From 70e82041135d2597861fd962ff842bebd73c4731 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 19 Dec 2018 22:38:43 +0000 Subject: [PATCH] Fix up linux version of mmap_iter property to get_mmap_iter. --- volatility/framework/plugins/linux/elfs.py | 2 +- volatility/framework/plugins/linux/malfind.py | 2 +- volatility/framework/plugins/linux/proc.py | 2 +- volatility/framework/symbols/linux/extensions/__init__.py | 5 ++--- 4 files changed, 5 insertions(+), 6 deletions(-) diff --git a/volatility/framework/plugins/linux/elfs.py b/volatility/framework/plugins/linux/elfs.py index d113f8b7a..0fefeff10 100644 --- a/volatility/framework/plugins/linux/elfs.py +++ b/volatility/framework/plugins/linux/elfs.py @@ -33,7 +33,7 @@ class Elfs(plugins.PluginInterface): name = utility.array_to_string(task.comm) - for vma in task.mm.mmap_iter: + for vma in task.mm.get_mmap_iter(): hdr = proc_layer.read(vma.vm_start, 4, pad = True) if not (hdr[0] == 0x7f and hdr[1] == 0x45 and hdr[2] == 0x4c and hdr[3] == 0x46): continue diff --git a/volatility/framework/plugins/linux/malfind.py b/volatility/framework/plugins/linux/malfind.py index 21826c197..0d4be3d7f 100644 --- a/volatility/framework/plugins/linux/malfind.py +++ b/volatility/framework/plugins/linux/malfind.py @@ -32,7 +32,7 @@ class Malfind(interfaces_plugins.PluginInterface): proc_layer = self.context.memory[proc_layer_name] - for vma in task.mm.mmap_iter: + for vma in task.mm.get_mmap_iter(): if vma.is_suspicious() and vma.get_name(task) != "[vdso]": data = proc_layer.read(vma.vm_start, 64, pad = True) yield vma, data diff --git a/volatility/framework/plugins/linux/proc.py b/volatility/framework/plugins/linux/proc.py index 8ddd2ade2..12cff96d3 100644 --- a/volatility/framework/plugins/linux/proc.py +++ b/volatility/framework/plugins/linux/proc.py @@ -29,7 +29,7 @@ class Maps(plugins.PluginInterface): name = utility.array_to_string(task.comm) - for vma in task.mm.mmap_iter: + for vma in task.mm.get_mmap_iter(): flags = vma.get_protection() page_offset = vma.get_page_offset() major = 0 diff --git a/volatility/framework/symbols/linux/extensions/__init__.py b/volatility/framework/symbols/linux/extensions/__init__.py index 1e6550455..434b3971e 100644 --- a/volatility/framework/symbols/linux/extensions/__init__.py +++ b/volatility/framework/symbols/linux/extensions/__init__.py @@ -59,7 +59,7 @@ class task_struct(generic.GenericIntelProcess): def get_process_memory_sections(self, heap_only: bool = False) -> Generator[Tuple[int, int], None, None]: """Returns a list of sections based on the memory manager's view of this task's virtual memory""" - for vma in self.mm.mmap_iter: + for vma in self.mm.get_mmap_iter(): start = int(vma.vm_start) end = int(vma.vm_end) @@ -95,8 +95,7 @@ class fs_struct(objects.Struct): class mm_struct(objects.Struct): - @property - def mmap_iter(self) -> Iterable[interfaces.objects.ObjectInterface]: + def get_mmap_iter(self) -> Iterable[interfaces.objects.ObjectInterface]: """Returns an iterator for the mmap list member of an mm_struct.""" if not self.mmap: