WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-11 12:17:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' into check_creds_malware

Browse Source
This commit is contained in:
ikelos
2025-06-11 22:21:59 +01:00
committed by GitHub
parent 85a5eb5d41 63019c0988
commit 470c53c5f7
30 changed files with 2900 additions and 2608 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/plugins/linux/linux.py
+12 -9
View File
@@ -29,7 +29,7 @@ class TestLinuxPslist:
class TestLinuxCheckIdt:
def test_linux_generic_check_idt(self, image, volatility, python):
rc, out, _err = test_volatility.runvol_plugin(
"linux.check_idt.Check_idt", image, volatility, python
"linux.malware.check_idt.Check_idt", image, volatility, python
)
assert rc == 0
@@ -41,7 +41,7 @@ class TestLinuxCheckIdt:
class TestLinuxCheckSyscall:
def test_linux_generic_check_syscall(self, image, volatility, python):
rc, out, _err = test_volatility.runvol_plugin(
"linux.check_syscall.Check_syscall", image, volatility, python
"linux.malware.check_syscall.Check_syscall", image, volatility, python
)
assert rc == 0
@@ -89,7 +89,7 @@ class TestLinuxProcMaps:
class TestLinuxTtyCheck:
def test_linux_generic_tty_check(self, image, volatility, python):
rc, out, _err = test_volatility.runvol_plugin(
"linux.tty_check.tty_check", image, volatility, python
"linux.malware.tty_check.Tty_Check", image, volatility, python
)
assert rc == 0
@@ -251,7 +251,7 @@ class TestLinuxKthreads:
class TestLinuxMalfind:
def test_linux_generic_malfind(self, image, volatility, python):
rc, out, _err = test_volatility.runvol_plugin(
"linux.malfind.Malfind", image, volatility, python
"linux.malware.malfind.Malfind", image, volatility, python
)
# linux-sample-1.bin has no process memory ranges with potential injected code.
@@ -426,7 +426,7 @@ class TestLinuxPageCacheInodepages:
class TestLinuxCheckAfinfo:
def test_linux_generic_check_afinfo(self, image, volatility, python):
rc, out, _err = test_volatility.runvol_plugin(
"linux.check_afinfo.Check_afinfo", image, volatility, python
"linux.malware.check_afinfo.Check_afinfo", image, volatility, python
)
# linux-sample-1.bin has no suspicious results.
@@ -438,7 +438,7 @@ class TestLinuxCheckAfinfo:
class TestLinuxCheckModules:
def test_linux_generic_check_modules(self, image, volatility, python):
rc, out, _err = test_volatility.runvol_plugin(
"linux.check_modules.Check_modules", image, volatility, python
"linux.malware.check_modules.Check_modules", image, volatility, python
)
# linux-sample-1.bin has no suspicious results.
@@ -479,7 +479,10 @@ class TestLinuxIomem:
class TestLinuxKeyboardNotifiers:
def test_linux_generic_keyboard_notifiers(self, image, volatility, python):
rc, out, _err = test_volatility.runvol_plugin(
"linux.keyboard_notifiers.Keyboard_notifiers", image, volatility, python
"linux.malware.keyboard_notifiers.Keyboard_notifiers",
image,
volatility,
python,
)
# linux-sample-1.bin has no suspicious results for this plugin.
@@ -501,7 +504,7 @@ class TestLinuxKmesg:
class TestLinuxNetfilter:
def test_linux_generic_netfilter(self, image, volatility, python):
rc, out, _err = test_volatility.runvol_plugin(
"linux.netfilter.Netfilter", image, volatility, python
"linux.malware.netfilter.Netfilter", image, volatility, python
)
# linux-sample-1.bin has no suspicious results for this plugin.
@@ -525,7 +528,7 @@ class TestLinuxHiddenModules:
# TODO: this check should be specific, against a distinct infected sample
image = LinuxSamples.LINUX_GENERIC.value.path
rc, out, _err = test_volatility.runvol_plugin(
"linux.hidden_modules.Hidden_modules", image, volatility, python
"linux.malware.hidden_modules.Hidden_modules", image, volatility, python
)
# linux-sample-1.bin has no hidden modules.