From a8adf4eaea6f93d32db141a88407e71e86531588 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 8 Aug 2018 17:32:08 -0500 Subject: [PATCH] Fix find_aslr for swapper isgnature and throwing exception instead of returning None --- volatility/framework/automagic/linux.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index c8a779402..1b9f32a36 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -1,7 +1,7 @@ import logging import typing -from volatility.framework import constants, interfaces, validity +from volatility.framework import interfaces, constants, validity, exceptions from volatility.framework.automagic import linux_symbol_cache from volatility.framework.configuration import requirements from volatility.framework.layers import intel, scanners @@ -343,7 +343,7 @@ class LinuxUtilities(object): """Determines the offset of the actual DTB in physical space and its symbol offset""" init_task_symbol = symbol_table + constants.BANG + 'init_task' table_dtb = context.symbol_space.get_symbol(init_task_symbol).address - swapper_signature = b"swapper/0\x00\x00\x00\x00\x00\x00" + swapper_signature = b"swapper(\/0|\x00\x00)\x00\x00\x00\x00\x00\x00" module = context.module(symbol_table, layer_name, 0) for offset in context.memory[layer_name].scan(scanner = scanners.RegExScanner(swapper_signature),