From e089314898f572fca563e53eb6196699488a7dbb Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 26 Jan 2020 20:40:47 +0000 Subject: [PATCH] Layers: Add pad option to the decode/encode steps --- volatility/framework/interfaces/layers.py | 6 +++--- volatility/framework/layers/linear.py | 3 +++ 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/volatility/framework/interfaces/layers.py b/volatility/framework/interfaces/layers.py index 80c04b20a..b2c2dc544 100644 --- a/volatility/framework/interfaces/layers.py +++ b/volatility/framework/interfaces/layers.py @@ -395,7 +395,7 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): """Returns a list of layer names that this layer translates onto.""" return [] - def _decode_data(self, layer_name: str, mapped_offset: int, offset: int, output_length: int) -> bytes: + def _decode_data(self, layer_name: str, mapped_offset: int, offset: int, output_length: int, pad: bool) -> bytes: """Decodes any necessary data. Args: @@ -407,7 +407,7 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): Returns: The data to be read from the underlying layer.""" - return self._context.layers.read(layer_name, mapped_offset, output_length) + return self._context.layers.read(layer_name, mapped_offset, output_length, pad = pad) def _encode_data(self, layer_name: str, mapped_offset: int, offset: int, value: bytes) -> bytes: """Encodes any necessary data. @@ -442,7 +442,7 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): # The layer_offset can be less than the current_offset in non-linearly mapped layers # it does not suggest an overlap, but that the data is in an encoded block if mapped_length > 0: - processed_data = self._decode_data(layer, mapped_offset, layer_offset, sublength) + processed_data = self._decode_data(layer, mapped_offset, layer_offset, sublength, pad) if len(processed_data) != sublength: raise ValueError("ProcessedData length does not match expected length of chunk") output += processed_data diff --git a/volatility/framework/layers/linear.py b/volatility/framework/layers/linear.py index 0497bc6d6..797785a4d 100644 --- a/volatility/framework/layers/linear.py +++ b/volatility/framework/layers/linear.py @@ -77,6 +77,9 @@ class LinearlyMappedLayer(interfaces.layers.TranslationLayerInterface): # Prev offset keeps track of the end of the previous subchunk prev_offset = chunk_start output = [] # type: List[Tuple[str, int, int]] + + # Returning the segments of the layer below only works with linearly mapped layers that don't process + # the data in some way # We populate the response based on subchunks that may be mapped all over the place for mapped in self.mapping(chunk_start, chunk_length, ignore_errors = True): offset, _, mapped_offset, mapped_length, layer_name = mapped