From 204657648ac10a7a453cf775f4e7503fd1e7d3ea Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 10 Apr 2020 22:28:28 +0100 Subject: [PATCH] Linux: Narrow in on a particular symbol table --- volatility/framework/automagic/linux.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index 0bbb72542..26db90388 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -171,7 +171,12 @@ class LinuxUtilities(object): sym_addr = dentry.d_op.d_dname - symbs = list(context.symbol_space.get_symbols_by_location(sym_addr)) + symbol_table_arr = sym_addr.vol.type_name.split("!") + symbol_table = None + if len(symbol_table_arr) == 2: + symbol_table = symbol_table_arr[0] + + symbs = list(context.symbol_space.get_symbols_by_location(sym_addr, table_name = symbol_table)) if len(symbs) == 1: sym = symbs[0].split(constants.BANG)[1]