WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-10-01 05:54:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

linux:check_syscall plugin: improve pointers validation

Browse Source
This commit is contained in:
Gustavo Moreira
2025-01-17 09:53:09 +11:00
parent 77b8058913
commit 583a06630f
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/check_syscall.py
+7 -3
View File
@@ -82,7 +82,7 @@ class Check_syscall(plugins.PluginInterface):
return table_size
def _get_table_info_disassembly(self, ptr_sz, vmlinux):
def _get_table_info_disassembly(self, ptr_sz, vmlinux) -> int:
"""Find the size of the system call table by disassembling functions
that immediately reference it in their first instruction This is in the
form 'cmp reg,NR_syscalls'."""
@@ -107,9 +107,13 @@ class Check_syscall(plugins.PluginInterface):
return 0
vmlinux = self.context.modules[self.config["kernel"]]
data = self.context.layers.read(vmlinux.layer_name, func_addr, 6)
vmlinux_layer = self.context.layers[vmlinux.layer_name]
try:
data = vmlinux_layer.read(func_addr, 6)
except exceptions.InvalidAddressException:
return 0
for address, size, mnemonic, op_str in md.disasm_lite(data, func_addr):
for _address, _size, mnemonic, op_str in md.disasm_lite(data, func_addr):
if mnemonic == "CMP":
table_size = int(op_str.split(",")[1].strip()) & 0xFFFF
break