diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index 29b1980e1..eca5b3243 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -136,68 +136,6 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): return addr - 0xffffffff80000000 return addr - 0xc0000000 - @classmethod - def mask_mods_list(cls, context: interfaces.context.ContextInterface, layer_name: str, - mods: Iterator[interfaces.objects.ObjectInterface]) -> List[Tuple[str, int, int]]: - """ - A helper function to mask the starting and end address of kernel modules - """ - mask = context.layers[layer_name].address_mask - - return [(utility.array_to_string(mod.name), mod.get_module_base() & mask, (mod.get_module_base() & mask) + mod.get_core_size()) - for mod in mods] - - @classmethod - def generate_kernel_handler_info( - cls, - context: interfaces.context.ContextInterface, - layer_name: str, - kernel_name: str, - mods_list: Iterator[interfaces.objects.ObjectInterface]) -> List[Tuple[str, int, int]]: - - """ - A helper function that gets the beginning and end address of the kernel module - """ - - kernel = contexts.Module(context, kernel_name, layer_name, 0) - - mask = context.layers[layer_name].address_mask - - start_addr = kernel.object_from_symbol("_text") - start_addr = start_addr.vol.offset & mask - - end_addr = kernel.object_from_symbol("_etext") - end_addr = end_addr.vol.offset & mask - - return [(constants.linux.KERNEL_NAME, start_addr, end_addr)] + \ - LinuxUtilities.mask_mods_list(context, layer_name, mods_list) - - @classmethod - def lookup_module_address(cls, context: interfaces.context.ContextInterface, handlers: List[Tuple[str, int, int]], - target_address): - """ - Searches between the start and end address of the kernel module using target_address. - Returns the module and symbol name of the address provided. - """ - - mod_name = "UNKNOWN" - symbol_name = "N/A" - - for name, start, end in handlers: - if start <= target_address <= end: - mod_name = name - if name == constants.linux.KERNEL_NAME: - symbols = list( - context.symbol_space.get_symbols_by_location(target_address)) - - if len(symbols): - symbol_name = symbols[0].split(constants.BANG)[1] if constants.BANG in symbols[0] else \ - symbols[0] - - break - - return mod_name, symbol_name - class LinuxBannerCache(symbol_cache.SymbolBannerCache): """Caches the banners found in the Linux symbol files.""" diff --git a/volatility/framework/plugins/linux/tty_check.py b/volatility/framework/plugins/linux/tty_check.py index c061249a9..a5b78fbb5 100644 --- a/volatility/framework/plugins/linux/tty_check.py +++ b/volatility/framework/plugins/linux/tty_check.py @@ -6,7 +6,7 @@ import logging from typing import List from volatility.framework import interfaces, renderers, exceptions, constants, contexts -from volatility.framework.automagic import linux +from volatility.framework.symbols import linux from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins from volatility.framework.objects import utility diff --git a/volatility/framework/symbols/linux/__init__.py b/volatility/framework/symbols/linux/__init__.py index 992f036ba..b4b4919da 100644 --- a/volatility/framework/symbols/linux/__init__.py +++ b/volatility/framework/symbols/linux/__init__.py @@ -1,9 +1,12 @@ # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import exceptions, constants, interfaces, objects +from typing import List, Tuple, Iterator + +from volatility.framework import exceptions, constants, interfaces, objects, contexts from volatility.framework.symbols import intermed from volatility.framework.symbols.linux import extensions +from volatility.framework.objects import utility class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): @@ -187,3 +190,64 @@ class LinuxUtilities(object): full_path = LinuxUtilities.path_for_file(context, task, filp) yield fd_num, filp, full_path + + @classmethod + def mask_mods_list(cls, context: interfaces.context.ContextInterface, layer_name: str, + mods: Iterator[interfaces.objects.ObjectInterface]) -> List[Tuple[str, int, int]]: + """ + A helper function to mask the starting and end address of kernel modules + """ + mask = context.layers[layer_name].address_mask + + return [(utility.array_to_string(mod.name), mod.get_module_base() & mask, (mod.get_module_base() & mask) + mod.get_core_size()) + for mod in mods] + + @classmethod + def generate_kernel_handler_info( + cls, + context: interfaces.context.ContextInterface, + layer_name: str, + kernel_name: str, + mods_list: Iterator[interfaces.objects.ObjectInterface]) -> List[Tuple[str, int, int]]: + """ + A helper function that gets the beginning and end address of the kernel module + """ + + kernel = contexts.Module(context, kernel_name, layer_name, 0) + + mask = context.layers[layer_name].address_mask + + start_addr = kernel.object_from_symbol("_text") + start_addr = start_addr.vol.offset & mask + + end_addr = kernel.object_from_symbol("_etext") + end_addr = end_addr.vol.offset & mask + + return [(constants.linux.KERNEL_NAME, start_addr, end_addr)] + \ + LinuxUtilities.mask_mods_list(context, layer_name, mods_list) + + @classmethod + def lookup_module_address(cls, context: interfaces.context.ContextInterface, handlers: List[Tuple[str, int, int]], + target_address): + """ + Searches between the start and end address of the kernel module using target_address. + Returns the module and symbol name of the address provided. + """ + + mod_name = "UNKNOWN" + symbol_name = "N/A" + + for name, start, end in handlers: + if start <= target_address <= end: + mod_name = name + if name == constants.linux.KERNEL_NAME: + symbols = list( + context.symbol_space.get_symbols_by_location(target_address)) + + if len(symbols): + symbol_name = symbols[0].split(constants.BANG)[1] if constants.BANG in symbols[0] else \ + symbols[0] + + break + + return mod_name, symbol_name diff --git a/volatility/framework/symbols/linux/extensions/__init__.py b/volatility/framework/symbols/linux/extensions/__init__.py index 5ca7342fa..2f35aa860 100644 --- a/volatility/framework/symbols/linux/extensions/__init__.py +++ b/volatility/framework/symbols/linux/extensions/__init__.py @@ -416,7 +416,11 @@ class list_head(objects.StructType, collections.abc.Iterable): direction = 'prev' if forward: direction = 'next' - link = getattr(self, direction).dereference() + try: + link = getattr(self, direction).dereference() + except exceptions.InvalidAddressException: + print("return here") + return if not sentinel: yield self._context.object(symbol_type, layer, offset = self.vol.offset - relative_offset) @@ -428,7 +432,11 @@ class list_head(objects.StructType, collections.abc.Iterable): yield obj seen.add(link.vol.offset) - link = getattr(link, direction).dereference() + try: + link = getattr(self, direction).dereference() + except exceptions.InvalidAddressException: + print("break here") + break def __iter__(self) -> Iterator[interfaces.objects.ObjectInterface]: return self.to_list(self.vol.parent.vol.type_name, self.vol.member_name)