Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Linux and Windows: Ensure linked list object extensions consistently yield valid entries #1543

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

Linux and Windows: Ensure linked list object extensions consistently yield valid entries #1543

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 25 additions & 17 deletions volatility3/framework/symbols/linux/extensions/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1209,35 +1209,43 @@ def to_list(
Objects of the type specified via the "symbol_type" argument.

"""
layer = layer or self.vol.layer_name
layer_name = layer or self.vol.layer_name

trans_layer = self._context.layers[layer_name]
if not trans_layer.is_valid(self.vol.offset):
return None

relative_offset = self._context.symbol_space.get_type(
symbol_type
).relative_child_offset(member)

direction = "prev"
if forward:
direction = "next"
try:
link = getattr(self, direction).dereference()
except exceptions.InvalidAddressException:
direction = "next" if forward else "prev"

link_ptr = getattr(self, direction)
if not (link_ptr and link_ptr.is_readable()):
return None
link = link_ptr.dereference()

if not sentinel:
yield self._context.object(
symbol_type, layer, offset=self.vol.offset - relative_offset
)
obj_offset = self.vol.offset - relative_offset
if not trans_layer.is_valid(obj_offset):
return None

yield self._context.object(symbol_type, layer_name, offset=obj_offset)

seen = {self.vol.offset}
while link.vol.offset not in seen:
obj = self._context.object(
symbol_type, layer, offset=link.vol.offset - relative_offset
)
yield obj
obj_offset = link.vol.offset - relative_offset
if not trans_layer.is_valid(obj_offset):
return None

yield self._context.object(symbol_type, layer_name, offset=obj_offset)

seen.add(link.vol.offset)
try:
link = getattr(link, direction).dereference()
except exceptions.InvalidAddressException:
link_ptr = getattr(link, direction)
if not (link_ptr and link_ptr.is_readable()):
break
link = link_ptr.dereference()

def __iter__(self) -> Iterator[interfaces.objects.ObjectInterface]:
return self.to_list(self.vol.parent.vol.type_name, self.vol.member_name)
Expand Down
47 changes: 23 additions & 24 deletions volatility3/framework/symbols/windows/extensions/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -962,56 +962,55 @@ def to_list(
) -> Iterator[interfaces.objects.ObjectInterface]:
"""Returns an iterator of the entries in the list."""

layer = layer or self.vol.layer_name
layer_name = layer or self.vol.layer_name
native_layer_name = layer_name or self.vol.native_layer_name

trans_layer = self._context.layers[layer_name]
if not trans_layer.is_valid(self.vol.offset):
return None

relative_offset = self._context.symbol_space.get_type(
symbol_type
).relative_child_offset(member)

direction = "Blink"
if forward:
direction = "Flink"

trans_layer = self._context.layers[layer]

try:
is_valid = trans_layer.is_valid(self.vol.offset)
if not is_valid:
return None
direction = "Flink" if forward else "Blink"

link = getattr(self, direction).dereference()
except exceptions.InvalidAddressException:
link_ptr = getattr(self, direction)
if not (link_ptr and link_ptr.is_readable()):
return None
link = link_ptr.dereference()

if not sentinel:
obj_offset = self.vol.offset - relative_offset
if not trans_layer.is_valid(obj_offset):
return None

yield self._context.object(
symbol_type,
layer,
offset=self.vol.offset - relative_offset,
native_layer_name=layer or self.vol.native_layer_name,
layer_name,
offset=obj_offset,
native_layer_name=native_layer_name,
)

seen = {self.vol.offset}
while link.vol.offset not in seen:
obj_offset = link.vol.offset - relative_offset

if not trans_layer.is_valid(obj_offset):
return None

obj = self._context.object(
yield self._context.object(
symbol_type,
layer,
layer_name,
offset=obj_offset,
native_layer_name=layer or self.vol.native_layer_name,
native_layer_name=native_layer_name,
)
yield obj

seen.add(link.vol.offset)

try:
link = getattr(link, direction).dereference()
except exceptions.InvalidAddressException:
link_ptr = getattr(link, direction)
if not (link_ptr and link_ptr.is_readable()):
return None
link = link_ptr.dereference()

def __iter__(self) -> Iterator[interfaces.objects.ObjectInterface]:
return self.to_list(self.vol.parent.vol.type_name, self.vol.member_name)
Expand Down
Loading