Skip to content

Commit b80c528

Browse files
committed
ShimcacheMem: Use address_to_string
Uses the new `address_to_string` utility function to read filepaths, in case a filepath crosses a boundary to a swapped page.
1 parent 87cc571 commit b80c528

File tree

1 file changed

+7
-2
lines changed
  • volatility3/framework/symbols/windows/extensions

1 file changed

+7
-2
lines changed

volatility3/framework/symbols/windows/extensions/shimcache.py

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
from typing import Dict, Optional, Tuple, Union
99

1010
from volatility3.framework import constants, exceptions, interfaces, objects, renderers
11+
from volatility3.framework.objects.utility import address_to_string
1112
from volatility3.framework.symbols.windows.extensions import conversion
1213

1314
vollog = logging.getLogger(__name__)
@@ -126,8 +127,12 @@ def file_path(self) -> Union[str, interfaces.renderers.BaseAbsentValue]:
126127
return self._file_path
127128

128129
if not hasattr(self.Path, "Buffer"):
129-
return self.Path.cast(
130-
"string", max_length=self.Path.vol.count, encoding="utf-16le"
130+
return address_to_string(
131+
self._context,
132+
self.Path.vol.layer_name,
133+
self.Path.vol.offset,
134+
520,
135+
encoding="utf-16le",
131136
)
132137

133138
try:

0 commit comments

Comments
 (0)