Created linux.proc.Maps plugin.

Added object extensions for the key structures. Also added constants.linux, which will contain Linux-specific constants that can't be extracted via dwarf.
2026-08-31 12:19:42 +02:00 · 2017-08-16 16:14:33 -04:00
parent efc2d75a86
commit 5bb2aef9fc
5 changed files with 196 additions and 3 deletions
@@ -0,0 +1,72 @@
+"""A module containing a collection of plugins that produce data
+typically found in Linux's /proc file system.
+"""
+
+from volatility.framework.interfaces import plugins
+from volatility.framework import renderers
+from volatility.framework.renderers import format_hints
+from volatility.framework.objects import utility
+from volatility.plugins.linux import pslist
+
+
+
+class Maps(plugins.PluginInterface):
+    """Lists all memory maps for all processes"""
+
+    @classmethod
+    def get_requirements(cls):
+        # Since we're calling the plugin, make sure we have the plugin's requirements
+        return pslist.PsList.get_requirements() + []
+
+
+    def _generator(self, tasks):
+        for task in tasks:
+            if not task.mm:
+                continue
+
+            name = utility.array_to_string(task.comm)
+
+            for vma in task.mm.mmap_iter:
+                flags = vma.flags
+                page_offset = vma.page_offset()
+                major = 0
+                minor = 0
+                inode = 0
+                path = ""
+
+                if vma.vm_file != 0:
+                    inode_object = vma.vm_file.f_path.dentry.d_inode
+                    major = inode_object.i_sb.major
+                    minor = inode_object.i_sb.minor
+                    inode = inode_object.i_ino
+                    path = vma.vm_file.full_path
+
+                yield(
+                    0,
+                    (task.pid,
+                     name,
+                     format_hints.Hex(vma.vm_start),
+                     format_hints.Hex(vma.vm_end),
+                     flags,
+                     format_hints.Hex(page_offset),
+                     major,
+                     minor,
+                     inode,
+                     path
+                     ))
+
+    def run(self):
+        plugin = pslist.PsList(self.context, "plugins.Maps")
+
+        return renderers.TreeGrid(
+                [("PID", int),
+                 ("Process", str),
+                 ("Start", format_hints.Hex),
+                 ("End", format_hints.Hex),
+                 ("Flags", str),
+                 ("PgOff", format_hints.Hex),
+                 ("Major", int),
+                 ("Minor", int),
+                 ("Inode", int),
+                 ("File Path", str)],
+                self._generator(plugin.list_tasks()))