From 7cbab87f06f96ce3c2e887dac080bfbd2d6f95b9 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Tue, 5 Feb 2013 20:05:06 +0000 Subject: [PATCH] move the plugin description for linux_check_evt_arm to proper place for pydoc --- volatility/plugins/linux/check_evt_arm.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility/plugins/linux/check_evt_arm.py b/volatility/plugins/linux/check_evt_arm.py index 1cfb5c9a..bb833261 100644 --- a/volatility/plugins/linux/check_evt_arm.py +++ b/volatility/plugins/linux/check_evt_arm.py @@ -27,12 +27,12 @@ import volatility.plugins.linux.common as linux_common class linux_check_evt_arm(linux_common.AbstractLinuxCommand): + ''' Checks the Exception Vector Table to look for syscall table hooking ''' + VECTOR_BASE = 0xffff0000 SWI_BASE = VECTOR_BASE + 8 def calculate(self): - ''' Performs various checks on the Exception Vector Table to look for syscall table hooking ''' - linux_common.set_plugin_members(self) # Get instructions executed when an inturrupt exception occurs swi = obj.Object("unsigned int", offset = self.SWI_BASE, vm = self.addr_space)