From bfab5bfd235b5d5e308b945e3fa339de2c297fed Mon Sep 17 00:00:00 2001
From: Andrew Case <andrew@dfir.org>
Date: Wed, 5 Mar 2025 23:11:37 +0000
Subject: [PATCH] Properly decode values from ELF files even with partial smear

---
 volatility3/framework/symbols/linux/extensions/elf.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/volatility3/framework/symbols/linux/extensions/elf.py b/volatility3/framework/symbols/linux/extensions/elf.py
index f2bfa89bd..7105a05ea 100644
--- a/volatility3/framework/symbols/linux/extensions/elf.py
+++ b/volatility3/framework/symbols/linux/extensions/elf.py
@@ -340,7 +340,7 @@ class elf_sym(objects.StructType):
         if idx != -1:
             name_bytes = name_bytes[:idx]
 
-        return name_bytes.decode("utf-8", errors="ignore")
+        return name_bytes.decode("utf-8", errors="replace")
 
 
 class elf_phdr(objects.StructType):
@@ -446,7 +446,7 @@ class elf_linkmap(objects.StructType):
         idx = buf.find(b"\x00")
         if idx != -1:
             buf = buf[:idx]
-        return buf.decode("utf-8", errors="ignore")
+        return buf.decode("utf-8", errors="replace")
 
 
 class_types = {