From 74a834b6de089a0ba8cca62d9e86314996faa9fb Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 30 Jan 2025 09:22:58 +1100 Subject: [PATCH] linux: vfsmount: improve kernel implementation detection --- volatility3/framework/symbols/linux/extensions/__init__.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index f612dfc3b..ec79b0203 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1575,13 +1575,11 @@ class vfsmount(objects.StructType): # the 'mnt_parent' member was relocated from the 'vfsmount' struct to the newly # introduced 'mount' struct. - Alternatively, vmlinux.has_type('mount') can be used here but it is faster. - Returns: 'True' if the kernel lacks the 'mount' struct, typically indicating kernel < 3.3. """ - return self.has_member("mnt_parent") + return not self._context.symbol_space.has_type("mount") def is_equal(self, vfsmount_ptr) -> bool: """Helper to make sure it is comparing two pointers to 'vfsmount'.