Linux: fix virtual to physical offsets for sockscan file_ops method

volatility3/framework/plugins/linux/sockscan.py

@@ -227,7 +227,25 @@ class Sockscan(plugins.PluginInterface):
 
             # sucessfully trversed from file to sock, this will exist in the
             # kernel layer, and need to be translated to the memory layer.
-            psock = socket.sk.dereference()
+            vsock = socket.sk.dereference()
+
+            # get virtual offset
+            virtual_sock_offset = vsock.vol.offset
+
+            # translate this offset to physical
+            native_layer = self.context.layers[vmlinux.layer_name]
+            physical_sock_offset, _physical_layer_name = native_layer.translate(
+                virtual_sock_offset
+            )
+
+            # build sock on the memory_layer using the physical_sock_offset
+            psock = self.context.object(
+                vmlinux.symbol_table_name + constants.BANG + "sock",
+                offset=physical_sock_offset,
+                layer_name=memory_layer_name,
+                native_layer_name=vmlinux.layer_name,
+            )
+
             return psock
 
         except exceptions.InvalidAddressException as error:
@@ -336,7 +354,7 @@ class Sockscan(plugins.PluginInterface):
 
         # use the init process to build a sock handler
         # TODO: look into options so that sockstat.SockHandlers so that process_sock can
-        # be used  without a task object.
+        # be used without a task object.
         init_task = vmlinux.object_from_symbol(symbol_name="init_task")
         sock_handler = sockstat.SockHandlers(self.context, symbol_table_name, init_task)