WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 19:57:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Initial attempt at cleaning up the API

Browse Source 
Context.object accepts a template or a string name (and now a type
flag).  Module.object only accepts a string (because a template already
has most of the stuff built in and might as well be passed to the
Context.object constructor).

The gotcha here is the absolute flag, which must now be set
appropriately in all cases *except* where the module is constructed
with an offset of 0 (whereby it will have no impact).
This commit is contained in:
Mike Auty
2019-08-14 20:50:42 +01:00
committed by ikelos
parent 95ac651f7e
commit 5362e2094e
27 changed files with 146 additions and 131 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/linux/check_afinfo.py
+1 -1
View File
@@ -98,7 +98,7 @@ class Check_afinfo(plugins.PluginInterface):
except exceptions.SymbolError:
continue
global_var = vmlinux.object(type_name = struct_type, offset = global_var.address)
global_var = vmlinux.object(symbol = struct_type, offset = global_var.address)
for name, member, address in self._check_afinfo(global_var_name, global_var, op_members, seq_members):
yield 0, (name, member, format_hints.Hex(address))
volatility/framework/plugins/linux/check_syscall.py
+1 -1
View File
@@ -176,7 +176,7 @@ class Check_syscall(plugins.PluginInterface):
for (table_name, (tableaddr, tblsz)) in tables:
table = vmlinux.object(
type_name = "array", subtype = vmlinux.get_type("pointer"), offset = tableaddr, count = tblsz)
symbol = "array", subtype = vmlinux.get_type("pointer"), offset = tableaddr, count = tblsz)
for (i, call_addr) in enumerate(table):
if not call_addr:
volatility/framework/plugins/linux/lsmod.py
+3 -3
View File
@@ -23,8 +23,8 @@ typically found in Linux's /proc file system.
from typing import List
from volatility.framework import contexts
from volatility.framework import renderers, constants, interfaces
from volatility.framework import exceptions, contexts
from volatility.framework.automagic import linux
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
@@ -48,9 +48,9 @@ class Lsmod(plugins.PluginInterface):
"""Lists all the modules in the primary layer"""
linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0, absolute_symbol_addresses = True)
vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0)
modules = vmlinux.object(symbol_name = "modules").cast("list_head")
modules = vmlinux.object(symbol = "modules", symbol_type = constants.SymbolType.SYMBOL).cast("list_head")
table_name = modules.vol.type_name.split(constants.BANG)[0]
volatility/framework/plugins/linux/pslist.py
+3 -3
View File
@@ -21,7 +21,7 @@
from typing import Callable, Iterable, List
import volatility.framework.interfaces.plugins as interfaces_plugins
from volatility.framework import renderers, interfaces, contexts
from volatility.framework import renderers, interfaces, contexts, constants
from volatility.framework.automagic import linux
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
@@ -75,9 +75,9 @@ class PsList(interfaces_plugins.PluginInterface):
"""Lists all the tasks in the primary layer"""
linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0, absolute_symbol_addresses = True)
vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0)
init_task = vmlinux.object(symbol_name = "init_task")
init_task = vmlinux.object(symbol = "init_task", symbol_type = constants.SymbolType.SYMBOL)
for task in init_task.tasks:
if not filter_func(task):