WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-30 03:39:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

added address mask to fix issue with kernel tracking

Browse Source
This commit is contained in:
Matt Tressler
2020-08-06 18:12:42 +01:00
committed by ikelos
parent eb2d7715ce
commit 2467e3986d
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/linux/check_idt.py
+4
View File
@@ -41,6 +41,8 @@ class Check_idt(interfaces.plugins.PluginInterface):
idt_table_size = 256
address_mask = self.context.layers[self.config['primary']].address_mask
# hw handlers + system call
check_idxs = list(range(0, 20)) + [128]
@@ -80,6 +82,8 @@ class Check_idt(interfaces.plugins.PluginInterface):
idt_addr = (high << 32) | (middle << 16) | low
idt_addr = idt_addr & address_mask
module_name, symbol_name = linux.LinuxUtilities.lookup_module_address(self.context, handlers, idt_addr)
yield(0, [format_hints.Hex(i), format_hints.Hex(idt_addr), module_name, symbol_name])