Leor3961 / volatility

Automatically exported from code.google.com/p/volatility
0 stars 0 forks source link

volatility doesn't mask off integer bits making printing / displaying more difficult than necessary #46

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago
the basic problem is that python has the idea of "infinite" sign extension when 
dealing with negative numbers that makes dealing with them really annoying. 
Here is an example from the python interpreter:

>>> x = 255
>>> print "%x" % x
ff
>>> x = -1
>>> print "%x" % x
-1
>>> x = x & 0xffffffff
>>> print "%x" % x
ffffffff
>>>

>>> x = -1
>>> type(x)
<type 'int'>
>>> x = x & 0xffffffff
>>> type(x)
<type 'long'>
>>>

as you can see when x is "-1" python doesn't treat it as a 4 byte 32 bit 
integer but instead treats it as the magic infinitely sign extended number. 
only after masking off 32 bits does it then switch to a regular 4 byte 'long' 
as opposed to the magic 'int'

so I guess I was wondering of the handler code for obj.Object would be able to 
mask to perform the 32bit mask on all integers in structures? If not, the 
render_* functions will be long and complicated as all the integer members will 
need to be chopped

Original issue reported on code.google.com by atc...@gmail.com on 21 Nov 2010 at 10:29

GoogleCodeExporter commented 8 years ago

Original comment by mike.auty@gmail.com on 21 Nov 2010 at 10:47

GoogleCodeExporter commented 8 years ago
you can close this, you can work around this very easy with .format() I just 
figured out

Original comment by atc...@gmail.com on 22 Jan 2011 at 6:12

GoogleCodeExporter commented 8 years ago
scratch that, its still an issue and all the workarounds I saw where what I 
mentioned in post 1 with the and'ing

Original comment by atc...@gmail.com on 22 Jan 2011 at 6:18

GoogleCodeExporter commented 8 years ago
per attc, no longer an issue

Original comment by michael.hale@gmail.com on 15 Dec 2011 at 7:47