search

volatilityfoundation / volatility3

Volatility 3.0 development
http://volatilityfoundation.org/
Other
2.72k stars 461 forks source link

Linux: netfilter plugin: Fix hooked field to match Volatility2 output #1323

Closed gcmoreira closed 1 week ago

gcmoreira commented 3 weeks ago

This PR fixes how the hooked module is interpreted to match the output of its Volatility2 counterpart.

ikelos commented 2 weeks ago

So... for clarity, this is waiting on the docstring being improved (from just hooked?) and for someone to tell me that the column title is unambiguous and that flipping this return value won't confuse anyone in any way.

atcuno commented 2 weeks ago

Yes it won't be confusing. Hooked is saying the network stack has been hijacked by a non-legitimate source. The logic was just inversed previously for determining the boolean value.

ikelos commented 1 week ago

Would hijacked be clearer or is hooked the more accurate technical term? If you're happy no one will get confused then I'm happy to merge it...

ikelos commented 1 week ago

Cool, looks good thanks for the fix! 5:)