Merge pull request #1025 from Abyss-W4tcher/remote_isf

Core: Remote ISF - correct sql query and strip identifier
volatilityfoundation · Oct 23, 2023 · e5d3134 · e5d3134
2 parents 11ddafd + c20baf9
commit e5d3134
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/volatility3/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py
@@ -429,7 +429,7 @@ def update(self, progress_callback=None):
             progress_callback(0, "Reading remote ISF list")
             cursor = self._database.cursor()
             cursor.execute(
-                f"SELECT cached FROM cache WHERE local = 0 and cached < datetime('now', {self.cache_period})"
+                f"SELECT cached FROM cache WHERE local = 0 and cached < datetime('now', '{self.cache_period}')"
             )
             remote_identifiers = RemoteIdentifierFormat(constants.REMOTE_ISF_URL)
             progress_callback(50, "Reading remote ISF list")
@@ -438,9 +438,13 @@ def update(self, progress_callback=None):
                     {}, operating_system=operating_system
                 )
                 for identifier, location in identifiers:
+                    identifier = identifier.rstrip()
+                    identifier = (
+                        identifier[:-1] if identifier.endswith(b"\x00") else identifier
+                    )  # Linux banners dumped by dwarf2json end with "\x00\n". If not stripped, the banner cannot match.
                     cursor.execute(
                         "INSERT OR REPLACE INTO cache(identifier, location, operating_system, local, cached) VALUES (?, ?, ?, ?, datetime('now'))",
-                        (location, identifier, operating_system, False),
+                        (identifier, location, operating_system, False),
                     )
             progress_callback(100, "Reading remote ISF list")
             self._database.commit()