From 53e32e36f6128fa3ec53e77f3e7fb859cbc1d173 Mon Sep 17 00:00:00 2001
From: Andrew Case <andrew@dfir.org>
Date: Fri, 14 Mar 2025 22:34:06 +0000
Subject: [PATCH] Add versioning on gatherers, make check non-specific to
 kernel gatherer, add requirements to ModuleGatherers

---
 .../symbols/linux/utilities/modules.py        | 40 ++++++++++++++++++-
 1 file changed, 38 insertions(+), 2 deletions(-)

diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py
index 957d7b5b4..70b45fbd9 100644
--- a/volatility3/framework/symbols/linux/utilities/modules.py
+++ b/volatility3/framework/symbols/linux/utilities/modules.py
@@ -23,6 +23,7 @@ from volatility3.framework import (
     objects,
 )
 
+from volatility3.framework.configuration import requirements
 from volatility3.framework.objects import utility
 from volatility3.framework.symbols.linux import extensions
 
@@ -274,7 +275,7 @@ class Modules(interfaces.configuration.VersionableInterface):
             for module in gatherer.gather_modules(context, kernel_module_name):
 
                 # the kernel sends back a ModuleInfo directly
-                if gatherer == ModuleGathererKernel:
+                if isinstance(module, ModuleInfo):
                     modinfo = module
                 else:
                     modinfo = cls.get_module_info_for_module(address_mask, module)
@@ -541,6 +542,10 @@ class ModuleGathererLsmod(ModuleGathererInterface):
     Gathers modules from the main kernel list
     """
 
+    _version = (1, 0, 0)
+
+    name = "Lsmod"
+
     @classmethod
     def gather_modules(
         cls, context: interfaces.context.ContextInterface, kernel_module_name: str
@@ -553,6 +558,10 @@ class ModuleGathererSysFs(ModuleGathererInterface):
     Gathers modules from the sysfs /sys/modules objects
     """
 
+    _version = (1, 0, 0)
+
+    name = "SysFs"
+
     @classmethod
     def gather_modules(
         cls, context: interfaces.context.ContextInterface, kernel_module_name: str
@@ -570,6 +579,10 @@ class ModuleGathererScanner(ModuleGathererInterface):
     Gathers modules by scanning memory
     """
 
+    _version = (1, 0, 0)
+
+    name = "Scanner"
+
     @classmethod
     def gather_modules(
         cls, context: interfaces.context.ContextInterface, kernel_module_name: str
@@ -593,6 +606,10 @@ class ModuleGathererKernel(ModuleGathererInterface):
     can determine when function pointers reference the kernel
     """
 
+    _version = (1, 0, 0)
+
+    name = "kernel"
+
     @classmethod
     def gather_modules(
         cls, context: interfaces.context.ContextInterface, kernel_module_name: str
@@ -614,7 +631,10 @@ class ModuleGathererKernel(ModuleGathererInterface):
         yield ModuleInfo(start_addr, constants.linux.KERNEL_NAME, start_addr, end_addr)
 
 
-class ModuleGatherers(interfaces.configuration.VersionableInterface):
+class ModuleGatherers(
+    interfaces.configuration.VersionableInterface,
+    interfaces.configuration.ConfigurableInterface,
+):
     _version = (1, 0, 0)
     _required_framework_version = (2, 0, 0)
 
@@ -629,3 +649,19 @@ class ModuleGatherers(interfaces.configuration.VersionableInterface):
         ModuleGathererScanner,
         ModuleGathererKernel,
     ]
+
+    @classmethod
+    def get_requirements(cls):
+        reqs = []
+
+        # for now, all versions are 1, this will be broken out if/when that changes
+        for gatherer in ModuleGatherers.all_gatherers_identifier:
+            reqs.append(
+                requirements.VersionRequirement(
+                    name=gatherer.name.replace(" ", ""),
+                    component=gatherer,
+                    version=(1, 0, 0),
+                )
+            )
+
+        return reqs