From 8935e4dd199d36a1ada23ee4cea3a102f53f63b0 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 10 Apr 2020 22:12:03 +0100 Subject: [PATCH] Fix up linuxutils to use symbol_tables rather than hard coded values --- volatility/framework/automagic/linux.py | 5 ++--- volatility/framework/plugins/linux/lsof.py | 8 +++++++- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index 4910dd2aa..8c67b875f 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -228,8 +228,7 @@ class LinuxUtilities(object): return ret @classmethod - def files_descriptors_for_process(cls, config: interfaces.configuration.HierarchicalDict, - context: interfaces.context.ContextInterface, + def files_descriptors_for_process(cls, context: interfaces.context.ContextInterface, symbol_table: str, task: interfaces.objects.ObjectInterface): fd_table = task.files.get_fds() @@ -242,7 +241,7 @@ class LinuxUtilities(object): if max_fds > 500000: return - file_type = config["vmlinux"] + constants.BANG + 'file' + file_type = symbol_table + constants.BANG + 'file' fds = objects.utility.array_of_pointers(fd_table, count = max_fds, subtype = file_type, context = context) diff --git a/volatility/framework/plugins/linux/lsof.py b/volatility/framework/plugins/linux/lsof.py index e82c8dee8..f62639567 100644 --- a/volatility/framework/plugins/linux/lsof.py +++ b/volatility/framework/plugins/linux/lsof.py @@ -30,12 +30,18 @@ class Lsof(plugins.PluginInterface): ] def _generator(self, tasks): + symbol_table = None for task in tasks: + if symbol_table is None: + if constants.BANG not in task.vol.type_name: + raise ValueError("Task is not part of a symbol table") + symbol_table = task.vol.type_name.split(constants.BANG)[0] + name = utility.array_to_string(task.comm) pid = int(task.pid) for fd_num, _, full_path in linux.LinuxUtilities.files_descriptors_for_process( - self.config, self.context, task): + self.context, symbol_table, task): yield (0, (pid, name, fd_num, full_path)) def run(self):