From 7f966901cf680cdf05d61ecd5d1be90fa49e8fc7 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 2 Sep 2018 18:28:59 +0100 Subject: [PATCH] Ensure the dtb can't get specified from an earlier run around the loop. --- volatility/framework/automagic/linux.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index b75c97637..40980405b 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -113,12 +113,12 @@ class LintelStacker(interfaces.automagic.StackerLayerInterface): layer = context.memory[layer_name] join = interfaces.configuration.path_join - dtb = None - linux_banners = linux_symbol_cache.LinuxSymbolCache.load_linux_banners() mss = scanners.MultiStringScanner([x for x in linux_banners if x is not None]) for _, banner in layer.scan(context = context, scanner = mss, progress_callback = progress_callback): + dtb = None vollog.debug("Identified banner: {}".format(repr(banner))) + symbol_files = linux_banners.get(banner, None) if symbol_files: isf_path = symbol_files[0]