From 6c96ffacddc0bc3ad461b1fd1042e572ec5d344a Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 01:13:03 +0000 Subject: [PATCH] Update fbdev plugin to gracefully handle old/broken symbol tables --- volatility3/framework/plugins/linux/graphics/fbdev.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/graphics/fbdev.py b/volatility3/framework/plugins/linux/graphics/fbdev.py index d436bbcb9..f7cde1bf0 100644 --- a/volatility3/framework/plugins/linux/graphics/fbdev.py +++ b/volatility3/framework/plugins/linux/graphics/fbdev.py @@ -262,7 +262,7 @@ You can try using ffmpeg to decode the raw buffer. Example usage: if not kernel.has_symbol("num_registered_fb"): vollog.error( - '"num_registered_fb" symbol does not exist in the symbol table. This means you are either analyzing an unsupported kernel version, your symbol table is corrupt, or the fbdev driver is compiled as a kernel module..' + '"num_registered_fb" symbol does not exist in the symbol table. This means you are either analyzing an unsupported kernel version, your symbol table is corrupt, or the fbdev driver is compiled as a kernel module.' ) return