From a34fb8497633394062e10366553a2c69ba10c85a Mon Sep 17 00:00:00 2001 From: Eve Date: Wed, 8 Mar 2023 13:31:37 +0000 Subject: [PATCH] Fix linux.psscan to use kernel offset when finding symbol location --- volatility3/framework/plugins/linux/psscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/psscan.py b/volatility3/framework/plugins/linux/psscan.py index ba233e53d..60b96ba40 100644 --- a/volatility3/framework/plugins/linux/psscan.py +++ b/volatility3/framework/plugins/linux/psscan.py @@ -111,7 +111,7 @@ class PsScan(interfaces.plugins.PluginInterface): # find all sched_class names by searching by if they include '_sched_class', e.g. 'fair_sched_class' if "_sched_class" in symbol: # use canonicalize to set the appropriate sign extension for the addr - addr = kernel_layer.canonicalize(vmlinux.get_symbol(symbol).address) + addr = kernel_layer.canonicalize(vmlinux.get_symbol(symbol).address + vmlinux.offset) # append to needles list the packed hex for searching needles.append(struct.pack(pack_format, addr))