diff --git a/test/test_volatility.py b/test/test_volatility.py index 8676d1f3e..5b57dd59d 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -842,6 +842,27 @@ def test_linux_hidden_modules(image, volatility, python): assert out.count(b"\n") >= 4 +def test_linux_kallsyms(image, volatility, python): + rc, out, _err = runvol_plugin( + "linux.kallsyms.Kallsyms", + image, + volatility, + python, + pluginargs=["--only-modules"], + ) + # linux-sample-1.bin has no hidden modules. + # This validates that plugin requirements are met and exceptions are not raised. + assert rc == 0 + assert out.count(b"\n") > 1000 + + # Addr Type Size Exported SubSystem ModuleName SymbolName Description + # 0xffffa009eba9 t 28 False module usbcore usb_mon_register Symbol is in the text (code) section + assert re.search( + rb"0xffffa009eba9\s+t\s+28\s+False\s+module\s+usbcore\s+usb_mon_register\s+Symbol is in the text \(code\) section", + out, + ) + + # MAC