diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index b014e37fa..f1ee701bf 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -119,20 +119,26 @@ def gather_contiguous_bytes_from_address( data = b"" - last_address = None + if isinstance(data_layer, interfaces.layers.TranslationLayerInterface): + last_address = None + + for address, length, _, _, _ in data_layer.mapping( + offset=starting_address, length=count, ignore_errors=True + ): + # Used to track when we hit a paged out page + if not last_address: + last_address = address + length + + # we hit a swapped out page + elif last_address and last_address != address: + break + + data += data_layer.read(address, length) - for address, length, _, _, _ in data_layer.mapping( - offset=starting_address, length=count, ignore_errors=True - ): - # Used to track when we hit a paged out page - if not last_address: last_address = address + length - # we hit a swapped out page - elif last_address and last_address != address: - break - - data += data_layer.read(address, length) + elif starting_address + count < data_layer.maximum_address: + data = data_layer.read(starting_address, count) # if we were able to read from the first page, we want to try and construct the string # if the first page fails -> throw exception @@ -143,8 +149,6 @@ def gather_contiguous_bytes_from_address( layer_name=data_layer, invalid_address=starting_address ) - return data - def bytes_to_decoded_string(data: bytes, encoding: str, errors: str) -> bytes: """