WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 12:47:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Linux automagic: Add support for more recent init_top_pgt symbol.

Browse Source
This commit is contained in:
Mike Auty
2019-11-22 22:40:52 +00:00
parent 06c4a6dcc7
commit a85f6f80f8
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/automagic/linux.py
+4 -1
View File
@@ -74,7 +74,10 @@ class LintelStacker(interfaces.automagic.StackerLayerInterface):
progress_callback = progress_callback)
layer_class = intel.Intel # type: Type
if 'init_level4_pgt' in table.symbols:
if 'init_top_pgt' in table.symbols:
layer_class = intel.Intel32e
dtb_symbol_name = 'init_top_pgt'
elif 'init_level4_pgt' in table.symbols:
layer_class = intel.Intel32e
dtb_symbol_name = 'init_level4_pgt'
else: