Linux - update linux_find_file

volatilityfoundation · May 27, 2014 · 3a18e6b · 3a18e6b
1 parent 7d8f349
commit 3a18e6b
Showing 1 changed file with 10 additions and 11 deletions.
diff --git a/volatility/plugins/linux/find_file.py b/volatility/plugins/linux/find_file.py
@@ -214,20 +214,19 @@ def get_file_contents(self, inode):
         extra = file_size % 4096
         idxs = file_size / 4096
 
-        if extra != 0:
+        if extra > 0:
             extra = 4096 - extra
             idxs = idxs + 1
 
         for idx in range(0, idxs):
-            data = data + self.get_page_contents(inode, idx)
-
-        # this is chop off any extra data on the last page
-
-        if extra != 0:
-            extra = extra * -1
-            data = data[:extra]
-
-        return data
-
+            data = self.get_page_contents(inode, idx)
+
+            # this is to chop off any extra data on the last page
+            if idx == idxs - 1:
+                if extra > 0:
+                    extra = extra * -1
+                    data = data[:extra]
+
+            yield data