Skip to content

Commit ae08c8e

Browse files
committed
Support setting the breakpoint on the lowest layer
1 parent f5ec6dc commit ae08c8e

File tree

1 file changed

+16
-1
lines changed

1 file changed

+16
-1
lines changed

volatility3/cli/volshell/generic.py

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -799,14 +799,28 @@ def create_configurable(
799799

800800
return constructed
801801

802-
def breakpoint(self, address: int, layer_name: Optional[str] = None) -> None:
802+
def breakpoint(
803+
self, address: int, layer_name: Optional[str] = None, lowest: bool = False
804+
) -> None:
803805
"""Sets a breakpoint on a particular address (within a specific layer)"""
804806
if layer_name is None:
805807
if self.current_layer is None:
806808
raise ValueError("Current layer must be set")
807809
layer_name = self.current_layer
808810

809811
layer: interfaces.layers.DataLayerInterface = self.context.layers[layer_name]
812+
813+
if lowest:
814+
while isinstance(layer, interfaces.layers.TranslationLayerInterface):
815+
mapping = layer.mapping(address, 1)
816+
if not mapping:
817+
raise ValueError(
818+
"Offset cannot be mapped lower, cannot break at lowest layer"
819+
)
820+
_, _, mapped_offset, _, mapped_layer_name = next(mapping)
821+
layer = self.context.layers[mapped_layer_name]
822+
address = mapped_offset
823+
810824
# Check if the read value is already overloaded
811825
if not hasattr(layer.read, "breakpoints"):
812826
# Layer read is not yet wrapped
@@ -825,6 +839,7 @@ def wrapped_read(offset: int, length: int, pad: bool = False) -> bytes:
825839
setattr(layer, "read", wrapped_read)
826840

827841
# Add the new breakpoint
842+
print(f"Setting breakpoint {address:x} on {layer.name}")
828843
breakpoints = getattr(layer.read, "breakpoints")
829844
breakpoints.add(address)
830845
setattr(layer.read, "breakpoints", breakpoints)

0 commit comments

Comments
 (0)