From 9175c1b1e96240ebb2947309043ec0416e44da2d Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 1 Feb 2025 20:43:01 +1100 Subject: [PATCH] linux: kallsyms api: ensure all the addresses are in the same range --- volatility3/framework/symbols/linux/kallsyms.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/kallsyms.py b/volatility3/framework/symbols/linux/kallsyms.py index a113dd6b1..493a82538 100644 --- a/volatility3/framework/symbols/linux/kallsyms.py +++ b/volatility3/framework/symbols/linux/kallsyms.py @@ -495,6 +495,7 @@ class Kallsyms(interfaces.configuration.VersionableInterface): Returns: Symbol address """ + layer = self._context.layers[self._layer_name] if self._kallsyms_offsets_address: # kernels >= 4.6 - Addresses are relative to kallsyms_relative_base # It assumes: CONFIG_KALLSYMS_BASE_RELATIVE=y and CONFIG_KALLSYMS_ABSOLUTE_PERCPU=y @@ -507,7 +508,7 @@ class Kallsyms(interfaces.configuration.VersionableInterface): return self._kallsyms_relative_base - 1 - sym_addr # Positive offsets are absolute values - return sym_addr + return sym_addr & layer.address_mask elif self._kas_config.addresses_address: # kernels < 4.6 - Addresses are absolute # unsigned long kallsyms_addresses[] @@ -516,7 +517,7 @@ class Kallsyms(interfaces.configuration.VersionableInterface): self._long_size, signed=False, ) - return kallsyms_address + return kallsyms_address & layer.address_mask else: raise exceptions.VolatilityException("Unsupported kernel")