WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-27 20:14:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

switch linux_lsmod to absolute_symbol_addresses interface

Browse Source
This commit is contained in:
Andrew Case
2018-12-27 22:41:03 +00:00
committed by ikelos
parent 59d3f2b8ee
commit 2a0aec8104
3 changed files with 24 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/linux/check_afinfo.py
+7 -5
View File
@@ -23,7 +23,7 @@ typically found in Linux's /proc file system.
import logging
from typing import List
from volatility.framework import exceptions, interfaces
from volatility.framework import exceptions, interfaces, contexts
from volatility.framework import renderers
from volatility.framework.automagic import linux
from volatility.framework.configuration import requirements
@@ -78,11 +78,13 @@ class Check_afinfo(plugins.PluginInterface):
yield var_name, "show", var.seq_show
def _generator(self):
_, aslr_shift = linux.LinuxUtilities.find_aslr(self.context, self.config['vmlinux'], self.config['primary'])
vmlinux = self.context.module(self.config['vmlinux'], self.config['primary'], aslr_shift)
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['primary'], self.config['vmlinux'],
aslr_shift)
vmlinux = contexts.Module(self.context,
self.config['vmlinux'],
self.config['primary'],
0,
absolute_symbol_addresses = True)
op_members = vmlinux.get_type('file_operations').members
seq_members = vmlinux.get_type('seq_operations').members