From 637ff680353564f04cacdf17d3853992cea4abdc Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 5 Feb 2025 19:19:26 +0100 Subject: [PATCH] make ftrace flags parsing more readable --- .../framework/plugins/linux/tracing/ftrace.py | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index da88d1de1..75b4d3cca 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -221,6 +221,12 @@ if the "hidden_modules" key is present in known_modules. for hooked_symbol in hooked_symbols ] ) + # Manipulate FtraceOpsFlags(ftrace_ops.flags) like so: + # "FtraceOpsFlags.FTRACE_OPS_FL_IPMODIFY|FTRACE_OPS_FL_ALLOC_TRAMP" + # -> "FTRACE_OPS_FL_IPMODIFY,FTRACE_OPS_FL_ALLOC_TRAMP" + formatted_ftrace_flags = ( + str(FtraceOpsFlags(ftrace_ops.flags)).split(".")[-1].replace("|", ",") + ) yield ParsedFtraceOps( ftrace_ops.vol.offset, callback_symbol, @@ -228,11 +234,7 @@ if the "hidden_modules" key is present in known_modules. hooked_symbols, module_name, module_address, - # FtraceOpsFlags(ftrace_ops.flags).name is valid in > Python3.10, but - # returns None <= Python 3.10. We need to manipulate it like so to ensure compatibility: - # FtraceOpsFlags.FTRACE_OPS_FL_IPMODIFY|FTRACE_OPS_FL_ALLOC_TRAMP - # -> FTRACE_OPS_FL_IPMODIFY,FTRACE_OPS_FL_ALLOC_TRAMP - str(FtraceOpsFlags(ftrace_ops.flags)).split(".")[-1].replace("|", ","), + formatted_ftrace_flags, ) return None