From 13729ac25f699d72c280b999ddbe0e9d02fcede6 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 18 Nov 2024 18:18:14 +1100 Subject: [PATCH] linux: VMCoreInfo API: AARCH64 uses NUMBER() with hex values. Fortunately, includes the 0x prefix, allowing the parser to still handle these cases correctly --- volatility3/framework/symbols/linux/__init__.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index b8a2056d5..cd4d16649 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -869,9 +869,9 @@ class VMCoreInfo(interfaces.configuration.VersionableInterface): if key.startswith("SYMBOL(") or key == "KERNELOFFSET": return int(value, 16) elif key.startswith(("NUMBER(", "LENGTH(", "SIZE(", "OFFSET(")): - return int(value) + return int(value, 0) elif key == "PAGESIZE": - return int(value) + return int(value, 0) # Default, as string return value