WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-30 19:59:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

Layers: Fix QEMU layer cutting off the last byte of the config

Browse Source
This commit is contained in:
Mike Auty
2023-01-06 22:10:50 +00:00
parent af3b70320e
commit cd89e39ee0
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/layers/qemu.py
+4 -2
View File
@@ -117,13 +117,15 @@ class QemuSuspendLayer(segmented.NonLinearlySegmentedLayer):
chunk_size = 4096
data = b""
for i in range(
base_layer.maximum_address, base_layer.minimum_address, -chunk_size
base_layer.maximum_address + 1, base_layer.minimum_address, -chunk_size
):
if i != base_layer.maximum_address:
# Since we're going backwards, we need to include one extra byte so the tail doesn't get chopped off
if i != base_layer.maximum_address + 1:
data = (base_layer.read(i, chunk_size) + data).rstrip(b"\x00")
if b"\x00" in data:
last_null_byte = data.rfind(b"\x00")
start_of_json = data.find(b"{", last_null_byte)
if start_of_json >= 0:
data = data[start_of_json:]
return json.loads(data)