From 1c6a5480170d38760f53e3d1caa2a6dafcba2f46 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 29 Oct 2024 17:30:47 +1100 Subject: [PATCH] Linux: hidden_modules: Simplify symbols type checks --- .../framework/plugins/linux/hidden_modules.py | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index 7fd5f9fad..7a01341c1 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -58,21 +58,10 @@ class Hidden_modules(interfaces.plugins.PluginInterface): modules_addr_max = vmlinux.object_from_symbol("module_addr_max") if isinstance(modules_addr_min, objects.Void): - # Crap ISF! Here's my best-effort workaround - vollog.warning( - "Your ISF symbols are missing type information. You may need to update " - "the ISF using the latest version of dwarf2json" + raise exceptions.VolatilityException( + "Your ISF symbols lack type information. You may need to update the" + "ISF using the latest version of dwarf2json" ) - # See issue #1041. In the Linux kernel these are "unsigned long" - for type_name in ("long unsigned int", "unsigned long"): - if vmlinux.has_type(type_name): - modules_addr_min = modules_addr_min.cast(type_name) - modules_addr_max = modules_addr_max.cast(type_name) - break - else: - raise exceptions.VolatilityException( - "Bad ISF! Please update the ISF using the latest version of dwarf2json" - ) else: raise exceptions.VolatilityException( "Cannot find the module memory allocation area. Unsupported kernel"