From d8cdd79843bfe897e754d9763864ff371904b6ad Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 24 Mar 2018 11:00:22 +0000 Subject: [PATCH] Add in pointer is_readable method to check if the pointer would translate properly. --- volatility/framework/objects/__init__.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index c4fb5d03c..537a31d3e 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -235,6 +235,12 @@ class Pointer(Integer): offset = offset, parent = self)) + def is_readable(self, layer_name: typing.Optional[str] = None) -> bool: + """Determines whether the address of this pointer can be read from memory""" + if layer_name is None: + layer_name = self.vol.layer_name + return self._context.memory[layer_name].is_valid(self) + def __getattr__(self, attr: str) -> typing.Any: """Convenience function to access unknown attributes by getting them from the subtype object""" return getattr(self.dereference(), attr)