WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 01:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

cut unnecessary plugin runner functions

Browse Source
This commit is contained in:
Abyss Watcher
2025-01-06 00:24:18 +01:00
parent 5c70356c27
commit 302f9fdf5b
1 changed files with 25 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/modxview.py
+25 -53
View File
@@ -53,54 +53,6 @@ class Modxview(interfaces.plugins.PluginInterface):
),
]
@classmethod
def run_lsmod(
cls, context: interfaces.context.ContextInterface, kernel_name: str
) -> List[extensions.module]:
"""Wrapper for the lsmod plugin."""
return list(lsmod.Lsmod.list_modules(context, kernel_name))
@classmethod
def run_check_modules(
cls,
context: interfaces.context.ContextInterface,
kernel_name: str,
) -> List[extensions.module]:
"""Wrapper for the check_modules plugin.
Here, we extract the /sys/module/ list."""
kernel = context.modules[kernel_name]
sysfs_modules: dict = check_modules.Check_modules.get_kset_modules(
context, kernel_name
)
# Convert get_kset_modules() offsets back to module objects
return [
kernel.object(object_type="module", offset=m_offset, absolute=True)
for m_offset in sysfs_modules.values()
]
@classmethod
def run_hidden_modules(
cls,
context: interfaces.context.ContextInterface,
kernel_name: str,
known_modules_addresses: Set[int],
) -> List[extensions.module]:
"""Wrapper for the hidden_modules plugin."""
modules_memory_boundaries = (
hidden_modules.Hidden_modules.get_modules_memory_boundaries(
context, kernel_name
)
)
return list(
hidden_modules.Hidden_modules.get_hidden_modules(
context,
kernel_name,
known_modules_addresses,
modules_memory_boundaries,
)
)
@classmethod
def flatten_run_modules_results(
cls, run_results: Dict[str, List[extensions.module]], deduplicate: bool = True
@@ -140,15 +92,35 @@ class Modxview(interfaces.plugins.PluginInterface):
kernel = context.modules[kernel_name]
run_results = {}
run_results["lsmod"] = cls.run_lsmod(context, kernel_name)
run_results["check_modules"] = cls.run_check_modules(context, kernel_name)
# lsmod
run_results["lsmod"] = list(lsmod.Lsmod.list_modules(context, kernel_name))
# check_modules
sysfs_modules: dict = check_modules.Check_modules.get_kset_modules(
context, kernel_name
)
## Convert get_kset_modules() offsets back to module objects
run_results["check_modules"] = [
kernel.object(object_type="module", offset=m_offset, absolute=True)
for m_offset in sysfs_modules.values()
]
# hidden_modules
if run_hidden_modules:
known_module_addresses = set(
known_modules_addresses = set(
context.layers[kernel.layer_name].canonicalize(module.vol.offset)
for module in run_results["lsmod"] + run_results["check_modules"]
)
run_results["hidden_modules"] = cls.run_hidden_modules(
context, kernel_name, known_module_addresses
modules_memory_boundaries = (
hidden_modules.Hidden_modules.get_modules_memory_boundaries(
context, kernel_name
)
)
run_results["hidden_modules"] = list(
hidden_modules.Hidden_modules.get_hidden_modules(
context,
kernel_name,
known_modules_addresses,
modules_memory_boundaries,
)
)
return run_results