From 41a93473e987bb43bca8e8095dddd890a1a1b351 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 14 Nov 2024 19:35:47 +1100 Subject: [PATCH] linux: intel VMCoreInfo: Improve layer config code --- volatility3/framework/automagic/linux.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 556a02c1f..c92fa05c4 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -347,16 +347,16 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): config_path = join("IntelHelper", new_layer_name) kernel_banner = LinuxSymbolFinder.banner_config_key banner_str = banner.decode(encoding="latin-1") + context.config[join(config_path, kernel_banner)] = banner_str context.config[join(config_path, "memory_layer")] = layer_name context.config[join(config_path, "page_map_offset")] = dtb - context.config[join(config_path, kernel_banner)] = banner_str + context.config[join(config_path, "kernel_virtual_offset")] = aslr_shift layer = layer_class( context, config_path=config_path, name=new_layer_name, metadata={"os": "Linux"}, ) - layer.config["kernel_virtual_offset"] = aslr_shift if layer and dtb: vollog.debug(