WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-23 22:52:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

Vastly speed-up intel memory traversals

Browse Source 
This uses the exceptions to indicate how much can be skipped in the
virtual intel translation layer.  This means large holes in the memory
can be skipped more quickly.  It also eliminates the is_valid/mapping
loop.
This commit is contained in:
Mike Auty
2018-05-07 23:10:01 +01:00
parent 2cb5435911
commit e53cb16485
1 changed files with 17 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/layers/intel.py
+17 -13
View File
@@ -152,23 +152,27 @@ class Intel(interfaces.layers.TranslationLayerInterface):
This allows translation layers to provide maps of contiguous regions in one layer
"""
if length == 0:
if ignore_errors and not self.is_valid(offset):
try:
mapped_offset, _, layer_name = self._translate(offset)
except exceptions.InvalidAddressException:
if not ignore_errors:
raise
raise StopIteration
mapped_offset, _, layer_name = self._translate(offset)
yield (offset, mapped_offset, length, layer_name)
raise StopIteration
while length > 0:
if ignore_errors:
while not self.is_valid(offset) and length > 0:
length -= 1 << self._page_size_in_bits
offset += 1 << self._page_size_in_bits
if length <= 0:
raise StopIteration
chunk_offset, page_size, layer_name = self._translate(offset)
chunk_size = min(page_size - (chunk_offset % page_size), length)
yield (offset, chunk_offset, chunk_size, layer_name)
length -= chunk_size
offset += chunk_size
try:
chunk_offset, page_size, layer_name = self._translate(offset)
except exceptions.PagedInvalidAddressException as excp:
mask = (1 << excp.invalid_bits) - 1
length_diff = (mask + 1 - (offset & mask))
length -= length_diff
offset += length_diff
else:
chunk_size = min(page_size - (chunk_offset % page_size), length)
yield (offset, chunk_offset, chunk_size, layer_name)
length -= chunk_size
offset += chunk_size
@property
def dependencies(self) -> typing.List[str]: