From 7913fb2bb0aac4cc390ce6e42ad6621115f0ae7c Mon Sep 17 00:00:00 2001
From: ikelos <ikelos@users.noreply.github.com>
Date: Fri, 10 Jan 2025 21:07:08 +0000
Subject: [PATCH] Revert "Small readability improvements"

---
 volatility3/framework/automagic/mac.py | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/volatility3/framework/automagic/mac.py b/volatility3/framework/automagic/mac.py
index 94c259463..f3679d160 100644
--- a/volatility3/framework/automagic/mac.py
+++ b/volatility3/framework/automagic/mac.py
@@ -101,7 +101,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
                 except exceptions.InvalidAddressException:
                     vollog.log(
                         constants.LOGLEVEL_VVVV,
-                        f"Skipping invalid idlepml4_ptr: {idlepml4_ptr:#x}",
+                        f"Skipping invalid idlepml4_ptr: 0x{idlepml4_ptr:0x}",
                     )
                     continue
 
@@ -112,7 +112,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
                 if tmp_dtb % 4096:
                     vollog.log(
                         constants.LOGLEVEL_VVV,
-                        f"Skipping non-page aligned DTB: {tmp_dtb:#x}",
+                        f"Skipping non-page aligned DTB: 0x{tmp_dtb:0x}",
                     )
                     continue
 
@@ -136,7 +136,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
                 new_layer.config["kernel_virtual_offset"] = kaslr_shift
 
             if new_layer and dtb:
-                vollog.debug(f"DTB was found at: {dtb:#x}")
+                vollog.debug(f"DTB was found at: 0x{dtb:0x}")
                 return new_layer
         vollog.debug("No suitable mac banner could be matched")
         return None
@@ -182,12 +182,14 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
         aslr_shift = 0
 
         for offset, banner in offset_generator:
-            banner_major, banner_minor = (int(x) for x in banner[22:].split(b".")[:2])
+            banner_major, banner_minor = (int(x) for x in banner[22:].split(b".")[0:2])
 
-            aslr_shift = offset - cls.virtual_to_physical_address(version_json_address)
+            tmp_aslr_shift = offset - cls.virtual_to_physical_address(
+                version_json_address
+            )
 
             major_string = context.layers[layer_name].read(
-                version_major_phys_offset + aslr_shift, 4
+                version_major_phys_offset + tmp_aslr_shift, 4
             )
             major = struct.unpack("<I", major_string)[0]
 
@@ -195,17 +197,18 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
                 continue
 
             minor_string = context.layers[layer_name].read(
-                version_minor_phys_offset + aslr_shift, 4
+                version_minor_phys_offset + tmp_aslr_shift, 4
             )
             minor = struct.unpack("<I", minor_string)[0]
 
             if minor != banner_minor:
                 continue
 
-            if aslr_shift & 0xFFF != 0:
+            if tmp_aslr_shift & 0xFFF != 0:
                 continue
 
-        aslr_shift &= 0xFFFFFFFF
+            aslr_shift = tmp_aslr_shift & 0xFFFFFFFF
+            break
 
         vollog.log(constants.LOGLEVEL_VVVV, f"Mac find_aslr returned: {aslr_shift:0x}")
 
@@ -216,9 +219,9 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
         """Converts a virtual mac address to a physical one (does not account
         of ASLR)"""
         if addr > 0xFFFFFF8000000000:
-            addr -= 0xFFFFFF8000000000
+            addr = addr - 0xFFFFFF8000000000
         else:
-            addr -= 0xFF8000000000
+            addr = addr - 0xFF8000000000
 
         return addr