diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 0fed4d71f..2830a8e58 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -179,16 +179,27 @@ class module(generic.GenericIntelProcess): return None def _get_sect_count(self, grp: interfaces.objects.ObjectInterface) -> int: - """Try to determine the number of valid sections""" + """Try to determine the number of valid sections. Support for kernels > 6.14-rc1. + + Resources: + - https://github.com/torvalds/linux/commit/d8959b947a8dfab1047c6fd5e982808f65717bfe + - https://github.com/torvalds/linux/commit/e0349c46cb4fbbb507fa34476bd70f9c82bad359 + """ + + if grp.has_member("bin_attrs"): + arr_offset = grp.bin_attrs + else: + arr_offset = grp.attrs + symbol_table_name = self.get_symbol_table_name() arr = self._context.object( symbol_table_name + constants.BANG + "array", layer_name=self.vol.layer_name, - offset=grp.attrs, + offset=arr_offset, subtype=self._context.symbol_space.get_type( symbol_table_name + constants.BANG + "pointer" ), - count=25, + count=50, ) idx = 0 @@ -198,6 +209,7 @@ class module(generic.GenericIntelProcess): @functools.cached_property def number_of_sections(self) -> int: + # Dropped in 6.14-rc1: d8959b947a8dfab1047c6fd5e982808f65717bfe if self.sect_attrs.has_member("nsections"): return self.sect_attrs.nsections