Updated imports to reflect new location of utility class; plugins are no longer outputing anything so commiting for Andrew to take a look at

volatility/framework/automagic/linux.py

@@ -136,68 +136,6 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface):
             return addr - 0xffffffff80000000
         return addr - 0xc0000000
 
-    @classmethod
-    def mask_mods_list(cls, context: interfaces.context.ContextInterface, layer_name: str,
-                       mods: Iterator[interfaces.objects.ObjectInterface]) -> List[Tuple[str, int, int]]:
-        """
-        A helper function to mask the starting and end address of kernel modules
-        """
-        mask = context.layers[layer_name].address_mask
-
-        return [(utility.array_to_string(mod.name), mod.get_module_base() & mask, (mod.get_module_base() & mask) + mod.get_core_size())
-                for mod in mods]
-
-    @classmethod
-    def generate_kernel_handler_info(
-            cls,
-            context: interfaces.context.ContextInterface,
-            layer_name: str,
-            kernel_name: str,
-            mods_list: Iterator[interfaces.objects.ObjectInterface]) -> List[Tuple[str, int, int]]:
-
-        """
-        A helper function that gets the beginning and end address of the kernel module
-        """    
-
-        kernel = contexts.Module(context, kernel_name, layer_name, 0)
-
-        mask = context.layers[layer_name].address_mask
-
-        start_addr = kernel.object_from_symbol("_text")
-        start_addr = start_addr.vol.offset & mask
-
-        end_addr = kernel.object_from_symbol("_etext")
-        end_addr = end_addr.vol.offset & mask
-
-        return [(constants.linux.KERNEL_NAME, start_addr, end_addr)] + \
-            LinuxUtilities.mask_mods_list(context, layer_name, mods_list)
-
-    @classmethod
-    def lookup_module_address(cls, context: interfaces.context.ContextInterface, handlers: List[Tuple[str, int, int]],
-                              target_address):
-        """
-        Searches between the start and end address of the kernel module using target_address.  
-        Returns the module and symbol name of the address provided.
-        """
-        
-        mod_name = "UNKNOWN"
-        symbol_name = "N/A"
-
-        for name, start, end in handlers:
-            if start <= target_address <= end:
-                mod_name = name
-                if name == constants.linux.KERNEL_NAME:
-                    symbols = list(
-                        context.symbol_space.get_symbols_by_location(target_address))
-
-                    if len(symbols):
-                        symbol_name = symbols[0].split(constants.BANG)[1] if constants.BANG in symbols[0] else \
-                            symbols[0]
-
-                break
-
-        return mod_name, symbol_name
-
 class LinuxBannerCache(symbol_cache.SymbolBannerCache):
     """Caches the banners found in the Linux symbol files."""
 

volatility/framework/plugins/linux/tty_check.py

@@ -6,7 +6,7 @@ import logging
 from typing import List
 
 from volatility.framework import interfaces, renderers, exceptions, constants, contexts
-from volatility.framework.automagic import linux
+from volatility.framework.symbols import linux
 from volatility.framework.configuration import requirements
 from volatility.framework.interfaces import plugins
 from volatility.framework.objects import utility

volatility/framework/symbols/linux/__init__.py

@@ -1,9 +1,12 @@
 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
-from volatility.framework import exceptions, constants, interfaces, objects
+from typing import List, Tuple, Iterator
+
+from volatility.framework import exceptions, constants, interfaces, objects, contexts
 from volatility.framework.symbols import intermed
 from volatility.framework.symbols.linux import extensions
+from volatility.framework.objects import utility
 
 
 class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable):
@@ -187,3 +190,64 @@ class LinuxUtilities(object):
                 full_path = LinuxUtilities.path_for_file(context, task, filp)
 
                 yield fd_num, filp, full_path
+
+    @classmethod
+    def mask_mods_list(cls, context: interfaces.context.ContextInterface, layer_name: str,
+                       mods: Iterator[interfaces.objects.ObjectInterface]) -> List[Tuple[str, int, int]]:
+        """
+        A helper function to mask the starting and end address of kernel modules
+        """
+        mask = context.layers[layer_name].address_mask
+
+        return [(utility.array_to_string(mod.name), mod.get_module_base() & mask, (mod.get_module_base() & mask) + mod.get_core_size())
+                for mod in mods]
+
+    @classmethod
+    def generate_kernel_handler_info(
+            cls,
+            context: interfaces.context.ContextInterface,
+            layer_name: str,
+            kernel_name: str,
+            mods_list: Iterator[interfaces.objects.ObjectInterface]) -> List[Tuple[str, int, int]]:
+        """
+        A helper function that gets the beginning and end address of the kernel module
+        """
+
+        kernel = contexts.Module(context, kernel_name, layer_name, 0)
+
+        mask = context.layers[layer_name].address_mask
+
+        start_addr = kernel.object_from_symbol("_text")
+        start_addr = start_addr.vol.offset & mask
+
+        end_addr = kernel.object_from_symbol("_etext")
+        end_addr = end_addr.vol.offset & mask
+
+        return [(constants.linux.KERNEL_NAME, start_addr, end_addr)] + \
+            LinuxUtilities.mask_mods_list(context, layer_name, mods_list)
+
+    @classmethod
+    def lookup_module_address(cls, context: interfaces.context.ContextInterface, handlers: List[Tuple[str, int, int]],
+                              target_address):
+        """
+        Searches between the start and end address of the kernel module using target_address.  
+        Returns the module and symbol name of the address provided.
+        """
+
+        mod_name = "UNKNOWN"
+        symbol_name = "N/A"
+
+        for name, start, end in handlers:
+            if start <= target_address <= end:
+                mod_name = name
+                if name == constants.linux.KERNEL_NAME:
+                    symbols = list(
+                        context.symbol_space.get_symbols_by_location(target_address))
+
+                    if len(symbols):
+                        symbol_name = symbols[0].split(constants.BANG)[1] if constants.BANG in symbols[0] else \
+                            symbols[0]
+
+                break
+
+        return mod_name, symbol_name

volatility/framework/symbols/linux/extensions/__init__.py

@@ -416,7 +416,11 @@ class list_head(objects.StructType, collections.abc.Iterable):
         direction = 'prev'
         if forward:
             direction = 'next'
-        link = getattr(self, direction).dereference()
+        try:
+            link = getattr(self, direction).dereference()
+        except exceptions.InvalidAddressException:
+            print("return here")
+            return
 
         if not sentinel:
             yield self._context.object(symbol_type, layer, offset = self.vol.offset - relative_offset)
@@ -428,7 +432,11 @@ class list_head(objects.StructType, collections.abc.Iterable):
             yield obj
 
             seen.add(link.vol.offset)
-            link = getattr(link, direction).dereference()
+            try:
+                link = getattr(self, direction).dereference()
+            except exceptions.InvalidAddressException:
+                print("break here")
+                break
 
     def __iter__(self) -> Iterator[interfaces.objects.ObjectInterface]:
         return self.to_list(self.vol.parent.vol.type_name, self.vol.member_name)