From d4045c9c138d077f607ccb81371dbb6d53cda694 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 2 Mar 2019 22:44:51 +0000 Subject: [PATCH] Significant fix for reading from the start of SegmentedLayers (including Lime) when ignoring errors. --- volatility/framework/interfaces/layers.py | 3 ++- volatility/framework/layers/segmented.py | 15 +++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/volatility/framework/interfaces/layers.py b/volatility/framework/interfaces/layers.py index 487e72a2e..d489bb9f2 100644 --- a/volatility/framework/interfaces/layers.py +++ b/volatility/framework/interfaces/layers.py @@ -383,7 +383,8 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): current_offset = offset elif offset < current_offset: raise exceptions.LayerException("Mapping returned an overlapping element") - output += [self._context.memory.read(layer, mapped_offset, mapped_length, pad)] + if mapped_length > 0: + output += [self._context.memory.read(layer, mapped_offset, mapped_length, pad)] current_offset += mapped_length recovered_data = b"".join(output) return recovered_data + b"\x00" * (length - len(recovered_data)) diff --git a/volatility/framework/layers/segmented.py b/volatility/framework/layers/segmented.py index 97bc6b86e..82aa21f5d 100644 --- a/volatility/framework/layers/segmented.py +++ b/volatility/framework/layers/segmented.py @@ -73,14 +73,13 @@ class SegmentedLayer(interfaces.layers.TranslationLayerInterface, metaclass = AB # Find rightmost value less than or equal to x i = bisect_right(self._segments, (offset, self.context.memory[self._base_layer].maximum_address)) - if i: - if not next: - segment = self._segments[i - 1] - if segment[0] <= offset < segment[0] + segment[2]: - return segment - else: - if i < len(self._segments): - return self._segments[i] + if i and not next: + segment = self._segments[i - 1] + if segment[0] <= offset < segment[0] + segment[2]: + return segment + if next: + if i < len(self._segments): + return self._segments[i] raise exceptions.InvalidAddressException(self.name, offset, "Invalid address at {:0x}".format(offset)) def mapping(self, offset: int, length: int, ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, str]]: