diff --git a/volatility/framework/interfaces/layers.py b/volatility/framework/interfaces/layers.py index 80c04b20a..b2c2dc544 100644 --- a/volatility/framework/interfaces/layers.py +++ b/volatility/framework/interfaces/layers.py @@ -395,7 +395,7 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): """Returns a list of layer names that this layer translates onto.""" return [] - def _decode_data(self, layer_name: str, mapped_offset: int, offset: int, output_length: int) -> bytes: + def _decode_data(self, layer_name: str, mapped_offset: int, offset: int, output_length: int, pad: bool) -> bytes: """Decodes any necessary data. Args: @@ -407,7 +407,7 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): Returns: The data to be read from the underlying layer.""" - return self._context.layers.read(layer_name, mapped_offset, output_length) + return self._context.layers.read(layer_name, mapped_offset, output_length, pad = pad) def _encode_data(self, layer_name: str, mapped_offset: int, offset: int, value: bytes) -> bytes: """Encodes any necessary data. @@ -442,7 +442,7 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): # The layer_offset can be less than the current_offset in non-linearly mapped layers # it does not suggest an overlap, but that the data is in an encoded block if mapped_length > 0: - processed_data = self._decode_data(layer, mapped_offset, layer_offset, sublength) + processed_data = self._decode_data(layer, mapped_offset, layer_offset, sublength, pad) if len(processed_data) != sublength: raise ValueError("ProcessedData length does not match expected length of chunk") output += processed_data diff --git a/volatility/framework/layers/linear.py b/volatility/framework/layers/linear.py index 0497bc6d6..797785a4d 100644 --- a/volatility/framework/layers/linear.py +++ b/volatility/framework/layers/linear.py @@ -77,6 +77,9 @@ class LinearlyMappedLayer(interfaces.layers.TranslationLayerInterface): # Prev offset keeps track of the end of the previous subchunk prev_offset = chunk_start output = [] # type: List[Tuple[str, int, int]] + + # Returning the segments of the layer below only works with linearly mapped layers that don't process + # the data in some way # We populate the response based on subchunks that may be mapped all over the place for mapped in self.mapping(chunk_start, chunk_length, ignore_errors = True): offset, _, mapped_offset, mapped_length, layer_name = mapped