volatilityfoundation/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-10-11 22:40:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Linux: update _get_boottime_raw for task_struct to support kernels >= 6.17

Browse Source
This commit is contained in:
eve
2026-10-08 12:37:57 +01:00
parent 3fcb731e0b
commit ea90b85172
2 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/constants/_version.py
+1 -1
View File
@@ -1,7 +1,7 @@
# We use the SemVer 2.0.0 versioning scheme
VERSION_MAJOR = 2 # Number of releases of the library with a breaking change
VERSION_MINOR = 28 # Number of changes that only add to the interface
VERSION_PATCH = 2 # Number of changes that do not change the interface
VERSION_PATCH = 3 # Number of changes that do not change the interface
VERSION_SUFFIX = ""
PACKAGE_VERSION = (
volatility3/framework/symbols/linux/extensions/__init__.py
+11 -1
View File
@@ -750,9 +750,19 @@ class task_struct(generic.GenericIntelProcess):
"""Returns the boot time in a Timespec64Concrete object."""
vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self)
if vmlinux.has_symbol("tk_core"):
if vmlinux.has_symbol("timekeeper_data"):
# kernels >= 6.17 | timekeeper_data[TIMEKEEPER_CORE] | 22c62b9a84b8f16ca0277e133a0cd62a259fee7c
# tk_core became a macro for this. TIMEKEEPER_CORE is always 0: it is the first
# enumerator of enum timekeeper_ids (include/linux/timekeeper_internal.h), with
# or without CONFIG_POSIX_AUX_CLOCKS.
tk_core = vmlinux.object_from_symbol("timekeeper_data")[0]
elif vmlinux.has_symbol("tk_core"):
# kernels >= 3.17 | tk_core | 3fdb14fd1df70325e1e91e1203a699a4803ed741
tk_core = vmlinux.object_from_symbol("tk_core")
else:
tk_core = None
if tk_core is not None:
timekeeper = tk_core.timekeeper
if not timekeeper.offs_real.has_member("tv64"):
# kernels >= 4.10 - Tested on Ubuntu 6.8.0-41