From 2cf35b91ee95540c514ad5eca85920c2982001fa Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 10 Mar 2026 12:03:45 +0000 Subject: [PATCH 1/2] Attempt to fix the local filepath not being detected correctly --- volatility3/framework/automagic/symbol_cache.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py index ff75e86c6d..f0029d0f5c 100644 --- a/volatility3/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -6,6 +6,7 @@ import json import logging import os +import pathlib import sqlite3 import urllib import urllib.parse @@ -495,9 +496,12 @@ def get_identifier_dictionary( vollog.debug( f"Duplicate entry for identifier {row['identifier']}: {row['location']} and {output[row['identifier']]}" ) - local_filepath = self._get_local_filepath(row["location"]) - if local_filepath and not local_filepath.startswith( - tuple(constants.SYMBOL_BASEPATHS) + local_filepath = pathlib.Path(self._get_local_filepath(row["location"])) + if local_filepath and not any( + [ + local_filepath.is_relative_to(basepath) + for basepath in constants.SYMBOL_BASEPATHS + ] ): vollog.debug( f"Location {row['location']} was not in the registered symbol paths and therefore not in the identifier dictionary" From 02af9f907c73bd68eddde83b094f2a6ebd068a6f Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 10 Mar 2026 20:13:08 +0000 Subject: [PATCH 2/2] Add in more checks and better error handling --- .../framework/automagic/symbol_cache.py | 44 ++++++++++--------- 1 file changed, 24 insertions(+), 20 deletions(-) diff --git a/volatility3/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py index f0029d0f5c..a4e792cf94 100644 --- a/volatility3/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -240,16 +240,19 @@ def find_location( results = self._database.cursor().execute(statement, parameters).fetchall() result = None for row in results: - local_filepath = self._get_local_filepath(row["location"]) - if not ( - local_filepath is None - or local_filepath.startswith(tuple(constants.SYMBOL_BASEPATHS)) - ): - vollog.debug( - f"Location {row['location']} found but outside of the registered symbol paths" - ) - else: - result = row["location"] + if row["location"]: + local_filepath = pathlib.Path(self._get_local_filepath(row["location"])) + if local_filepath and not any( + [ + local_filepath.is_relative_to(basepath) + for basepath in constants.SYMBOL_BASEPATHS + ] + ): + vollog.debug( + f"Location {row['location']} found but outside of the registered symbol paths" + ) + else: + result = row["location"] return result def get_local_locations(self) -> Generator[str, None, None]: @@ -496,16 +499,17 @@ def get_identifier_dictionary( vollog.debug( f"Duplicate entry for identifier {row['identifier']}: {row['location']} and {output[row['identifier']]}" ) - local_filepath = pathlib.Path(self._get_local_filepath(row["location"])) - if local_filepath and not any( - [ - local_filepath.is_relative_to(basepath) - for basepath in constants.SYMBOL_BASEPATHS - ] - ): - vollog.debug( - f"Location {row['location']} was not in the registered symbol paths and therefore not in the identifier dictionary" - ) + if row["location"]: + local_filepath = pathlib.Path(self._get_local_filepath(row["location"])) + if local_filepath and not any( + [ + local_filepath.is_relative_to(basepath) + for basepath in constants.SYMBOL_BASEPATHS + ] + ): + vollog.debug( + f"Location {row['location']} was not in the registered symbol paths and therefore not in the identifier dictionary" + ) else: output[row["identifier"]] = row["location"] return output