From 96f5fdae2f48b6a87f735daa3fc56e7aa2902c61 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Tue, 19 Nov 2024 11:25:52 +1100
Subject: [PATCH] linux: intel VMCoreInfo: Add the vmcoreinfo to the layer
 metadata

---
 volatility3/framework/automagic/linux.py | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py
index 81f5f5661..2b7cdf4cc 100644
--- a/volatility3/framework/automagic/linux.py
+++ b/volatility3/framework/automagic/linux.py
@@ -2,8 +2,9 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
-import logging
 import os
+import logging
+import collections
 from typing import Optional, Tuple, Type
 
 from volatility3.framework import constants, interfaces
@@ -107,11 +108,13 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface):
                     join(config_path, LinuxSymbolFinder.banner_config_key)
                 ] = str(banner, "latin-1")
 
+                # Set an empty vmcoreinfo entry to prevent using the wrong one in the layer stack.
+                layer_metadata = dict(os="Linux", vmcoreinfo={})
                 layer = layer_class(
                     context,
                     config_path=config_path,
                     name=new_layer_name,
-                    metadata={"os": "Linux"},
+                    metadata=layer_metadata,
                 )
                 layer.config["kernel_virtual_offset"] = aslr_shift
 
@@ -376,6 +379,10 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface):
                         aslr_shift,
                         dtb,
                     )
+                    # Add the vmcoreinfo dict to the layer metadata
+                    layer._direct_metadata = collections.ChainMap(
+                        {"vmcoreinfo": vmcoreinfo}, layer._direct_metadata
+                    )
 
                     return layer