From 83dde6aec31fd79d349644a3b0ac317b73d1cb7f Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 9 Feb 2025 12:26:42 +0100 Subject: [PATCH] improve prel32 comments --- .../framework/plugins/linux/tracing/tracepoints.py | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/tracepoints.py b/volatility3/framework/plugins/linux/tracing/tracepoints.py index 2a79b90d6..89bec4598 100644 --- a/volatility3/framework/plugins/linux/tracing/tracepoints.py +++ b/volatility3/framework/plugins/linux/tracing/tracepoints.py @@ -217,8 +217,10 @@ if the "hidden_modules" key is present in known_modules. tracepoints_end.vol.offset - tracepoints_start.vol.offset ) # kernel's tracepoint_ptr_deref() and tracepoint_ptr_t - # adjust depending on the use of relocated pointers - # or not + # adjust depending on the use of PC-relative addressing + # or not. + # Relocation is commonly used to store pointers as offsets + # relative to their own address rather than absolute addresses/pointers. config_have_arch_prel32_relocations = ( tracepoints_start.vol.subtype.type_name == kernel.symbol_table_name + constants.BANG + "int" @@ -230,9 +232,13 @@ if the "hidden_modules" key is present in known_modules. subtype=kernel.get_type("int"), ) for relative_offset in tracepoints_relative_offsets: + # relative_offset is the value stored at relative_offset.vol.offset + # See kernel's offset_to_ptr(). Example: + # 0xffff9da125e0 = 0x7af138 + 0xffff9d2634a8 + absolute_address = relative_offset + relative_offset.vol.offset tracepoint = kernel.object( "tracepoint", - relative_offset + relative_offset.vol.offset, + absolute_address, absolute=True, ) tracepoints.append(tracepoint)