volatility3.framework.objects.utility module

address_to_string(context, layer_name, address, count, errors='replace', block_size=32)

Reads a null-terminated string from a given specified memory address, processing

it in blocks for efficiency.

Parameters:

• context (ContextInterface) – The context used to retrieve memory layers and symbol tables

• layer_name (str) – The name of the memory layer to read from

• address (int) – The address where the string is located in memory

• count (int) – The number of bytes to read

• errors (str) – The error handling scheme to use for encoding errors. Defaults to “replace”

• block_size – Reading block size. Defaults to 32

Return type:

str

Returns:

The decoded string extracted from memory.

array_of_pointers(array, count, subtype, context)

Takes an object, and recasts it as an array of pointers to subtype.

Return type:

ObjectInterface

array_to_string(array, count=None, errors='replace', block_size=32)

Takes a Volatility ‘Array’ of characters and returns a Python string.

Parameters:

• array (Array) – The Volatility Array object containing character elements.

• count (Optional[int]) – Optional maximum number of characters to convert. If None, the function processes the entire array.

• errors (str) – Specifies error handling behavior for decoding, defaulting to “replace”.

• block_size – Reading block size. Defaults to 32

Return type:

str

Returns:

A decoded string representation of the character array.

bswap_32(value)

Return type:

int

bswap_64(value)

Return type:

int

pointer_to_string(pointer, count, errors='replace', block_size=32)

Takes a Volatility ‘Pointer’ to characters and returns a Python string.

Parameters:

• pointer (Pointer) – A Pointer object containing character elements.

• count (int) – Optional maximum number of characters to convert. If None, the function processes the entire array.

• errors (str) – Specifies error handling behavior for decoding, defaulting to “replace”.

• block_size – Reading block size. Defaults to 32

Return type:

str

Returns:

A decoded string representation of the data referenced by the pointer.

rol(value, count, max_bits=64)

A rotate-left instruction in Python

Return type:

int