From 03cf84f9cff90aaa135190b025e28fe436fff69e Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 27 Jan 2025 11:05:08 +0100 Subject: [PATCH] assign kernel layer to variable early --- volatility3/framework/plugins/linux/tracing/ftrace.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index 629f1bab8..99961c931 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -150,6 +150,7 @@ if the "hidden_modules" key is present in known_modules. An iterable of ParsedFtraceOps dataclasses, containing a selection of useful fields (callback, hook, module) related to an ftrace_ops struct """ kernel = context.modules[kernel_name] + kernel_layer = context.layers[kernel.layer_name] callback = ftrace_ops.func callback_symbol = module_address = module_name = None @@ -170,7 +171,7 @@ if the "hidden_modules" key is present in known_modules. "A callback module origin could not be determined. hidden_modules plugin will be run to detect additional modules.", ) known_modules_addresses = set( - context.layers[kernel.layer_name].canonicalize(module.vol.offset) + kernel_layer.canonicalize(module.vol.offset) for module in modxview.Modxview.flatten_run_modules_results( known_modules )