From ec04dc9caa8ff614d5aea92c19526ecb0f263713 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 30 Jun 2021 13:18:37 +1000 Subject: [PATCH] Fix issue #522: private attribute names mangle As per https://docs.python.org/3/tutorial/classes.html#private-variables Python will mangle private attribute names from `__attrname` to `_classname__attrname` to avoid name clashes of names with names defined by subclasses. This will happen even if subclasses are not involved i.e.: calling `type_member.__foo` from a plugin classmethod. Note that `__foo` is not meant to be a Python private attribute, but the actual name of the type member. Like sock.__sk_common here: https://github.com/torvalds/linux/blob/62fb9874f5da54fdb243003b386128037319b219/include/net/sock.h#L354 We need to strip the '_classname' prefix from the attribute's name before continuing with the member attribute lookup. --- volatility3/framework/objects/__init__.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility3/framework/objects/__init__.py b/volatility3/framework/objects/__init__.py index 2f2829653..2129c9d81 100644 --- a/volatility3/framework/objects/__init__.py +++ b/volatility3/framework/objects/__init__.py @@ -732,6 +732,10 @@ class AggregateType(interfaces.objects.ObjectInterface): def __getattr__(self, attr: str) -> Any: """Method for accessing members of the type.""" + + if attr.startswith("_") and not attr.startswith("__") and "__" in attr: + attr = attr[attr.find("_", 1):] # See issue #522 + if attr in ['_concrete_members', 'vol']: raise AttributeError("Object has not been properly initialized") if attr in self._concrete_members: