From 97945c33bb58dd6ceeffff4a91804effd7a2f144 Mon Sep 17 00:00:00 2001 From: atcuno Date: Tue, 15 Apr 2014 16:10:50 -0500 Subject: [PATCH] Linux - tty check --- volatility/plugins/linux/tty_check.py | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/volatility/plugins/linux/tty_check.py b/volatility/plugins/linux/tty_check.py index aac1396b..22abf371 100644 --- a/volatility/plugins/linux/tty_check.py +++ b/volatility/plugins/linux/tty_check.py @@ -57,15 +57,13 @@ class linux_check_tty(linux_common.AbstractLinuxCommand): name = tty_dev.name recv_buf = tty_dev.ldisc.ops.receive_buf - if recv_buf in sym_cache: - sym_name = sym_cache[recv_buf] - else: - sym_name = self.is_known_address(recv_buf, modules) + hooked = self.is_known_address(recv_buf, modules) - if not sym_name: + if hooked: sym_name = "HOOKED" hooked = 1 else: + sym_name = self.profile.get_symbol_by_address("kernel", call_addr) hooked = 0 sym_cache[recv_buf] = sym_name