WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 13:17:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Linux: include all mod mem types in size calculations

Browse Source
This commit is contained in:
Eve
2024-02-02 14:03:55 +00:00
parent ecf20d99b4
commit 261d7ffbf2
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/linux/extensions/__init__.py
+11 -2
View File
@@ -56,7 +56,11 @@ class module(generic.GenericIntelProcess):
def get_init_size(self):
self._get_mod_mem_type()
if self.mod_mem_type:
return self.mem[self.mod_mem_type["MOD_INIT_TEXT"]].size
return (
self.mem[self.mod_mem_type["MOD_INIT_TEXT"]].size
+ self.mem[self.mod_mem_type["MOD_INIT_DATA"]].size
+ self.mem[self.mod_mem_type["MOD_INIT_RODATA"]].size
)
else:
if self.has_member("init_layout"):
return self.init_layout.size
@@ -69,7 +73,12 @@ class module(generic.GenericIntelProcess):
def get_core_size(self):
self._get_mod_mem_type()
if self.mod_mem_type:
return self.mem[self.mod_mem_type["MOD_TEXT"]].size
return (
self.mem[self.mod_mem_type["MOD_TEXT"]].size
+ self.mem[self.mod_mem_type["MOD_DATA"]].size
+ self.mem[self.mod_mem_type["MOD_RODATA"]].size
+ self.mem[self.mod_mem_type["MOD_RO_AFTER_INIT"]].size
)
else:
if self.has_member("core_layout"):
return self.core_layout.size