log(
constants.LOGLEVEL_VVV,
f"Skipping non-page aligned DTB: {tmp_dtb:#x}",
f"Skipping non-page aligned DTB: 0x{tmp_dtb:0x}",
)
continue
@@ -136,7 +136,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
new_layer.config["kernel_virtual_offset"] = kaslr_shift
if new_layer and dtb:
vollog.debug(f"DTB was found at: {dtb:#x}")
vollog.debug(f"DTB was found at: 0x{dtb:0x}")
return new_layer
vollog.debug("No suitable mac banner could be matched")
return None
@@ -182,12 +182,14 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
aslr_shift = 0
for offset, banner in offset_generator:
banner_major, banner_minor = (int(x) for x in banner[22:].split(b".")[:2])
banner_major, banner_minor = (int(x) for x in banner[22:].split(b".")[0:2])
aslr_shift = offset - cls.virtual_to_physical_address(version_json_address)
tmp_aslr_shift = offset - cls.virtual_to_physical_address(
version_json_address
)
major_string = context.layers[layer_name].read(
version_major_phys_offset + aslr_shift, 4
version_major_phys_offset + tmp_aslr_shift, 4
)
major = struct.unpack("<I", major_string)[0]
@@ -195,17 +197,18 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
continue
minor_string = context.layers[layer_name].read(
version_minor_phys_offset + aslr_shift, 4
version_minor_phys_offset + tmp_aslr_shift, 4
)
minor = struct.unpack("<I", minor_string)[0]
if minor != banner_minor:
continue
if aslr_shift & 0xFFF != 0:
if tmp_aslr_shift & 0xFFF != 0:
continue
aslr_shift &= 0xFFFFFFFF
aslr_shift = tmp_aslr_shift & 0xFFFFFFFF
break
vollog.log(constants.LOGLEVEL_VVVV, f"Mac find_aslr returned: {aslr_shift:0x}")
@@ -216,9 +219,9 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
"""Converts a virtual mac address to a physical one (does not account
of ASLR)"""
if addr > 0xFFFFFF8000000000:
addr -= 0xFFFFFF8000000000
addr = addr - 0xFFFFFF8000000000
else:
addr -= 0xFF8000000000
addr = addr - 0xFF8000000000
return addr