Add versioning on gatherers, make check non-specific to kernel gatherer, add requirements to ModuleGatherers

This commit is contained in:
Andrew Case
2025-03-14 22:34:06 +00:00
parent a0f3cba6f6
commit 53e32e36f6
@@ -23,6 +23,7 @@ from volatility3.framework import (
objects,
)
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
from volatility3.framework.symbols.linux import extensions
@@ -274,7 +275,7 @@ class Modules(interfaces.configuration.VersionableInterface):
for module in gatherer.gather_modules(context, kernel_module_name):
# the kernel sends back a ModuleInfo directly
if gatherer == ModuleGathererKernel:
if isinstance(module, ModuleInfo):
modinfo = module
else:
modinfo = cls.get_module_info_for_module(address_mask, module)
@@ -541,6 +542,10 @@ class ModuleGathererLsmod(ModuleGathererInterface):
Gathers modules from the main kernel list
"""
_version = (1, 0, 0)
name = "Lsmod"
@classmethod
def gather_modules(
cls, context: interfaces.context.ContextInterface, kernel_module_name: str
@@ -553,6 +558,10 @@ class ModuleGathererSysFs(ModuleGathererInterface):
Gathers modules from the sysfs /sys/modules objects
"""
_version = (1, 0, 0)
name = "SysFs"
@classmethod
def gather_modules(
cls, context: interfaces.context.ContextInterface, kernel_module_name: str
@@ -570,6 +579,10 @@ class ModuleGathererScanner(ModuleGathererInterface):
Gathers modules by scanning memory
"""
_version = (1, 0, 0)
name = "Scanner"
@classmethod
def gather_modules(
cls, context: interfaces.context.ContextInterface, kernel_module_name: str
@@ -593,6 +606,10 @@ class ModuleGathererKernel(ModuleGathererInterface):
can determine when function pointers reference the kernel
"""
_version = (1, 0, 0)
name = "kernel"
@classmethod
def gather_modules(
cls, context: interfaces.context.ContextInterface, kernel_module_name: str
@@ -614,7 +631,10 @@ class ModuleGathererKernel(ModuleGathererInterface):
yield ModuleInfo(start_addr, constants.linux.KERNEL_NAME, start_addr, end_addr)
class ModuleGatherers(interfaces.configuration.VersionableInterface):
class ModuleGatherers(
interfaces.configuration.VersionableInterface,
interfaces.configuration.ConfigurableInterface,
):
_version = (1, 0, 0)
_required_framework_version = (2, 0, 0)
@@ -629,3 +649,19 @@ class ModuleGatherers(interfaces.configuration.VersionableInterface):
ModuleGathererScanner,
ModuleGathererKernel,
]
@classmethod
def get_requirements(cls):
reqs = []
# for now, all versions are 1, this will be broken out if/when that changes
for gatherer in ModuleGatherers.all_gatherers_identifier:
reqs.append(
requirements.VersionRequirement(
name=gatherer.name.replace(" ", ""),
component=gatherer,
version=(1, 0, 0),
)
)
return reqs