From 94631b577dcfa044f02bb933c900cb463cdd68bb Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Mon, 25 Mar 2013 16:00:52 +0000 Subject: [PATCH] linux check_idt, null/unimplemented handlers shouldn't be reported as HOOKED --- volatility/plugins/linux/check_idt.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/plugins/linux/check_idt.py b/volatility/plugins/linux/check_idt.py index 7a92ff32..e8d9a7e3 100644 --- a/volatility/plugins/linux/check_idt.py +++ b/volatility/plugins/linux/check_idt.py @@ -63,7 +63,7 @@ class linux_check_idt(linux_common.AbstractLinuxCommand): idt_addr = ent.Address - if not idt_addr in sym_addrs: + if idt_addr != 0 and not idt_addr in sym_addrs: yield(i, idt_addr, 1) else: yield(i, idt_addr, 0)