WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-11 12:17:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Linux: dentry object extension: Add a method to walk dentries subdirectories

Browse Source
This commit is contained in:
Gustavo Moreira
2024-08-03 21:05:23 +10:00
parent 231f682b27
commit a369a9e23c
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/linux/extensions/__init__.py
+20
View File
@@ -820,6 +820,26 @@ class dentry(objects.StructType):
current_dentry = current_dentry.d_parent
return None
def get_subdirs(self) -> interfaces.objects.ObjectInterface:
"""Walks dentry subdirs
Yields:
A dentry object
"""
if self.has_member("d_sib") and self.has_member("d_children"):
# kernels >= 6.8
walk_member = "d_sib"
list_head_member = self.d_children.first
elif self.has_member("d_child") and self.has_member("d_subdirs"):
# 2.5.0 <= kernels < 6.8
walk_member = "d_child"
list_head_member = self.d_subdirs
else:
raise exceptions.VolatilityException("Unsupported dentry type")
dentry_type_name = self.get_symbol_table_name() + constants.BANG + "dentry"
yield from list_head_member.to_list(dentry_type_name, walk_member)
class struct_file(objects.StructType):
def get_dentry(self) -> interfaces.objects.ObjectInterface: