From ab5dac10d936c5b668a9c69e6acbada06abcd662 Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 25 Apr 2025 11:54:55 +0100 Subject: [PATCH] Linux: fix virtual to physical offsets for sockscan file_ops method --- .../framework/plugins/linux/sockscan.py | 22 +++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 915a8e834..a123e74cd 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -227,7 +227,25 @@ class Sockscan(plugins.PluginInterface): # sucessfully trversed from file to sock, this will exist in the # kernel layer, and need to be translated to the memory layer. - psock = socket.sk.dereference() + vsock = socket.sk.dereference() + + # get virtual offset + virtual_sock_offset = vsock.vol.offset + + # translate this offset to physical + native_layer = self.context.layers[vmlinux.layer_name] + physical_sock_offset, _physical_layer_name = native_layer.translate( + virtual_sock_offset + ) + + # build sock on the memory_layer using the physical_sock_offset + psock = self.context.object( + vmlinux.symbol_table_name + constants.BANG + "sock", + offset=physical_sock_offset, + layer_name=memory_layer_name, + native_layer_name=vmlinux.layer_name, + ) + return psock except exceptions.InvalidAddressException as error: @@ -336,7 +354,7 @@ class Sockscan(plugins.PluginInterface): # use the init process to build a sock handler # TODO: look into options so that sockstat.SockHandlers so that process_sock can - # be used without a task object. + # be used without a task object. init_task = vmlinux.object_from_symbol(symbol_name="init_task") sock_handler = sockstat.SockHandlers(self.context, symbol_table_name, init_task)