Skip to content

Commit

Permalink
Address feedback. Add doc strings
Browse files Browse the repository at this point in the history
  • Loading branch information
atcuno committed Feb 1, 2025
1 parent 3b3331a commit 60dc0c0
Showing 1 changed file with 25 additions and 4 deletions.
29 changes: 25 additions & 4 deletions volatility3/framework/symbols/linux/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
import functools
import logging
from abc import ABC, abstractmethod
from typing import Iterator, List, Tuple, Optional, Union, Dict
from typing import List, Tuple, Optional, Union, Dict, Generator, Iterator

import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules
from volatility3 import framework
Expand Down Expand Up @@ -429,7 +429,28 @@ def lookup_module_address(
)

@classmethod
def walk_internal_list(cls, vmlinux, struct_name, list_member, list_start):
def walk_internal_list(
cls,
vmlinux: interfaces.context.ModuleInterface,
struct_name: str,
list_member: str,
list_start: interfaces.objects.ObjectInterface,
max_count: int = 4096,
) -> Generator[interfaces.objects.ObjectInterface, None, None]:
"""
An API that provides generic, smear-resistant enumeration of embedded lists
Args:
vmlinux:
struct_name: name of the structure of the list elements
list_member: name of the list_member holding the internal list
list_start: Starting (head) member of the list
max_count: Optional maximum amount of list elements that will be yielded
Returns:
Instances of `struct_name`
"""

count = 0
seen = set()

Expand All @@ -452,9 +473,9 @@ def walk_internal_list(cls, vmlinux, struct_name, list_member, list_start):

list_start = getattr(list_struct, list_member)

if count == 4096:
if count == max_count:
vollog.debug(
f"walk_internal_list: Breaking list enumeration at {count}"
f"walk_internal_list: Breaking list enumeration at maximum allowed count of {count}"
)
break

Expand Down

0 comments on commit 60dc0c0

Please sign in to comment.