initial set of Linux plugins and extensions for ikelos review

volatility/plugins/linux/lsof.py

@@ -0,0 +1,63 @@
+"""A module containing a collection of plugins that produce data
+typically found in Linux's /proc file system.
+"""
+import logging
+
+from volatility.framework.interfaces import plugins
+from volatility.framework import renderers
+from volatility.framework import constants
+from volatility.framework.automagic import linux
+from volatility.framework.renderers import format_hints
+from volatility.framework.objects import utility
+from volatility.plugins.linux import pslist
+
+vollog = logging.getLogger(__name__)
+
+class Lsof(plugins.PluginInterface):
+    """Lists all memory maps for all processes"""
+
+    @classmethod
+    def get_requirements(cls):
+        # Since we're calling the plugin, make sure we have the plugin's requirements
+        return pslist.PsList.get_requirements() + []
+
+    # yields list of data, e.g.: calculate
+    def _generator(self, tasks):
+        layer_name   = self.config['primary.memory_layer']
+
+        _, aslr_shift = linux.LinuxUtilities.find_aslr(self.context, self.config["vmlinux"], layer_name)
+        vmlinux = self.context.module(self.config["vmlinux"], self.config["primary"], aslr_shift)
+        pointer_template = self.context.symbol_space[self.config['vmlinux']].get_type('pointer')
+
+        for task in tasks:
+            fd_table = task.files.get_fds()
+            if fd_table == 0:
+                continue
+
+            max_fds  = task.files.get_max_fds()
+                    
+            proc_name = utility.array_to_string(task.comm)
+        
+            # corruption check
+            if max_fds > 500000:
+                continue
+            
+            fds = vmlinux.object(type_name="array", offset = fd_table.vol.offset, subtype = pointer_template, count = max_fds)
+            
+            for (i, fd_ptr) in enumerate(fds):
+                if fd_ptr:
+                    filp = fd_ptr.dereference().cast(self.config["vmlinux"] + constants.BANG + 'file')
+
+                    full_path = task.path_for_file(filp, layer_name)
+
+                    yield (0, (task.pid, proc_name, i, full_path))
+
+    def run(self):
+        plugin = pslist.PsList(self.context, "plugins.Lsof")
+
+        return renderers.TreeGrid(
+                [("PID", int),
+                 ("Process", str),
+                 ("FD", int),
+                 ("Path", str)],
+                self._generator(plugin.list_tasks()))