From 25eaaff06cbd0f517c71e3074144eec3cf4fbea2 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 26 Mar 2025 01:30:26 +0000 Subject: [PATCH] Bring hidden module to expose dump option. Fix CodeQL found bug --- volatility3/framework/plugins/linux/hidden_modules.py | 8 +++++++- .../framework/symbols/linux/utilities/module_extract.py | 2 +- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index c6f5d749e..5d44ccb00 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -19,7 +19,7 @@ class Hidden_modules(plugins.PluginInterface): """Carves memory to find hidden kernel modules""" _required_framework_version = (2, 10, 0) - _version = (3, 0, 0) + _version = (3, 0, 1) @classmethod def get_hidden_modules( @@ -72,6 +72,12 @@ class Hidden_modules(plugins.PluginInterface): component=linux_utilities_modules.ModuleDisplayPlugin, version=(1, 0, 0), ), + requirements.BooleanRequirement( + name="dump", + description="Extract listed modules", + default=False, + optional=True, + ), ] @staticmethod diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index 41b4e29b0..fbe9053ec 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -782,7 +782,7 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): hasattr(module.sect_attrs, "nsections") except exceptions.InvalidAddressException: vollog.debug(f"module at offset {module.vol.offset:#x} is paged out.") - return + return None # Gather sections updated_sections, strtab_index, symtab_index = cls._parse_sections(