WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 13:17:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

linux: vfsmount: improve kernel implementation detection

Browse Source
This commit is contained in:
Gustavo Moreira
2025-01-30 09:34:07 +11:00
parent d077ec3488
commit 74a834b6de
1 changed files with 1 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/linux/extensions/__init__.py
+1 -3
View File
@@ -1575,13 +1575,11 @@ class vfsmount(objects.StructType):
# the 'mnt_parent' member was relocated from the 'vfsmount' struct to the newly # the 'mnt_parent' member was relocated from the 'vfsmount' struct to the newly
# introduced 'mount' struct. # introduced 'mount' struct.
Alternatively, vmlinux.has_type('mount') can be used here but it is faster.
Returns: Returns:
'True' if the kernel lacks the 'mount' struct, typically indicating kernel < 3.3. 'True' if the kernel lacks the 'mount' struct, typically indicating kernel < 3.3.
""" """
return self.has_member("mnt_parent") return not self._context.symbol_space.has_type("mount")
def is_equal(self, vfsmount_ptr) -> bool: def is_equal(self, vfsmount_ptr) -> bool:
"""Helper to make sure it is comparing two pointers to 'vfsmount'. """Helper to make sure it is comparing two pointers to 'vfsmount'.