From 726359b59c8e8f18caa554477a42ce5f8e9ce534 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Thu, 7 Nov 2024 07:09:25 -0600 Subject: [PATCH] bug fixes --- .../framework/plugins/linux/check_unlinked_modules.py | 2 +- .../framework/plugins/linux/kernel_tracing/ftrace.py | 11 ++++++++--- .../plugins/linux/kernel_tracing/tracepoints.py | 6 +++++- volatility3/framework/plugins/linux/netfilter.py | 2 +- 4 files changed, 15 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/linux/check_unlinked_modules.py b/volatility3/framework/plugins/linux/check_unlinked_modules.py index 197fd98c8..1fc6b2967 100644 --- a/volatility3/framework/plugins/linux/check_unlinked_modules.py +++ b/volatility3/framework/plugins/linux/check_unlinked_modules.py @@ -397,7 +397,7 @@ def flatten_modules_handlers( """Flatten a list of previously calculated modules handlers boundaries (extract all "start" and "end")""" return list( sum( - [(h[1], h[2]) for h in set(handlers)], + [(h[2], h[3]) for h in set(handlers)], (), ) ) diff --git a/volatility3/framework/plugins/linux/kernel_tracing/ftrace.py b/volatility3/framework/plugins/linux/kernel_tracing/ftrace.py index 1ccbf56bb..948a67705 100644 --- a/volatility3/framework/plugins/linux/kernel_tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/kernel_tracing/ftrace.py @@ -144,8 +144,13 @@ class Check_ftrace(interfaces.plugins.PluginInterface): for ftrace_func_entry in ftrace_func_entries: callback = int(ftrace_ops.func) + try: + func = ftrace_func_entry.ip.cast("pointer") + except exceptions.InvalidAddressException: + continue + hook_symbols = wrapper_get_symbols_by_absolute_location( - self.vmlinux, ftrace_func_entry.ip.cast("pointer") + self.vmlinux, func ) # Avoid running the aggressive module finder twice for an address, if it wasn't found previously @@ -226,9 +231,9 @@ class Check_ftrace(interfaces.plugins.PluginInterface): while True: yield bucket_head.cast("ftrace_func_entry") - if bucket_head.next.is_readable(): + try: bucket_head = bucket_head.next.dereference() - else: + except exceptions.InvalidAddressException: break def set_compiled_kernel_space_boundaries(self): diff --git a/volatility3/framework/plugins/linux/kernel_tracing/tracepoints.py b/volatility3/framework/plugins/linux/kernel_tracing/tracepoints.py index cf9fe20b9..bd40e98f1 100644 --- a/volatility3/framework/plugins/linux/kernel_tracing/tracepoints.py +++ b/volatility3/framework/plugins/linux/kernel_tracing/tracepoints.py @@ -132,7 +132,8 @@ class Check_tracepoints(interfaces.plugins.PluginInterface): try: parse_result = self.parse_tracepoint(tracepoint) - results.append((0, parse_result)) + if parse_result: + results.append((0, parse_result)) except Exception as e: vollog.exception(f"Unhandled exception : {e}") @@ -163,6 +164,9 @@ class Check_tracepoints(interfaces.plugins.PluginInterface): # Fetch more informations about the module if module_name != UNKNOWN: module_obj = get_module_object_from_name(module_name, self.modules) + if not module_obj: + return None + module_address = module_obj.vol.offset f_module = f"{hex(module_address)} [{module_name}]" probe_handler_address_symbol = ( diff --git a/volatility3/framework/plugins/linux/netfilter.py b/volatility3/framework/plugins/linux/netfilter.py index f576c073c..66075f907 100644 --- a/volatility3/framework/plugins/linux/netfilter.py +++ b/volatility3/framework/plugins/linux/netfilter.py @@ -190,7 +190,7 @@ class AbstractNetfilter(ABC): priority = int(hook_ops.priority) hook_ops_hook = hook_ops.hook module_name = self.get_module_name_for_address(hook_ops_hook) - hooked = module_name is not None + hooked = module_name is None yield netns, proto_name, hook_name, priority, hook_ops_hook, module_name, hooked