diff --git a/volatility/framework/plugins/linux/check_idt.py b/volatility/framework/plugins/linux/check_idt.py index 46cbe1842..ad3530c19 100644 --- a/volatility/framework/plugins/linux/check_idt.py +++ b/volatility/framework/plugins/linux/check_idt.py @@ -41,6 +41,8 @@ class Check_idt(interfaces.plugins.PluginInterface): idt_table_size = 256 + address_mask = self.context.layers[self.config['primary']].address_mask + # hw handlers + system call check_idxs = list(range(0, 20)) + [128] @@ -80,6 +82,8 @@ class Check_idt(interfaces.plugins.PluginInterface): idt_addr = (high << 32) | (middle << 16) | low + idt_addr = idt_addr & address_mask + module_name, symbol_name = linux.LinuxUtilities.lookup_module_address(self.context, handlers, idt_addr) yield(0, [format_hints.Hex(i), format_hints.Hex(idt_addr), module_name, symbol_name])