diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index d99157b3b..116dfa4ae 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -117,14 +117,14 @@ class Sockscan(plugins.PluginInterface): and will warn the user if multiple layers are found. Args: - symbol_table_name: The name of the kernel module on which to operate. + kernel_module_name: The name of the kernel module on which to operate. Returns: memory_layer_name: The name of the layer below the kernel to be scanned. """ # get vmlinux module from context in order to build objects and read symbols - vmlinux = self.context.modules[symbol_table_name] + vmlinux = self.context.modules[kernel_module_name] # get kernel layer from context so that it's dependencies can be found, and therefore scanned. # kernel layer will be virtual and built ontop of a physical layer. @@ -150,16 +150,16 @@ class Sockscan(plugins.PluginInterface): return memory_layer_name - def _find_file_ops_needles(self, symbol_table_name: str): + def _find_file_ops_needles(self, kernel_module_name: str): # get vmlinux module from context in order to read symbols - vmlinux = self.context.modules[symbol_table_name] + vmlinux = self.context.modules[kernel_module_name] file_ops_symbol_names = [ "socket_file_ops", "sockfs_dentry_operations", ] file_ops_needles = self._canonicalize_symbol_addrs( - symbol_table_name, file_ops_symbol_names + kernel_module_name, file_ops_symbol_names ) # get file struct to find the offset to the f_op pointer # this is so that the file object can be created at the correct offset, @@ -168,9 +168,9 @@ class Sockscan(plugins.PluginInterface): return (file_ops_needles, f_op_offset) - def _find_sk_destruct_needles(self, symbol_table_name: str): + def _find_sk_destruct_needles(self, kernel_module_name: str): # get vmlinux module from context in order to read symbols - vmlinux = self.context.modules[symbol_table_name] + vmlinux = self.context.modules[kernel_module_name] socket_destructor_symbol_names = [ "sock_def_destruct", @@ -180,7 +180,7 @@ class Sockscan(plugins.PluginInterface): "inet_sock_destruct", ] socket_destructor_needles = self._canonicalize_symbol_addrs( - symbol_table_name, socket_destructor_symbol_names + kernel_module_name, socket_destructor_symbol_names ) # get sock struct to find the offset to the sk_destruct pointer # this is so that the sock object can be created at the correct offset, @@ -191,7 +191,7 @@ class Sockscan(plugins.PluginInterface): return (socket_destructor_needles, sk_destruct_offset) def _walk_file_ops_needles( - self, symbol_table_name, memory_layer_name, needle_addr, f_op_offset + self, kernel_module_name, memory_layer_name, needle_addr, f_op_offset ): vmlinux = self.context.modules[kernel_module_name] try: