Conversation
ikelos
left a comment
ikelos
left a comment
There was a problem hiding this comment.
Well, not sure how you managed it, but looks like you managed to scrape by without really needing a version bump on anything! I would still request at least a PATCH version bump on LinuxUtilities before I merge it, so we can more quickly identify what might have changed if people start experiencing issues...
| if vma.is_suspicious(proc_layer) and vma_name != "[vdso]": | ||
| data = proc_layer.read(vma.vm_start, 64, pad=True) | ||
| yield vma, data | ||
| yield vma, vma_name, data |
There was a problem hiding this comment.
It's an internal/non-exposed function, so this change is fine, but could we get a return type in the function signature please?
| fname = "Anonymous Mapping" | ||
| return fname | ||
|
|
||
| def get_name(self, context, task) -> Optional[str]: |
There was a problem hiding this comment.
Yeah, there wasn't a return type defined, so theoretically you could make a case for it being ok, but I'd at least bump the PATCH number, so we know that changes were made and be able to differentiate if strange things start being reported please. Hopefully this is in line to be moved to its own separate module in the same style as the ftrace stuff at some point...
There was a problem hiding this comment.
ok where do I bump the PATCH number for this for now?
ikelos
added
the
awaiting-author-response
2 participants
The
get_nameAPI of vm_area_struct instances could (and did in testing) throw invalid address exception, which doesn't match how otherget_*APIs work and really defeats the purpose of them. So I fixed the API to properly return None on these errors and updated the typing to reflect that (it was missing before). I also changed the callers of this API to properly display a renderer value when the name isn't found.malfind for vol3 was also strange in that it didn't show the path of code injection regions, which is a key artifact. Given that malfind uses
get_name, I added the path fixes for it in along with its API fixing.Sample: ggmemday1