From c8d90cffe43a7440b60322a2b19a16cdd7c5f22c Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 8 May 2025 12:52:18 +0200 Subject: [PATCH] adjust to the new NULL-terminated processing --- .../symbols/linux/extensions/__init__.py | 23 +++++++++++-------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 22d06baea..953e3cb89 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -187,26 +187,31 @@ class module(generic.GenericIntelProcess): """ if grp.has_member("bin_attrs"): - arr_offset = grp.bin_attrs + arr_offset_ptr = grp.bin_attrs + arr_subtype = "bin_attribute" else: - arr_offset = grp.attrs + arr_offset_ptr = grp.attrs + arr_subtype = "attribute" - if not arr_offset.is_readable(): + if not arr_offset_ptr.is_readable(): vollog.log( constants.LOGLEVEL_V, f"Cannot dereference the pointer to the NULL-terminated list of binary attributes for module at offset {self.vol.offset:#x}", ) return 0 - # We chose 1000 as an arbitrary guard value against - # extreme cases of smearing. + # We chose 100 as an arbitrary guard value to prevent + # looping forever in extreme cases, and because 100 is not expected + # to be a valid number of sections. If that still happens, + # Vol3 module processing will indicate that it is missing information + # with the following message: + # "Unable to reconstruct the ELF for module struct at" # See PR #1773 for more information. bin_attrs_list = utility.dynamically_sized_array_of_pointers( context=self._context, - layer_name=self.vol.layer_name, - symbol_table_name=self.get_symbol_table_name(), - array_offset=arr_offset.dereference().vol.offset, - iterator_guard_value=1000, + array=arr_offset_ptr.dereference(), + iterator_guard_value=100, + subtype=self.get_symbol_table_name() + constants.BANG + arr_subtype, ) return len(bin_attrs_list)