From 94f989be7ab0fe7704ca69d134b29f27d8a3a84b Mon Sep 17 00:00:00 2001 From: eve Date: Wed, 31 Dec 2025 12:54:41 +0000 Subject: [PATCH] Linux: update sockscan to add docstring to _find_file_ops_needles --- volatility3/framework/plugins/linux/sockscan.py | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 0056a1925..9288d85f0 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -151,6 +151,16 @@ class Sockscan(plugins.PluginInterface): return memory_layer_name def _find_file_ops_needles(self, kernel_module_name: str): + """Retrieves socket file symbols and the offset to the 'f_op' pointer. + + Args: + kernel_module_name (str): The name of the kernel module to search. + + Returns: + Tuple[List[int], int]: A list of file symbol addresses and, + the offset to the 'f_op' pointer. + """ + # get vmlinux module from context in order to read symbols vmlinux = self.context.modules[kernel_module_name]