From 2467e3986d6a73839adaff3fa89e6b443eb7bd9e Mon Sep 17 00:00:00 2001 From: Matt Tressler Date: Thu, 6 Aug 2020 13:05:07 -0400 Subject: [PATCH] added address mask to fix issue with kernel tracking --- volatility/framework/plugins/linux/check_idt.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility/framework/plugins/linux/check_idt.py b/volatility/framework/plugins/linux/check_idt.py index 46cbe1842..ad3530c19 100644 --- a/volatility/framework/plugins/linux/check_idt.py +++ b/volatility/framework/plugins/linux/check_idt.py @@ -41,6 +41,8 @@ class Check_idt(interfaces.plugins.PluginInterface): idt_table_size = 256 + address_mask = self.context.layers[self.config['primary']].address_mask + # hw handlers + system call check_idxs = list(range(0, 20)) + [128] @@ -80,6 +82,8 @@ class Check_idt(interfaces.plugins.PluginInterface): idt_addr = (high << 32) | (middle << 16) | low + idt_addr = idt_addr & address_mask + module_name, symbol_name = linux.LinuxUtilities.lookup_module_address(self.context, handlers, idt_addr) yield(0, [format_hints.Hex(i), format_hints.Hex(idt_addr), module_name, symbol_name])