diff --git a/volatility3/framework/interfaces/layers.py b/volatility3/framework/interfaces/layers.py index 4f5314d74..0cf7e087a 100644 --- a/volatility3/framework/interfaces/layers.py +++ b/volatility3/framework/interfaces/layers.py @@ -491,7 +491,14 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): # Setup the variables for this block block_start = offset block_end = offset + sublength - conversion = mapped_offset - offset + + # Setup the necessary bits for non-linear mappings + # For linear we give one layer down and mapped offsets (therefore the conversion) + # This saves an tiny amount of time not have to redo lookups we've already done + # For non-linear layers, we give the layer name and the offset in the layer name + # so that the read/conversion occurs properly + conversion = mapped_offset - offset if linear else 0 + return_name = layer_name if linear else self.name # If this isn't contiguous, start a new chunk if chunk_position < block_start: @@ -499,8 +506,6 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): output = [] chunk_start = chunk_position = block_start - return_name = self.name if not linear else layer_name - # Halfway through a chunk, finish the chunk, then take more if chunk_position != chunk_start: chunk_size = min(chunk_position - chunk_start, scanner.chunk_size + scanner.overlap)