WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 10:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Linux: Narrow in on a particular symbol table

Browse Source
This commit is contained in:
Mike Auty
2020-06-10 19:39:20 +01:00
committed by ikelos
parent 054b95c8ed
commit 204657648a
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/automagic/linux.py
+6 -1
View File
@@ -171,7 +171,12 @@ class LinuxUtilities(object):
sym_addr = dentry.d_op.d_dname
symbs = list(context.symbol_space.get_symbols_by_location(sym_addr))
symbol_table_arr = sym_addr.vol.type_name.split("!")
symbol_table = None
if len(symbol_table_arr) == 2:
symbol_table = symbol_table_arr[0]
symbs = list(context.symbol_space.get_symbols_by_location(sym_addr, table_name = symbol_table))
if len(symbs) == 1:
sym = symbs[0].split(constants.BANG)[1]