diff --git a/volatility/framework/plugins/linux/lsmod.py b/volatility/framework/plugins/linux/lsmod.py index 74ebbc4d7..9491d92e7 100644 --- a/volatility/framework/plugins/linux/lsmod.py +++ b/volatility/framework/plugins/linux/lsmod.py @@ -4,16 +4,19 @@ """A module containing a collection of plugins that produce data typically found in Linux's /proc file system.""" +import logging + from typing import List, Generator, Iterable from volatility.framework import contexts -from volatility.framework import renderers, constants, interfaces +from volatility.framework import exceptions, renderers, constants, interfaces from volatility.framework.automagic import linux from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins from volatility.framework.objects import utility from volatility.framework.renderers import format_hints +vollog = logging.getLogger(__name__) class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules.""" @@ -44,6 +47,12 @@ class Lsmod(plugins.PluginInterface): vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0) + try: + vmlinux.get_type("module") + except exceptions.SymbolError: + vollog.debug("The required symbol 'module' is not present in symbol table. Please check that kernel modules are enabled for the system under analysis.") + return + modules = vmlinux.object_from_symbol(symbol_name = "modules").cast("list_head") table_name = modules.vol.type_name.split(constants.BANG)[0] diff --git a/volatility/framework/symbols/linux/__init__.py b/volatility/framework/symbols/linux/__init__.py index 288166b97..0120010fb 100644 --- a/volatility/framework/symbols/linux/__init__.py +++ b/volatility/framework/symbols/linux/__init__.py @@ -25,7 +25,9 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.set_type_class('fs_struct', extensions.fs_struct) self.set_type_class('files_struct', extensions.files_struct) self.set_type_class('vfsmount', extensions.vfsmount) - self.set_type_class('module', extensions.module) + + if 'module' in self.types: + self.set_type_class('module', extensions.module) if 'mount' in self.types: self.set_type_class('mount', extensions.mount)