mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-27 20:14:51 +02:00
Fix capabilities plugin on kernels before 6.3
kernel_cap_t only handles the 6.3+ layout and raised for everything else. Before 6.3 the same name exists as a typedef of kernel_cap_struct, whose implementation already decodes the two-element cap array, so fall back to it instead of raising.
This commit is contained in:
@@ -2375,9 +2375,8 @@ class kernel_cap_t(kernel_cap_struct):
|
||||
# In kernels >= 6.3 kernel_cap_t::val is a u64
|
||||
cap_value = self.val
|
||||
else:
|
||||
raise exceptions.VolatilityException(
|
||||
"Unsupported kernel capabilities implementation"
|
||||
)
|
||||
# Before 6.3 kernel_cap_t is a typedef of kernel_cap_struct
|
||||
return super().get_capabilities()
|
||||
|
||||
return cap_value & self.get_kernel_cap_full()
|
||||
|
||||
|
||||
Reference in New Issue
Block a user