WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-22 01:24:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix linux.psscan to use kernel offset when finding symbol location

Browse Source
This commit is contained in:
Eve
2023-03-08 13:39:00 +00:00
parent 3791b21695
commit a34fb84976
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/psscan.py
+1 -1
View File
@@ -111,7 +111,7 @@ class PsScan(interfaces.plugins.PluginInterface):
# find all sched_class names by searching by if they include '_sched_class', e.g. 'fair_sched_class'
if "_sched_class" in symbol:
# use canonicalize to set the appropriate sign extension for the addr
addr = kernel_layer.canonicalize(vmlinux.get_symbol(symbol).address)
addr = kernel_layer.canonicalize(vmlinux.get_symbol(symbol).address + vmlinux.offset)
# append to needles list the packed hex for searching
needles.append(struct.pack(pack_format, addr))