diff --git a/test_rig.py b/test_rig.py index 9a8d4ee10..de465324e 100644 --- a/test_rig.py +++ b/test_rig.py @@ -72,10 +72,11 @@ def intel32e(ctx): def test_translation(): nativelst = native.x86NativeTable ctx = framework.Context(nativelst) - intel, x = intel32e(ctx) + intel, x = intel32(ctx) for val in x: - print(hex(val), hex(intel.translate(val))) + a, b = intel._translate(val) + print(hex(val), hex(a), hex(b)) #print(bin(0x39000), bin(0xffab8020)) #print(hex(intel.translate(0xffab8020))) diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py index 18adb798c..77eb709a3 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility/framework/layers/intel.py @@ -59,14 +59,14 @@ class Intel(interfaces.layers.TranslationLayerInterface): # Check if we're a large page if large_page and (entry & (1 << 7)): # We're a large page, the rest is finished below - # TODO: We'd have to implement PSE-36 here + # If we want to implement PSE-36, it would need to be done here break # Figure out how much of the offset we should be using start = position position -= size index = self._mask(offset, start, position + 1) >> (position + 1) - # Grab the first chunk of the entry we should be using + # Grab the base address of the table we'll be getting the next entry from base_address = self._mask(entry, self._maxphyaddr - 1, size + self._index_shift) # Create the offset for the next entry table_offset = base_address | (index << self._index_shift) @@ -77,13 +77,27 @@ class Intel(interfaces.layers.TranslationLayerInterface): if not self._page_is_valid(entry): raise exceptions.InvalidAddressException("Page Fault at entry " + hex(entry) + " in page entry") page = self._mask(entry, self._maxphyaddr - 1, position + 1) | self._mask(offset, position, 0) - return page, 1 << position + return page, 1 << (position + 1) def translate(self, offset): """Translates a specific offset based on the paging tables""" result, _ = self._translate(offset) return result + def mapping(self, offset, length): + """Returns a sorted list of (offset, mapped_offset, length, layer) mappings + + This allows translation layers to provide maps of contiguous regions in one layer + """ + result = [] + while length > 0: + chunk_offset, page_size = self._translate(offset) + chunk_size = min(page_size - (chunk_offset % page_size), length) + length -= chunk_size + offset -= chunk_size + result.append((chunk_offset, chunk_size)) + return result + class IntelPAE(Intel): """Class for handling Physical Address Extensions for Intel architectures"""