diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py index e5154ac99..f7976723f 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility/framework/layers/intel.py @@ -136,11 +136,21 @@ class Intel(interfaces.layers.TranslationLayerInterface): # Grab the base address of the table we'll be getting the next entry from base_address = self._mask(entry, self._maxphyaddr - 1, size + self._index_shift) - # Create the offset for the next entry - table_offset = base_address | (index << self._index_shift) + + table = self._context.memory.read(self._base_layer, base_address, self.page_size) + + # If the table is entirely duplicates, then mark the whole table as bad + if (table == table[:struct.calcsize(self._entry_format)] * + (self.page_size // struct.calcsize(self._entry_format))): + raise exceptions.PagedInvalidAddressException(self.name, offset, position + 1, entry, + "Page Fault at entry " + hex(entry) + " in table " + name) + # Read the data for the next entry + entry_data = table[(index << self._index_shift): + (index << self._index_shift) + struct.calcsize(self._entry_format)] + # Read out the new entry from memory - entry, = struct.unpack(self._entry_format, self._context.memory.read(self._base_layer, table_offset, - struct.calcsize(self._entry_format))) + entry, = struct.unpack(self._entry_format, entry_data) + return entry, position def _process_table(self, entry: int, page: int, layer_name: str) -> None: