From c01f3c5556141102eac1a4ca65c8f63fabacb253 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 5 Feb 2025 19:17:25 +0100 Subject: [PATCH] non inclusive upper bound address check --- volatility3/framework/symbols/linux/utilities/modules.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index baaeff683..d03e76c88 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -35,13 +35,16 @@ class Modules(interfaces.configuration.VersionableInterface): Returns: The first memory module in which the address fits + + Kernel documentation: + "within_module" and "within_module_mem_type" functions """ matches = [] seen_addresses = set() for module in modules: _, start, end = cls.mask_mods_list(context, layer_name, [module])[0] if ( - start <= target_address <= end + start <= target_address < end and module.vol.offset not in seen_addresses ): matches.append(module)