WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-07 18:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

make ftrace flags parsing more readable

Browse Source
This commit is contained in:
Abyss Watcher
2025-02-05 19:19:26 +01:00
parent c01f3c5556
commit 637ff68035
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/tracing/ftrace.py
+7 -5
View File
@@ -221,6 +221,12 @@ if the "hidden_modules" key is present in known_modules.
for hooked_symbol in hooked_symbols
]
)
# Manipulate FtraceOpsFlags(ftrace_ops.flags) like so:
# "FtraceOpsFlags.FTRACE_OPS_FL_IPMODIFY|FTRACE_OPS_FL_ALLOC_TRAMP"
# -> "FTRACE_OPS_FL_IPMODIFY,FTRACE_OPS_FL_ALLOC_TRAMP"
formatted_ftrace_flags = (
str(FtraceOpsFlags(ftrace_ops.flags)).split(".")[-1].replace("|", ",")
)
yield ParsedFtraceOps(
ftrace_ops.vol.offset,
callback_symbol,
@@ -228,11 +234,7 @@ if the "hidden_modules" key is present in known_modules.
hooked_symbols,
module_name,
module_address,
# FtraceOpsFlags(ftrace_ops.flags).name is valid in > Python3.10, but
# returns None <= Python 3.10. We need to manipulate it like so to ensure compatibility:
# FtraceOpsFlags.FTRACE_OPS_FL_IPMODIFY|FTRACE_OPS_FL_ALLOC_TRAMP
# -> FTRACE_OPS_FL_IPMODIFY,FTRACE_OPS_FL_ALLOC_TRAMP
str(FtraceOpsFlags(ftrace_ops.flags)).split(".")[-1].replace("|", ","),
formatted_ftrace_flags,
)
return None