volatilityfoundation
Update Linux DTB scanner to handle newer Linux kernel versions (>= 5.14-rc1)
Since commit 2f064a5 in the Linux kernel (5.14-rc1) the task state field is no longer called "state" but is instead called "__state".
This commit adds support to first look for "state" and if that is not found, attempt to look for the "__state" field.
This should resolve issues some folks been having with newer Linux kernel releases.
Since getting the same error:
Traceback (most recent call last):
File "vol.py", line 192, in
Since getting the same error:
Traceback (most recent call last): File "vol.py", line 192, in main() File "vol.py", line 183, in main command.execute() File "/home/odin/Documents/volatility/volatility/plugins/linux/common.py", line 67, in execute commands.Command.execute(self, *args, **kwargs) File "/home/odin/Documents/volatility/volatility/commands.py", line 116, in execute if not self.is_valid_profile(profsself._config.PROFILE): File "/home/odin/Documents/volatility/volatility/plugins/overlays/linux/linux.py", line 218, in init obj.Profile.init(self, *args, **kwargs) File "/home/odin/Documents/volatility/volatility/obj.py", line 862, in init self.reset() File "/home/odin/Documents/volatility/volatility/plugins/overlays/linux/linux.py", line 232, in reset self.load_vtypes() File "/home/odin/Documents/volatility/volatility/plugins/overlays/linux/linux.py", line 269, in load_vtypes vtypesvar = dwarf.DWARFParser(dwarfdata).finalize() File "/home/odin/Documents/volatility/volatility/dwarf.py", line 72, in init self.feed_line(line) File "/home/odin/Documents/volatility/volatility/dwarf.py", line 163, in feed_line self.process_statement(**parsed) #pylint: disable-msg=W0142 File "/home/odin/Documents/volatility/volatility/dwarf.py", line 267, in process_statement d = data['DW_AT_data_member_location'] KeyError: 'DW_AT_data_member_location'
This PR has nothing to do with errors related to "DW_AT_data_member_location". See #828 for a solution to this.
This PR solves the problem of the inability to process newer kernel memory dumps once the correct DWARF debug version is acquired.
It works for me with a Ubuntu_5.15.0-78-generic dump. Huge thanks and I owe you a beer! (or two)
