From ea90b85172cd16d215435d023afbc812181144f6 Mon Sep 17 00:00:00 2001 From: eve Date: Thu, 8 Oct 2026 12:37:57 +0100 Subject: [PATCH] Linux: update _get_boottime_raw for task_struct to support kernels >= 6.17 --- volatility3/framework/constants/_version.py | 2 +- .../framework/symbols/linux/extensions/__init__.py | 12 +++++++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 03494aa7..a2a07efc 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,7 +1,7 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change VERSION_MINOR = 28 # Number of changes that only add to the interface -VERSION_PATCH = 2 # Number of changes that do not change the interface +VERSION_PATCH = 3 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ( diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 8068a3e9..ada68c44 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -750,9 +750,19 @@ class task_struct(generic.GenericIntelProcess): """Returns the boot time in a Timespec64Concrete object.""" vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) - if vmlinux.has_symbol("tk_core"): + if vmlinux.has_symbol("timekeeper_data"): + # kernels >= 6.17 | timekeeper_data[TIMEKEEPER_CORE] | 22c62b9a84b8f16ca0277e133a0cd62a259fee7c + # tk_core became a macro for this. TIMEKEEPER_CORE is always 0: it is the first + # enumerator of enum timekeeper_ids (include/linux/timekeeper_internal.h), with + # or without CONFIG_POSIX_AUX_CLOCKS. + tk_core = vmlinux.object_from_symbol("timekeeper_data")[0] + elif vmlinux.has_symbol("tk_core"): # kernels >= 3.17 | tk_core | 3fdb14fd1df70325e1e91e1203a699a4803ed741 tk_core = vmlinux.object_from_symbol("tk_core") + else: + tk_core = None + + if tk_core is not None: timekeeper = tk_core.timekeeper if not timekeeper.offs_real.has_member("tv64"): # kernels >= 4.10 - Tested on Ubuntu 6.8.0-41