From 44911bf54a873591ce2c09661076744b72e9239b Mon Sep 17 00:00:00 2001 From: Matt Tressler Date: Wed, 22 Jul 2020 13:07:59 -0400 Subject: [PATCH] Fixed tty_check not finding the ttyhook module --- volatility/framework/automagic/linux.py | 17 +++++------------ volatility/framework/plugins/linux/tty_check.py | 4 ++-- .../symbols/linux/extensions/__init__.py | 10 +++++++++- 3 files changed, 16 insertions(+), 15 deletions(-) diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index 0572b8fbd..845ca4f4d 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -144,7 +144,7 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): """ mask = context.layers[layer_name].address_mask - return [(utility.array_to_string(mod.name), mod.vol.offset & mask, (mod.vol.offset & mask) + mod.vol.size) + return [(utility.array_to_string(mod.name), mod.get_module_base() & mask, (mod.get_module_base() & mask) + mod.get_core_size()) for mod in mods] @classmethod @@ -153,21 +153,14 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): context: interfaces.context.ContextInterface, layer_name: str, kernel, # ikelos - how to type this?? - mods_list: Iterator[Any]): - - try: - start_addr = kernel.object_from_symbol("vm_kernel_stext") - except exceptions.SymbolError: - start_addr = kernel.object_from_symbol("_text") - - try: - end_addr = kernel.object_from_symbol("vm_kernel_etext") - except exceptions.SymbolError: - end_addr = kernel.object_from_symbol("_etext") + mods_list: Iterator[Any]): mask = context.layers[layer_name].address_mask + start_addr = kernel.object_from_symbol("_text") start_addr = start_addr.vol.offset & mask + + end_addr = kernel.object_from_symbol("_etext") end_addr = end_addr.vol.offset & mask return [("__kernel__", start_addr, end_addr)] + \ diff --git a/volatility/framework/plugins/linux/tty_check.py b/volatility/framework/plugins/linux/tty_check.py index 8fbf1ac12..b7d32863a 100644 --- a/volatility/framework/plugins/linux/tty_check.py +++ b/volatility/framework/plugins/linux/tty_check.py @@ -38,7 +38,7 @@ class tty_check(plugins.PluginInterface): modules = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['vmlinux']) - handles = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'], vmlinux, modules) + handlers = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'], vmlinux, modules) try: tty_drivers = vmlinux.object_from_symbol("tty_drivers") @@ -70,7 +70,7 @@ class tty_check(plugins.PluginInterface): recv_buf = tty_dev.ldisc.ops.receive_buf - module_name, symbol_name = linux.LinuxUtilities.lookup_module_address(self.context, handles, recv_buf) + module_name, symbol_name = linux.LinuxUtilities.lookup_module_address(self.context, handlers, recv_buf) sym_cache[recv_buf] = symbol_name diff --git a/volatility/framework/symbols/linux/extensions/__init__.py b/volatility/framework/symbols/linux/extensions/__init__.py index 4073eda99..5ca7342fa 100644 --- a/volatility/framework/symbols/linux/extensions/__init__.py +++ b/volatility/framework/symbols/linux/extensions/__init__.py @@ -22,6 +22,14 @@ vollog = logging.getLogger(__name__) class module(generic.GenericIntelProcess): + def get_module_base(self): + if self.has_member("core_layout"): + return self.core_layout.base + else: + return self.module_core + + raise AttributeError("module -> get_module_core: Unable to determine base address of module") + def get_init_size(self): if self.has_member("init_layout"): return self.init_layout.size @@ -38,7 +46,7 @@ class module(generic.GenericIntelProcess): elif self.has_member("core_size"): return self.core_size - raise AttributeError("module -> get_core_size: Unable to determine initial size of module") + raise AttributeError("module -> get_core_size: Unable to determine core size of module") def get_module_core(self): if self.has_member("core_layout"):