From 9f6d1949800981e7d5cc6416b661880fe8041a38 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 19 Nov 2024 12:47:56 +1100 Subject: [PATCH] linux: intel VMCoreInfo: The _direct_metadata class attribute needs to be modified; otherwise, it will only exist within the instance namespace. --- volatility3/framework/automagic/linux.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 2b7cdf4cc..8c4ccd8e3 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -379,8 +379,8 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): aslr_shift, dtb, ) - # Add the vmcoreinfo dict to the layer metadata - layer._direct_metadata = collections.ChainMap( + # Add the vmcoreinfo dict to the layer class metadata + layer.__class__._direct_metadata = collections.ChainMap( {"vmcoreinfo": vmcoreinfo}, layer._direct_metadata )