diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index 4108d7231..e6a3244cb 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -376,6 +376,7 @@ class Intel(linear.LinearlyMappedLayer): yield offset, length, mapped_offset, length, layer_name return None while length > 0: + skip_mask = None try: chunk_offset, page_size, layer_name = self._translate(offset) # Page align the chunk size value @@ -386,11 +387,9 @@ class Intel(linear.LinearlyMappedLayer): # Virtual -> physical is contiguous in the chunk_size range. # If we fail, we can jump directly to the end as we know all bytes in between # aren't mapped (virtually and) physically anyway. - raise exceptions.PagedInvalidAddressException( - layer_name=layer_name, - invalid_address=chunk_offset, - entry=0, - invalid_bits=int(math.log2(chunk_size)), + skip_mask = chunk_size - 1 + raise exceptions.InvalidAddressException( + layer_name=layer_name, invalid_address=chunk_offset ) except ( exceptions.PagedInvalidAddressException, @@ -398,12 +397,13 @@ class Intel(linear.LinearlyMappedLayer): ) as excp: if not ignore_errors: raise - # We can jump more if we know where the page fault failed - if isinstance(excp, exceptions.PagedInvalidAddressException): - mask = (1 << excp.invalid_bits) - 1 - else: - mask = (1 << self._page_size_in_bits) - 1 - length_diff = mask + 1 - (offset & mask) + if skip_mask is None: + # We can jump more if we know where the page fault occured + if isinstance(excp, exceptions.PagedInvalidAddressException): + skip_mask = (1 << excp.invalid_bits) - 1 + else: + skip_mask = (1 << self._page_size_in_bits) - 1 + length_diff = skip_mask + 1 - (offset & skip_mask) length -= length_diff offset += length_diff else: