WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 12:47:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1590 from volatilityfoundation/mnt_parent_missing

Browse Source 
Add mnt_parent check to kernel version validation
This commit is contained in:
ikelos
2025-02-01 01:46:46 +00:00
committed by GitHub
parent 75b55c3b30 1132bd9830
commit 5a046ea0e4
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/linux/extensions/__init__.py
+3 -1
View File
@@ -1574,7 +1574,9 @@ class vfsmount(objects.StructType):
'True' if the kernel lacks the 'mount' struct, typically indicating kernel < 3.3.
"""
return not self._context.symbol_space.has_type("mount")
return (not self._context.symbol_space.has_type("mount")) and self.has_member(
"mnt_parent"
)
def is_equal(self, vfsmount_ptr) -> bool:
"""Helper to make sure it is comparing two pointers to 'vfsmount'.