WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 03:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fixing memory wrong memory offset in hex dump

Browse Source
This commit is contained in:
tvanegro
2025-06-17 16:12:22 +02:00
parent 53b3bd7d47
commit e13b8f9bd0
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/malware/malfind.py
+8 -4
View File
@@ -85,15 +85,17 @@ class Malfind(interfaces.plugins.PluginInterface):
if vma.is_suspicious(proc_layer) and vma_name != "[vdso]":
malicious_pages = vma.get_malicious_pages(proc_layer)
offset = 0
if dump_page:
# Dumping each dirty page
for page_addr in malicious_pages:
offset = page_addr - vma.vm_start
data = proc_layer.read(page_addr, dump_size, pad=True)
yield vma, f"{vma_name}, page address: {page_addr:#x}, offset: {page_addr-vma.vm_start:#x}", data
yield vma, f"{vma_name}, page address: {page_addr:#x}, offset: {offset:#x}", data, offset
else:
# Original behaviour - Dump the start of the region (not necessarily matching the dirty page)
data = proc_layer.read(vma.vm_start, dump_size, pad=True)
yield vma, vma_name, data
yield vma, vma_name, data, offset
def _generator(self, tasks):
# determine if we're on a 32 or 64 bit kernel
@@ -105,13 +107,15 @@ class Malfind(interfaces.plugins.PluginInterface):
for task in tasks:
process_name = utility.array_to_string(task.comm)
for vma, vma_name, data in self._list_injections(task):
for vma, vma_name, data, offset in self._list_injections(task):
if is_32bit_arch:
architecture = "intel"
else:
architecture = "intel64"
disasm = renderers.Disassembly(data, vma.vm_start, architecture)
disasm = renderers.Disassembly(
data, vma.vm_start + offset, architecture
)
yield (
0,