Fixed tty_check not finding the ttyhook module

volatility/framework/automagic/linux.py

@@ -144,7 +144,7 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface):
         """
         mask = context.layers[layer_name].address_mask
 
-        return [(utility.array_to_string(mod.name), mod.vol.offset & mask, (mod.vol.offset & mask) + mod.vol.size)
+        return [(utility.array_to_string(mod.name), mod.get_module_base() & mask, (mod.get_module_base() & mask) + mod.get_core_size())
                 for mod in mods]
 
     @classmethod
@@ -153,21 +153,14 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface):
             context: interfaces.context.ContextInterface,
             layer_name: str,
             kernel,  # ikelos - how to type this??
-            mods_list: Iterator[Any]):
-
-        try:
-            start_addr = kernel.object_from_symbol("vm_kernel_stext")
-        except exceptions.SymbolError:
-            start_addr = kernel.object_from_symbol("_text")
-
-        try:
-            end_addr = kernel.object_from_symbol("vm_kernel_etext")
-        except exceptions.SymbolError:
-            end_addr = kernel.object_from_symbol("_etext")
+            mods_list: Iterator[Any]):          
 
         mask = context.layers[layer_name].address_mask
 
+        start_addr = kernel.object_from_symbol("_text")
         start_addr = start_addr.vol.offset & mask
+
+        end_addr = kernel.object_from_symbol("_etext")
         end_addr = end_addr.vol.offset & mask
 
         return [("__kernel__", start_addr, end_addr)] + \

volatility/framework/plugins/linux/tty_check.py

@@ -38,7 +38,7 @@ class tty_check(plugins.PluginInterface):
 
         modules = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['vmlinux'])
 
-        handles = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'], vmlinux, modules)
+        handlers = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'], vmlinux, modules)
 
         try:
             tty_drivers = vmlinux.object_from_symbol("tty_drivers")
@@ -70,7 +70,7 @@ class tty_check(plugins.PluginInterface):
 
                 recv_buf = tty_dev.ldisc.ops.receive_buf
 
-                module_name, symbol_name = linux.LinuxUtilities.lookup_module_address(self.context, handles, recv_buf)
+                module_name, symbol_name = linux.LinuxUtilities.lookup_module_address(self.context, handlers, recv_buf)
 
                 sym_cache[recv_buf] = symbol_name
 

volatility/framework/symbols/linux/extensions/__init__.py

@@ -22,6 +22,14 @@ vollog = logging.getLogger(__name__)
 
 class module(generic.GenericIntelProcess):
 
+    def get_module_base(self):
+        if self.has_member("core_layout"):
+            return self.core_layout.base
+        else:
+            return self.module_core
+
+        raise AttributeError("module -> get_module_core: Unable to determine base address of module")
+
     def get_init_size(self):
         if self.has_member("init_layout"):
             return self.init_layout.size
@@ -38,7 +46,7 @@ class module(generic.GenericIntelProcess):
         elif self.has_member("core_size"):
             return self.core_size
 
-        raise AttributeError("module -> get_core_size: Unable to determine initial size of module")
+        raise AttributeError("module -> get_core_size: Unable to determine core size of module")
 
     def get_module_core(self):
         if self.has_member("core_layout"):