volatility3
volatility3 copied to clipboard
Kallsyms does a lot of stuff manually that should use the framework
From #1599, there's [an open comment[(https://github.com/volatilityfoundation/volatility3/pull/1599/files/bf0271cd5765d656cc9a3844bb8b5c7e69e650ec#r1938483310) that points out that it does a lot of manual reads rather than using the framework. The rationale for this was to avoid loading symbol tables or similar, but since the plugin has a requirement on as kernel, the symbol table will have already been loaded (plus the needed symbols are just an array of pointers, which are both base types and therefore should be present regardless).
Rework get_task_callstack so that it creates an array of pointer -> void, which can then be used to get the address and value of the pointers.