Merge branch 'develop' into linux_hidden_modules

volatility3/framework/symbols/linux/__init__.py

@@ -615,7 +615,7 @@ class IDStorage(ABC):
 
         return nodep
 
-    def _iter_node(self, nodep, height) -> int:
+    def _iter_node(self, nodep, height) -> Iterator[int]:
         node = self.nodep_to_node(nodep)
         node_slots = node.slots
         for off in range(self.CHUNK_SIZE):
@@ -632,7 +632,7 @@ class IDStorage(ABC):
                 for child_node in self._iter_node(nodep, height - 1):
                     yield child_node
 
-    def get_entries(self, root: interfaces.objects.ObjectInterface) -> int:
+    def get_entries(self, root: interfaces.objects.ObjectInterface) -> Iterator[int]:
         """Walks the tree data structure
 
         Args:
@@ -818,7 +818,7 @@ class PageCache(object):
         self._page_cache = page_cache
         self._idstorage = IDStorage.choose_id_storage(context, kernel_module_name)
 
-    def get_cached_pages(self) -> interfaces.objects.ObjectInterface:
+    def get_cached_pages(self) -> Iterator[interfaces.objects.ObjectInterface]:
         """Returns all page cache contents
 
         Yields:

volatility3/framework/symbols/linux/extensions/__init__.py

@@ -26,10 +26,6 @@ vollog = logging.getLogger(__name__)
 
 class module(generic.GenericIntelProcess):
 
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self._mod_mem_type = None  # Initialize _mod_mem_type to None for memoization
-
     def is_valid(self):
         """Determine whether it is a valid module object by verifying the self-referential
         in module_kobject. This also confirms that the module is actively allocated and
@@ -61,8 +57,8 @@ class module(generic.GenericIntelProcess):
 
         return True
 
-    @property
-    def mod_mem_type(self):
+    @functools.cached_property
+    def mod_mem_type(self) -> Dict:
         """Return the mod_mem_type enum choices if available or an empty dict if not"""
         # mod_mem_type and module_memory were added in kernel 6.4 which replaces
         # module_layout for storing the information around core_layout etc.
@@ -1331,7 +1327,7 @@ class vfsmount(objects.StructType):
             bool: 'True' if the given argument points to the the same 'vfsmount'
             as 'self'.
         """
-        if type(vfsmount_ptr) == objects.Pointer:
+        if isinstance(vfsmount_ptr, objects.Pointer):
             return self.vol.offset == vfsmount_ptr
         else:
             raise exceptions.VolatilityException(