WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-11 12:17:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Updated imports to reflect new location of utility class; plugins are no longer outputing anything so commiting for Andrew to take a look at

Browse Source
This commit is contained in:
Matt Tressler
2020-07-30 23:24:23 +01:00
committed by ikelos
parent 355c25fefb
commit 34ff856a79
4 changed files with 76 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/automagic/linux.py
-62
View File
@@ -136,68 +136,6 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface):
return addr - 0xffffffff80000000
return addr - 0xc0000000
@classmethod
def mask_mods_list(cls, context: interfaces.context.ContextInterface, layer_name: str,
mods: Iterator[interfaces.objects.ObjectInterface]) -> List[Tuple[str, int, int]]:
"""
A helper function to mask the starting and end address of kernel modules
"""
mask = context.layers[layer_name].address_mask
return [(utility.array_to_string(mod.name), mod.get_module_base() & mask, (mod.get_module_base() & mask) + mod.get_core_size())
for mod in mods]
@classmethod
def generate_kernel_handler_info(
cls,
context: interfaces.context.ContextInterface,
layer_name: str,
kernel_name: str,
mods_list: Iterator[interfaces.objects.ObjectInterface]) -> List[Tuple[str, int, int]]:
"""
A helper function that gets the beginning and end address of the kernel module
"""
kernel = contexts.Module(context, kernel_name, layer_name, 0)
mask = context.layers[layer_name].address_mask
start_addr = kernel.object_from_symbol("_text")
start_addr = start_addr.vol.offset & mask
end_addr = kernel.object_from_symbol("_etext")
end_addr = end_addr.vol.offset & mask
return [(constants.linux.KERNEL_NAME, start_addr, end_addr)] + \
LinuxUtilities.mask_mods_list(context, layer_name, mods_list)
@classmethod
def lookup_module_address(cls, context: interfaces.context.ContextInterface, handlers: List[Tuple[str, int, int]],
target_address):
"""
Searches between the start and end address of the kernel module using target_address.
Returns the module and symbol name of the address provided.
"""
mod_name = "UNKNOWN"
symbol_name = "N/A"
for name, start, end in handlers:
if start <= target_address <= end:
mod_name = name
if name == constants.linux.KERNEL_NAME:
symbols = list(
context.symbol_space.get_symbols_by_location(target_address))
if len(symbols):
symbol_name = symbols[0].split(constants.BANG)[1] if constants.BANG in symbols[0] else \
symbols[0]
break
return mod_name, symbol_name
class LinuxBannerCache(symbol_cache.SymbolBannerCache):
"""Caches the banners found in the Linux symbol files."""