From 825cb321a58ae211a60a1419fa1ea98d7122ceb5 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 15 Apr 2025 17:11:53 +0200 Subject: [PATCH] sections manual enumeration adjustment --- .../framework/symbols/linux/utilities/module_extract.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index e55f77668..c2732f216 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -38,7 +38,7 @@ vollog = logging.getLogger(__name__) class ModuleExtract(interfaces.configuration.VersionableInterface): """Extracts Linux kernel module structures into an analyzable ELF file""" - _version = (1, 0, 0) + _version = (1, 0, 1) _required_framework_version = (2, 25, 0) framework.require_interface_version(*_required_framework_version) @@ -60,9 +60,14 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): count = 0 try: + if grp.has_member("bin_attrs"): + arr_offset = grp.bin_attrs + else: + arr_offset = grp.attrs + array = kernel.object( object_type="array", - offset=grp.attrs, + offset=arr_offset, sub_type=kernel.get_type("pointer"), count=50, absolute=True,