Linux: Boottime API: Refactor TimespecVol3::negate() to return a new object instead of modifying the original. It also normalizes its values, aligning with the behavior of the other addition and subtraction operators

Author: gcmoreira

volatility3/framework/symbols/linux/__init__.py

@@ -909,6 +909,7 @@ def __sub__(self, timespec) -> "TimespecVol3":
             tv_sec=self.tv_sec - timespec.tv_sec,
             tv_nsec=self.tv_nsec - timespec.tv_nsec,
         )
+
         result.normalize()
 
         return result
@@ -925,6 +926,13 @@ def normalize(self):
             self.tv_sec -= 1
 
     def negate(self):
-        """Negates the sign of both tv_sec and tv_nsec"""
-        self.tv_sec = -self.tv_sec
-        self.tv_nsec = -self.tv_nsec
+        """Returns a new TimespecVol3 object with the values of the current object negated"""
+
+        result = TimespecVol3(
+            tv_sec=-self.tv_sec,
+            tv_nsec=-self.tv_nsec,
+        )
+
+        result.normalize()
+
+        return result

volatility3/framework/symbols/linux/extensions/__init__.py

@@ -502,10 +502,7 @@ def _get_boottime_raw(self) -> "linux.TimespecVol3":
 
             boottime += timekeeper.total_sleep_time
 
-            boottime.negate()
-            boottime.normalize()
-
-            return boottime
+            return boottime.negate()
 
         elif vmlinux.has_symbol("wall_to_monotonic"):
             # kernels < 3.4 - Tested on Debian7 3.2.0-4 (3.2.57-3+deb7u2)
@@ -523,10 +520,7 @@ def _get_boottime_raw(self) -> "linux.TimespecVol3":
                     # kernels < 2.6.32 total_sleep_time is an unsigned long as seconds
                     boottime.tv_sec += total_sleep_time
 
-            boottime.negate()
-            boottime.normalize()
-
-            return boottime
+            return boottime.negate()
 
         raise exceptions.VolatilityException("Unsupported")