From 92eae9c50f56a486f0d62d57a68135d2b7375001 Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 9 May 2025 09:06:43 +0100 Subject: [PATCH] Linux: Add comment for explaining the behaviour with smear --- volatility3/framework/symbols/linux/__init__.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 65f20d88d..327c6dd37 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -99,7 +99,7 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): class LinuxUtilities(interfaces.configuration.VersionableInterface): """Class with multiple useful linux functions.""" - _version = (2, 3, 0) + _version = (2, 3, 1) _required_framework_version = (2, 0, 0) framework.require_interface_version(*_required_framework_version) @@ -200,6 +200,9 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): path = "/" + "/".join(reversed(path_reversed)) if smeared: + # if there is smear the missing dname will be empty. e.g. if the normal + # path would be /foo/bar/baz, but bar is missing due to smear the results + # returned here will show /foo//baz. Note the // for the missing dname. return f" {path}" return path