Skip to content

Commit 2759df8

Browse files
committed
tag potentially smeared dentry names
1 parent 140a16d commit 2759df8

File tree

1 file changed

+8
-5
lines changed

1 file changed

+8
-5
lines changed

volatility3/framework/symbols/linux/__init__.py

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,7 @@ def do_get_path(cls, rdentry, rmnt, dentry, vfsmnt) -> Union[None, str]:
169169
return ""
170170

171171
path_reversed = []
172+
smeared = False
172173
while (
173174
dentry
174175
and dentry.is_readable()
@@ -190,14 +191,16 @@ def do_get_path(cls, rdentry, rmnt, dentry, vfsmnt) -> Union[None, str]:
190191

191192
parent = dentry.d_parent
192193
dname = dentry.d_name.name_as_str()
193-
dname_stripped = dname.strip("/")
194-
if dname_stripped:
195-
path_reversed.append(dname_stripped)
194+
# empty dentry names are most likely
195+
# the result of smearing
196+
if not dname:
197+
smeared = True
198+
path_reversed.append(dname.strip("/"))
196199
dentry = parent
197200

198-
if path_reversed == []:
199-
return ""
200201
path = "/" + "/".join(reversed(path_reversed))
202+
if smeared:
203+
return f"<potentially smeared> {path}"
201204
return path
202205

203206
@classmethod

0 commit comments

Comments
 (0)