From 140a16d1dd263e4985413d166fb6e40111fa1051 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 5 May 2025 21:44:05 +0200 Subject: [PATCH 1/2] prevent forward slashes only dentry names --- volatility3/framework/symbols/linux/__init__.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 9d3930087..fbe0fdad3 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -190,9 +190,13 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): parent = dentry.d_parent dname = dentry.d_name.name_as_str() - path_reversed.append(dname.strip("/")) + dname_stripped = dname.strip("/") + if dname_stripped: + path_reversed.append(dname_stripped) dentry = parent + if path_reversed == []: + return "" path = "/" + "/".join(reversed(path_reversed)) return path From 2759df89dbf38ba3bd515624642db527b16b03e6 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 6 May 2025 00:31:09 +0200 Subject: [PATCH 2/2] tag potentially smeared dentry names --- volatility3/framework/symbols/linux/__init__.py | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index fbe0fdad3..65f20d88d 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -169,6 +169,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): return "" path_reversed = [] + smeared = False while ( dentry and dentry.is_readable() @@ -190,14 +191,16 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): parent = dentry.d_parent dname = dentry.d_name.name_as_str() - dname_stripped = dname.strip("/") - if dname_stripped: - path_reversed.append(dname_stripped) + # empty dentry names are most likely + # the result of smearing + if not dname: + smeared = True + path_reversed.append(dname.strip("/")) dentry = parent - if path_reversed == []: - return "" path = "/" + "/".join(reversed(path_reversed)) + if smeared: + return f" {path}" return path @classmethod