diff --git a/volatility/dwarf.py b/volatility/dwarf.py index 89feb7131..5768d0991 100644 --- a/volatility/dwarf.py +++ b/volatility/dwarf.py @@ -50,6 +50,7 @@ class DWARFParser(object): 'unsigned int': 'unsigned int', 'sizetype' : 'unsigned long', 'ssizetype' : 'long', + '__int128 unsigned': 'unsigned long long', } diff --git a/volatility/plugins/overlays/linux/linux.py b/volatility/plugins/overlays/linux/linux.py index eb19d3446..a84d132c1 100644 --- a/volatility/plugins/overlays/linux/linux.py +++ b/volatility/plugins/overlays/linux/linux.py @@ -153,7 +153,7 @@ def parse_system_map(data, module): except ValueError: continue - if symbol == "arm_syscall": + if symbol == "arm_syscall" or symbol == "compat_arm_syscall": arch = "ARM" if not symbol in sys_map[module]: @@ -192,7 +192,7 @@ def LinuxProfileFactory(profpkg): sysmapdata = profpkg.read(f.filename) arch, memmodel, sysmap = parse_system_map(profpkg.read(f.filename), "kernel") - if memmodel == "64bit": + if memmodel == "64bit" and arch == "x86": arch = "x64" if not sysmapdata or not dwarfdata: