WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 11:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Linux: hidden_modules: Simplify symbols type checks

Browse Source
This commit is contained in:
Gustavo Moreira
2024-10-29 17:30:47 +11:00
parent dfd8a1f195
commit 1c6a548017
1 changed files with 3 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/hidden_modules.py
+3 -14
View File
@@ -58,21 +58,10 @@ class Hidden_modules(interfaces.plugins.PluginInterface):
modules_addr_max = vmlinux.object_from_symbol("module_addr_max")
if isinstance(modules_addr_min, objects.Void):
# Crap ISF! Here's my best-effort workaround
vollog.warning(
"Your ISF symbols are missing type information. You may need to update "
"the ISF using the latest version of dwarf2json"
raise exceptions.VolatilityException(
"Your ISF symbols lack type information. You may need to update the"
"ISF using the latest version of dwarf2json"
)
# See issue #1041. In the Linux kernel these are "unsigned long"
for type_name in ("long unsigned int", "unsigned long"):
if vmlinux.has_type(type_name):
modules_addr_min = modules_addr_min.cast(type_name)
modules_addr_max = modules_addr_max.cast(type_name)
break
else:
raise exceptions.VolatilityException(
"Bad ISF! Please update the ISF using the latest version of dwarf2json"
)
else:
raise exceptions.VolatilityException(
"Cannot find the module memory allocation area. Unsupported kernel"