WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 17:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

switch linux_lsmod to absolute_symbol_addresses interface

Browse Source
This commit is contained in:
Andrew Case
2018-12-27 22:41:03 +00:00
committed by ikelos
parent 59d3f2b8ee
commit 2a0aec8104
3 changed files with 24 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/linux/check_afinfo.py
+7 -5
View File
@@ -23,7 +23,7 @@ typically found in Linux's /proc file system.
import logging
from typing import List
from volatility.framework import exceptions, interfaces
from volatility.framework import exceptions, interfaces, contexts
from volatility.framework import renderers
from volatility.framework.automagic import linux
from volatility.framework.configuration import requirements
@@ -78,11 +78,13 @@ class Check_afinfo(plugins.PluginInterface):
yield var_name, "show", var.seq_show
def _generator(self):
_, aslr_shift = linux.LinuxUtilities.find_aslr(self.context, self.config['vmlinux'], self.config['primary'])
vmlinux = self.context.module(self.config['vmlinux'], self.config['primary'], aslr_shift)
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['primary'], self.config['vmlinux'],
aslr_shift)
vmlinux = contexts.Module(self.context,
self.config['vmlinux'],
self.config['primary'],
0,
absolute_symbol_addresses = True)
op_members = vmlinux.get_type('file_operations').members
seq_members = vmlinux.get_type('seq_operations').members
volatility/framework/plugins/linux/check_syscall.py
+7 -5
View File
@@ -23,7 +23,7 @@ typically found in Linux's /proc file system.
import logging
from typing import List
from volatility.framework import exceptions, interfaces
from volatility.framework import exceptions, interfaces, contexts
from volatility.framework import renderers, constants
from volatility.framework.automagic import linux
from volatility.framework.configuration import requirements
@@ -143,11 +143,13 @@ class Check_syscall(plugins.PluginInterface):
# TODO - add finding and parsing unistd.h once cached file enumeration is added
def _generator(self):
_, aslr_shift = linux.LinuxUtilities.find_aslr(self.context, self.config['vmlinux'], self.config['primary'])
vmlinux = self.context.module(self.config['vmlinux'], self.config['primary'], aslr_shift)
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'],
aslr_shift)
vmlinux = contexts.Module(self.context,
self.config['vmlinux'],
self.config['primary'],
0,
absolute_symbol_addresses = True)
ptr_sz = vmlinux.get_type("pointer").size
if ptr_sz == 4:
volatility/framework/plugins/linux/lsmod.py
+10 -7
View File
@@ -24,6 +24,7 @@ typically found in Linux's /proc file system.
from typing import List
from volatility.framework import renderers, constants, interfaces
from volatility.framework import exceptions, contexts
from volatility.framework.automagic import linux
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
@@ -45,17 +46,19 @@ class Lsmod(plugins.PluginInterface):
@classmethod
def list_modules(cls, context: interfaces.context.ContextInterface, layer_name: str, vmlinux_symbols: str):
"""Lists all the modules in the primary layer"""
linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
_, aslr_shift = linux.LinuxUtilities.find_aslr(context, vmlinux_symbols, layer_name)
vmlinux = context.module(vmlinux_symbols, layer_name, aslr_shift)
module_head_addr = vmlinux.get_symbol("modules").address
modules = vmlinux.object(type_name = "list_head", offset = module_head_addr)
vmlinux = contexts.Module(context,
vmlinux_symbols,
layer_name,
0,
absolute_symbol_addresses = True)
modules = vmlinux.object(symbol_name = "modules").cast("list_head")
table_name = modules.vol.type_name.split(constants.BANG)[0]
for module in modules.to_list("{}{}module".format(table_name, constants.BANG), "list"):
for module in modules.to_list(table_name + constants.BANG + "module", "list"):
yield module
def _generator(self):