From 2ff7dea5125b16dedcaf9ac63752850f35d0fd58 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 20 Feb 2025 01:07:10 +0000 Subject: [PATCH] Linux: Remember to apply the symbols to addr as well as link --- volatility3/framework/plugins/linux/ip.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/ip.py b/volatility3/framework/plugins/linux/ip.py index 0e3f7ff0e..460774daf 100644 --- a/volatility3/framework/plugins/linux/ip.py +++ b/volatility3/framework/plugins/linux/ip.py @@ -7,6 +7,7 @@ from volatility3.framework import interfaces, renderers, constants from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.symbols.linux import net +from volatility3.framework.symbols.linux.extensions import net as net_extensions class Addr(plugins.PluginInterface): @@ -29,7 +30,7 @@ class Addr(plugins.PluginInterface): ), ] - def _gather_net_dev_info(self, net_dev): + def _gather_net_dev_info(self, net_dev: net_extensions.net_device): mac_addr = net_dev.get_mac_address() promisc = net_dev.promisc operational_state = net_dev.get_operational_state() @@ -61,6 +62,7 @@ class Addr(plugins.PluginInterface): net_type_symname = vmlinux.symbol_table_name + constants.BANG + "net" net_device_symname = vmlinux.symbol_table_name + constants.BANG + "net_device" + net.NetSymbols.apply(self.context.symbol_space[vmlinux.symbol_table_name]) # 'net_namespace_list' exists from kernels >= 2.6.24 net_namespace_list = vmlinux.object_from_symbol("net_namespace_list")