WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 20:57:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

improve prel32 comments

Browse Source
This commit is contained in:
Abyss Watcher
2025-02-09 12:26:42 +01:00
parent 0abe258765
commit 83dde6aec3
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/tracing/tracepoints.py
+9 -3
View File
@@ -217,8 +217,10 @@ if the "hidden_modules" key is present in known_modules.
tracepoints_end.vol.offset - tracepoints_start.vol.offset
)
# kernel's tracepoint_ptr_deref() and tracepoint_ptr_t
# adjust depending on the use of relocated pointers
# or not
# adjust depending on the use of PC-relative addressing
# or not.
# Relocation is commonly used to store pointers as offsets
# relative to their own address rather than absolute addresses/pointers.
config_have_arch_prel32_relocations = (
tracepoints_start.vol.subtype.type_name
== kernel.symbol_table_name + constants.BANG + "int"
@@ -230,9 +232,13 @@ if the "hidden_modules" key is present in known_modules.
subtype=kernel.get_type("int"),
)
for relative_offset in tracepoints_relative_offsets:
# relative_offset is the value stored at relative_offset.vol.offset
# See kernel's offset_to_ptr(). Example:
# 0xffff9da125e0 = 0x7af138 + 0xffff9d2634a8
absolute_address = relative_offset + relative_offset.vol.offset
tracepoint = kernel.object(
"tracepoint",
relative_offset + relative_offset.vol.offset,
absolute_address,
absolute=True,
)
tracepoints.append(tracepoint)