volatilityfoundation / volatilityfoundation/volatility3
Kallsyms does a lot of stuff manually that should use the framework
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 4.4k
- Forks
- 705
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 3
Description
From #1599, there's [an open comment[(https://github.com/volatilityfoundation/volatility3/pull/1599/files/bf0271cd5765d656cc9a3844bb8b5c7e69e650ec#r1938483310) that points out that it does a lot of manual reads rather than using the framework. The rationale for this was to avoid loading symbol tables or similar, but since the plugin has a requirement on as kernel, the symbol table will have already been loaded (plus the needed symbols are just an array of pointers, which are both base types and therefore should be present regardless).
Rework get_task_callstack so that it creates an array of pointer -> void, which can then be used to get the address and value of the pointers.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the get_task_callstack entry point and review the related framework usage, beginning with the comment on pull request #1599. Rework it to create an array of pointer-to-void values and use those values to obtain pointer addresses and contents, while preserving the existing call-stack behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- operating-systems
- Issue type
- Refactor
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100