WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 01:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add mnt_parent check to kernel version validation

Browse Source
This commit is contained in:
Andrew Case
2025-01-31 18:10:12 +00:00
parent b51acfd3fb
commit 55b27a68d5
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/linux/extensions/__init__.py
+1 -1
View File
@@ -1574,7 +1574,7 @@ class vfsmount(objects.StructType):
'True' if the kernel lacks the 'mount' struct, typically indicating kernel < 3.3.
"""
return not self._context.symbol_space.has_type("mount")
return (not self._context.symbol_space.has_type("mount")) and self.has_member("mnt_parent")
def is_equal(self, vfsmount_ptr) -> bool:
"""Helper to make sure it is comparing two pointers to 'vfsmount'.