From 2d1acaca51ce70a1582e99d87a394aee8711418b Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 25 Apr 2025 16:40:06 +0100 Subject: [PATCH] Linux: update extensions used by kallsyms plugin to use utility.pointer_to_string --- .../symbols/linux/extensions/__init__.py | 20 ++++--------------- 1 file changed, 4 insertions(+), 16 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index d281e2b9b..bd57b726a 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -3065,14 +3065,7 @@ class kernel_symbol(objects.StructType): else: raise AttributeError("Unsupported kernel_symbol type implementation") - layer = self._context.layers[self.vol.layer_name] - name_bytes = layer.read(name_offset, linux_constants.KSYM_NAME_LEN) - - idx = name_bytes.find(b"\x00") - if idx != -1: - name_bytes = name_bytes[:idx] - - return name_bytes.decode("utf-8", errors="ignore") + return utility.pointer_to_string(name_offset, linux_constants.KSYM_NAME_LEN) def get_name(self) -> Optional[str]: try: @@ -3108,14 +3101,9 @@ class kernel_symbol(objects.StructType): else: raise AttributeError("Unsupported kernel_symbol type implementation") - layer = self._context.layers[self.vol.layer_name] - namespace_bytes = layer.read(namespace_offset, linux_constants.KSYM_NAME_LEN) - - idx = namespace_bytes.find(b"\x00") - if idx != -1: - namespace_bytes = namespace_bytes[:idx] - - return namespace_bytes.decode("utf-8", errors="ignore") + return utility.pointer_to_string( + namespace_offset, linux_constants.KSYM_NAME_LEN + ) def get_namespace(self) -> Optional[str]: try: