From 8f1b33899612f39d4da8affb93a6f09f9bdcd7e7 Mon Sep 17 00:00:00 2001 From: mtressler <59582863+mtressler@users.noreply.github.com> Date: Fri, 17 Jul 2020 14:00:29 -0400 Subject: [PATCH] Update check_creds.py changed behavior of plugin with it is run with a bad symbol table. Instead of a vollog.error, a TypeError exception is raised with information as to why it was raised. Also removed unnecessary header info. --- volatility/framework/plugins/linux/check_creds.py | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/volatility/framework/plugins/linux/check_creds.py b/volatility/framework/plugins/linux/check_creds.py index 59ba90029..7151dc7b7 100644 --- a/volatility/framework/plugins/linux/check_creds.py +++ b/volatility/framework/plugins/linux/check_creds.py @@ -1,14 +1,7 @@ -# Volatility - # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -""" -@author: Matt Tressler -@contact: matthewtressler10@gmail.com -""" - import logging from typing import List @@ -44,7 +37,7 @@ class check_creds(interfaces.plugins.PluginInterface): type_task = self.context.symbol_space.get_type(self.config['vmlinux'] + constants.BANG +"task_struct") if not type_task.has_member("cred"): - vollog.error("this command is not supported by this profile") + raise TypeError("This plugin requires the task_struct structure to have a cred member. This member is not present in the supplied symbol table. This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt.") creds = {}