WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-09 11:17:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Initial attempts at cloning a symbol table

Browse Source
This commit is contained in:
Mike Auty
2020-06-10 19:39:20 +01:00
committed by ikelos
parent fabb4f4924
commit 2748ce32d8
18 changed files with 69 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/linux/check_afinfo.py
+1 -1
View File
@@ -64,7 +64,7 @@ class Check_afinfo(plugins.PluginInterface):
def _generator(self):
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0)
vmlinux = contexts.Module(self.context, masked_vmlinux_symbols, self.config['primary'], 0)
op_members = vmlinux.get_type('file_operations').members
seq_members = vmlinux.get_type('seq_operations').members
volatility/framework/plugins/linux/check_syscall.py
+3 -2
View File
@@ -122,9 +122,10 @@ class Check_syscall(plugins.PluginInterface):
# TODO - add finding and parsing unistd.h once cached file enumeration is added
def _generator(self):
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
masked_symbol_table = linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'],
self.config['primary'])
vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0)
vmlinux = contexts.Module(self.context, masked_symbol_table, self.config['primary'], 0)
ptr_sz = vmlinux.get_type("pointer").size
if ptr_sz == 4:
volatility/framework/plugins/linux/lsmod.py
+3 -4
View File
@@ -5,8 +5,7 @@
found in Linux's /proc file system."""
import logging
from typing import List, Generator, Iterable
from typing import List, Iterable
from volatility.framework import contexts
from volatility.framework import exceptions, renderers, constants, interfaces
@@ -46,9 +45,9 @@ class Lsmod(plugins.PluginInterface):
This function will throw a SymbolError exception if kernel module support is not enabled.
"""
linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
masked_vmlinux_symbols = linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0)
vmlinux = contexts.Module(context, masked_vmlinux_symbols, layer_name, 0)
modules = vmlinux.object_from_symbol(symbol_name = "modules").cast("list_head")
volatility/framework/plugins/linux/lsof.py
+3 -2
View File
@@ -45,7 +45,8 @@ class Lsof(plugins.PluginInterface):
yield (0, (pid, name, fd_num, full_path))
def run(self):
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
masked_vmlinux_symbols = linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'],
self.config['primary'])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
@@ -53,5 +54,5 @@ class Lsof(plugins.PluginInterface):
self._generator(
pslist.PsList.list_tasks(self.context,
self.config['primary'],
self.config['vmlinux'],
masked_vmlinux_symbols,
filter_func = filter_func)))
volatility/framework/plugins/linux/pslist.py
+2 -2
View File
@@ -75,9 +75,9 @@ class PsList(interfaces.plugins.PluginInterface):
Yields:
Process objects
"""
linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
masked_vmlinux_symbols = linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0)
vmlinux = contexts.Module(context, masked_vmlinux_symbols, layer_name, 0)
init_task = vmlinux.object_from_symbol(symbol_name = "init_task")