From a9691fbe77b72bed2cd5b12471d8f5deaae88813 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 9 Feb 2025 12:41:23 +0100 Subject: [PATCH] remove unnecessary object creation --- volatility3/framework/plugins/linux/tracing/tracepoints.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/tracepoints.py b/volatility3/framework/plugins/linux/tracing/tracepoints.py index 89bec4598..247e139d5 100644 --- a/volatility3/framework/plugins/linux/tracing/tracepoints.py +++ b/volatility3/framework/plugins/linux/tracing/tracepoints.py @@ -212,10 +212,10 @@ if the "hidden_modules" key is present in known_modules. tracepoints = [] tracepoints_start = kernel.object_from_symbol("__start___tracepoints_ptrs") - tracepoints_end = kernel.object_from_symbol("__stop___tracepoints_ptrs") - tracepoints_array_size = ( - tracepoints_end.vol.offset - tracepoints_start.vol.offset + tracepoints_end = kernel.get_absolute_symbol_address( + "__stop___tracepoints_ptrs" ) + tracepoints_array_size = tracepoints_end - tracepoints_start.vol.offset # kernel's tracepoint_ptr_deref() and tracepoint_ptr_t # adjust depending on the use of PC-relative addressing # or not.