Skip to content

Commit fda3ced

Browse files
committed
Linux: update kmsg to create objects via context rather than module
1 parent b9c60a5 commit fda3ced

File tree

1 file changed

+12
-11
lines changed
  • volatility3/framework/plugins/linux

1 file changed

+12
-11
lines changed

volatility3/framework/plugins/linux/kmsg.py

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -64,10 +64,8 @@ def __init__(
6464
):
6565
self._context = context
6666
self._config = config
67-
vmlinux = context.modules[self._config["kernel"]]
68-
self.layer_name = vmlinux.layer_name # type: ignore
69-
symbol_table_name = vmlinux.symbol_table_name # type: ignore
70-
self.vmlinux = contexts.Module.create(context, symbol_table_name, self.layer_name, vmlinux.offset) # type: ignore
67+
self.vmlinux = context.modules[self._config["kernel"]]
68+
self.layer_name = self.vmlinux.layer_name # type: ignore
7169
self.long_unsigned_int_size = self.vmlinux.get_type("long unsigned int").size
7270

7371
@classmethod
@@ -358,21 +356,24 @@ def run(self) -> Iterator[Tuple[str, str, str, str, str]]:
358356

359357
desc_ring = ringbuffers.desc_ring
360358
text_data_ring = ringbuffers.text_data_ring
361-
362359
desc_count = 1 << desc_ring.count_bits
363-
desc_arr = self.vmlinux.object(
364-
object_type="array",
360+
361+
array_type = self.vmlinux.symbol_table_name + constants.BANG + "array"
362+
363+
desc_arr = self._context.object(
364+
array_type,
365365
offset=desc_ring.descs,
366366
subtype=self.vmlinux.get_type("prb_desc"),
367367
count=desc_count,
368-
absolute=True,
368+
layer_name=self.layer_name,
369369
)
370-
info_arr = self.vmlinux.object(
371-
object_type="array",
370+
371+
info_arr = self._context.object(
372+
array_type,
372373
offset=desc_ring.infos,
373374
subtype=self.vmlinux.get_type("printk_info"),
374375
count=desc_count,
375-
absolute=True,
376+
layer_name=self.layer_name,
376377
)
377378

378379
# See kernel/printk/printk_ringbuffer.h

0 commit comments

Comments
 (0)