diff --git a/volatility/framework/plugins/linux/check_afinfo.py b/volatility/framework/plugins/linux/check_afinfo.py index 3ca8b3546..d3f0530db 100644 --- a/volatility/framework/plugins/linux/check_afinfo.py +++ b/volatility/framework/plugins/linux/check_afinfo.py @@ -23,7 +23,7 @@ typically found in Linux's /proc file system. import logging from typing import List -from volatility.framework import exceptions, interfaces +from volatility.framework import exceptions, interfaces, contexts from volatility.framework import renderers from volatility.framework.automagic import linux from volatility.framework.configuration import requirements @@ -78,11 +78,13 @@ class Check_afinfo(plugins.PluginInterface): yield var_name, "show", var.seq_show def _generator(self): - _, aslr_shift = linux.LinuxUtilities.find_aslr(self.context, self.config['vmlinux'], self.config['primary']) - vmlinux = self.context.module(self.config['vmlinux'], self.config['primary'], aslr_shift) + linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary']) - linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['primary'], self.config['vmlinux'], - aslr_shift) + vmlinux = contexts.Module(self.context, + self.config['vmlinux'], + self.config['primary'], + 0, + absolute_symbol_addresses = True) op_members = vmlinux.get_type('file_operations').members seq_members = vmlinux.get_type('seq_operations').members diff --git a/volatility/framework/plugins/linux/check_syscall.py b/volatility/framework/plugins/linux/check_syscall.py index f43fd4f11..61d72ead4 100644 --- a/volatility/framework/plugins/linux/check_syscall.py +++ b/volatility/framework/plugins/linux/check_syscall.py @@ -23,7 +23,7 @@ typically found in Linux's /proc file system. import logging from typing import List -from volatility.framework import exceptions, interfaces +from volatility.framework import exceptions, interfaces, contexts from volatility.framework import renderers, constants from volatility.framework.automagic import linux from volatility.framework.configuration import requirements @@ -143,11 +143,13 @@ class Check_syscall(plugins.PluginInterface): # TODO - add finding and parsing unistd.h once cached file enumeration is added def _generator(self): - _, aslr_shift = linux.LinuxUtilities.find_aslr(self.context, self.config['vmlinux'], self.config['primary']) - vmlinux = self.context.module(self.config['vmlinux'], self.config['primary'], aslr_shift) + linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary']) - linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'], - aslr_shift) + vmlinux = contexts.Module(self.context, + self.config['vmlinux'], + self.config['primary'], + 0, + absolute_symbol_addresses = True) ptr_sz = vmlinux.get_type("pointer").size if ptr_sz == 4: diff --git a/volatility/framework/plugins/linux/lsmod.py b/volatility/framework/plugins/linux/lsmod.py index fe98192a0..8ed53718f 100644 --- a/volatility/framework/plugins/linux/lsmod.py +++ b/volatility/framework/plugins/linux/lsmod.py @@ -24,6 +24,7 @@ typically found in Linux's /proc file system. from typing import List from volatility.framework import renderers, constants, interfaces +from volatility.framework import exceptions, contexts from volatility.framework.automagic import linux from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins @@ -45,17 +46,19 @@ class Lsmod(plugins.PluginInterface): @classmethod def list_modules(cls, context: interfaces.context.ContextInterface, layer_name: str, vmlinux_symbols: str): """Lists all the modules in the primary layer""" + linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name) - _, aslr_shift = linux.LinuxUtilities.find_aslr(context, vmlinux_symbols, layer_name) - vmlinux = context.module(vmlinux_symbols, layer_name, aslr_shift) - - module_head_addr = vmlinux.get_symbol("modules").address - - modules = vmlinux.object(type_name = "list_head", offset = module_head_addr) + vmlinux = contexts.Module(context, + vmlinux_symbols, + layer_name, + 0, + absolute_symbol_addresses = True) + + modules = vmlinux.object(symbol_name = "modules").cast("list_head") table_name = modules.vol.type_name.split(constants.BANG)[0] - for module in modules.to_list("{}{}module".format(table_name, constants.BANG), "list"): + for module in modules.to_list(table_name + constants.BANG + "module", "list"): yield module def _generator(self):