bug fixes

volatility3/framework/plugins/linux/check_unlinked_modules.py

@@ -397,7 +397,7 @@ def flatten_modules_handlers(
     """Flatten a list of previously calculated modules handlers boundaries (extract all "start" and "end")"""
     return list(
         sum(
-            [(h[1], h[2]) for h in set(handlers)],
+            [(h[2], h[3]) for h in set(handlers)],
             (),
         )
     )

volatility3/framework/plugins/linux/kernel_tracing/ftrace.py

@@ -144,8 +144,13 @@ class Check_ftrace(interfaces.plugins.PluginInterface):
 
         for ftrace_func_entry in ftrace_func_entries:
             callback = int(ftrace_ops.func)
+            try:
+                func = ftrace_func_entry.ip.cast("pointer")
+            except exceptions.InvalidAddressException:
+                continue
+
             hook_symbols = wrapper_get_symbols_by_absolute_location(
-                self.vmlinux, ftrace_func_entry.ip.cast("pointer")
+                self.vmlinux, func
             )
 
             # Avoid running the aggressive module finder twice for an address, if it wasn't found previously
@@ -226,9 +231,9 @@ class Check_ftrace(interfaces.plugins.PluginInterface):
 
         while True:
             yield bucket_head.cast("ftrace_func_entry")
-            if bucket_head.next.is_readable():
+            try:
                 bucket_head = bucket_head.next.dereference()
-            else:
+            except exceptions.InvalidAddressException:
                 break
 
     def set_compiled_kernel_space_boundaries(self):

volatility3/framework/plugins/linux/kernel_tracing/tracepoints.py

@@ -132,7 +132,8 @@ class Check_tracepoints(interfaces.plugins.PluginInterface):
 
             try:
                 parse_result = self.parse_tracepoint(tracepoint)
-                results.append((0, parse_result))
+                if parse_result:
+                    results.append((0, parse_result))
             except Exception as e:
                 vollog.exception(f"Unhandled exception : {e}")
 
@@ -163,6 +164,9 @@ class Check_tracepoints(interfaces.plugins.PluginInterface):
         # Fetch more informations about the module
         if module_name != UNKNOWN:
             module_obj = get_module_object_from_name(module_name, self.modules)
+            if not module_obj:
+                return None
+
             module_address = module_obj.vol.offset
             f_module = f"{hex(module_address)} [{module_name}]"
             probe_handler_address_symbol = (

volatility3/framework/plugins/linux/netfilter.py

@@ -190,7 +190,7 @@ class AbstractNetfilter(ABC):
                         priority = int(hook_ops.priority)
                         hook_ops_hook = hook_ops.hook
                         module_name = self.get_module_name_for_address(hook_ops_hook)
-                        hooked = module_name is not None
+                        hooked = module_name is None
 
                         yield netns, proto_name, hook_name, priority, hook_ops_hook, module_name, hooked