qwhai / volatility

Automatically exported from code.google.com/p/volatility
GNU General Public License v2.0
0 stars 0 forks source link

duplicate work being done in ssdt #192

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
I believe we're doing the same check twice in ssdt, so here's a patch. Can 
someone verify I'm not crazy?

Before we yield, the calculate() function does this:

vm = tasks.find_space(addr_space, procs, table)
if vm:
    tables_with_vm.append((idx, table, n, vm))
else:
    debug.debug("[SSDT not resident at 0x{0:08X}]\n".format(table))

Then in render_text it does this:

if vm.is_valid_address(table):
    ....
else:
    outfd.write("  [SSDT not resident at 0x{0:08X} ]\n".format(table))

The tasks.find_space function only returns a valid VM if is_valid_address is 
True, so there's no need to check vm.is_valid_address again in the 
render_function. 

Just trying to clean up a bit in prep for adding x64 ssdt stuff...

Original issue reported on code.google.com by michael.hale@gmail.com on 24 Jan 2012 at 7:51

Attachments:

GoogleCodeExporter commented 9 years ago
This issue was closed by revision r1308.

Original comment by michael.hale@gmail.com on 25 Jan 2012 at 4:51