From 65556a2c92d63f9248689fc80ab45af6eea4e3c2 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 4 Dec 2019 13:33:51 -0600 Subject: [PATCH] Linux - update handling of kernels that do not have loadable module support --- volatility/framework/plugins/linux/lsmod.py | 11 ++++++++++- volatility/framework/symbols/linux/__init__.py | 4 +++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/volatility/framework/plugins/linux/lsmod.py b/volatility/framework/plugins/linux/lsmod.py index 74ebbc4d7..9491d92e7 100644 --- a/volatility/framework/plugins/linux/lsmod.py +++ b/volatility/framework/plugins/linux/lsmod.py @@ -4,16 +4,19 @@ """A module containing a collection of plugins that produce data typically found in Linux's /proc file system.""" +import logging + from typing import List, Generator, Iterable from volatility.framework import contexts -from volatility.framework import renderers, constants, interfaces +from volatility.framework import exceptions, renderers, constants, interfaces from volatility.framework.automagic import linux from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins from volatility.framework.objects import utility from volatility.framework.renderers import format_hints +vollog = logging.getLogger(__name__) class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules.""" @@ -44,6 +47,12 @@ class Lsmod(plugins.PluginInterface): vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0) + try: + vmlinux.get_type("module") + except exceptions.SymbolError: + vollog.debug("The required symbol 'module' is not present in symbol table. Please check that kernel modules are enabled for the system under analysis.") + return + modules = vmlinux.object_from_symbol(symbol_name = "modules").cast("list_head") table_name = modules.vol.type_name.split(constants.BANG)[0] diff --git a/volatility/framework/symbols/linux/__init__.py b/volatility/framework/symbols/linux/__init__.py index 288166b97..0120010fb 100644 --- a/volatility/framework/symbols/linux/__init__.py +++ b/volatility/framework/symbols/linux/__init__.py @@ -25,7 +25,9 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.set_type_class('fs_struct', extensions.fs_struct) self.set_type_class('files_struct', extensions.files_struct) self.set_type_class('vfsmount', extensions.vfsmount) - self.set_type_class('module', extensions.module) + + if 'module' in self.types: + self.set_type_class('module', extensions.module) if 'mount' in self.types: self.set_type_class('mount', extensions.mount)