From ad4bf2d0cbe9b32f337dbca103268d4de10903ff Mon Sep 17 00:00:00 2001 From: atcuno Date: Thu, 26 Sep 2013 18:11:25 +0000 Subject: [PATCH] Linux - simplify logic in check_idt --- volatility/plugins/linux/check_idt.py | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/volatility/plugins/linux/check_idt.py b/volatility/plugins/linux/check_idt.py index 265b4b66..2b04fdbd 100644 --- a/volatility/plugins/linux/check_idt.py +++ b/volatility/plugins/linux/check_idt.py @@ -63,14 +63,15 @@ class linux_check_idt(linux_common.AbstractLinuxCommand): idt_addr = ent.Address - if idt_addr != 0 and not idt_addr in sym_addrs: - hooked = 1 - sym_name = "HOOKED" - else: - hooked = 0 - sym_name = self.profile.get_symbol_by_address("kernel", idt_addr) - - yield(i, idt_addr, sym_name, hooked) + if idt_addr != 0: + if not idt_addr in sym_addrs: + hooked = 1 + sym_name = "HOOKED" + else: + hooked = 0 + sym_name = self.profile.get_symbol_by_address("kernel", idt_addr) + + yield(i, idt_addr, sym_name, hooked) def render_text(self, outfd, data):