fix plugins for new API

volatility/framework/plugins/linux/elfs.py

@@ -57,7 +57,7 @@ class Elfs(plugins.PluginInterface):
                 if not (hdr[0] == 0x7f and hdr[1] == 0x45 and hdr[2] == 0x4c and hdr[3] == 0x46):
                     continue
 
-                path = vma.get_name(task)
+                path = vma.get_name(self.context, task)
 
                 yield (0, (task.pid, name, format_hints.Hex(vma.vm_start), format_hints.Hex(vma.vm_end), path))
 

volatility/framework/plugins/linux/malfind.py

@@ -53,7 +53,7 @@ class Malfind(interfaces_plugins.PluginInterface):
         proc_layer = self.context.memory[proc_layer_name]
 
         for vma in task.mm.get_mmap_iter():
-            if vma.is_suspicious() and vma.get_name(task) != "[vdso]":
+            if vma.is_suspicious() and vma.get_name(self.context, task) != "[vdso]":
                 data = proc_layer.read(vma.vm_start, 64, pad = True)
                 yield vma, data
 

volatility/framework/plugins/linux/proc.py

@@ -63,7 +63,7 @@ class Maps(plugins.PluginInterface):
                         minor = inode_object.i_sb.minor
                         inode = inode_object.i_ino
 
-                path = vma.get_name(task)
+                path = vma.get_name(self.context, task)
 
                 yield (0, (task.pid, name, format_hints.Hex(vma.vm_start), format_hints.Hex(vma.vm_end), flags,
                            format_hints.Hex(page_offset), major, minor, inode, path))

volatility/framework/plugins/linux/pslist.py

@@ -21,7 +21,7 @@
 from typing import Callable, Iterable, List
 
 import volatility.framework.interfaces.plugins as interfaces_plugins
-from volatility.framework import renderers, interfaces
+from volatility.framework import renderers, interfaces, contexts
 from volatility.framework.automagic import linux
 from volatility.framework.configuration import requirements
 from volatility.framework.objects import utility
@@ -72,9 +72,14 @@ class PsList(interfaces_plugins.PluginInterface):
                    vmlinux_symbols: str,
                    filter: Callable[[int], bool] = lambda _: False) -> Iterable[interfaces.objects.ObjectInterface]:
         """Lists all the tasks in the primary layer"""
+        linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
 
-        _, aslr_shift = linux.LinuxUtilities.find_aslr(context, vmlinux_symbols, layer_name)
-        vmlinux = context.module(vmlinux_symbols, layer_name, aslr_shift)
+        vmlinux = contexts.Module(context,
+                                  vmlinux_symbols,
+                                  layer_name,
+                                  0,
+                                  absolute_symbol_addresses = True)   
+ 
         init_task = vmlinux.object(symbol_name = "init_task")
 
         for task in init_task.tasks:

volatility/framework/symbols/linux/extensions/__init__.py

@@ -214,9 +214,9 @@ class vm_area_struct(objects.Struct):
 
         return self.vm_pgoff << constants.linux.PAGE_SHIFT
 
-    def get_name(self, task):
+    def get_name(self, context, task):
         if self.vm_file != 0:
-            fname = linux.LinuxUtilities.path_for_file(task, self.vm_file)
+            fname = linux.LinuxUtilities.path_for_file(context, task, self.vm_file)
         elif self.vm_start <= task.mm.start_brk and self.vm_end >= task.mm.brk:
             fname = "[heap]"
         elif self.vm_start <= task.mm.start_stack and self.vm_end >= task.mm.start_stack:
@@ -230,19 +230,18 @@ class vm_area_struct(objects.Struct):
 
     # used by malfind
     def is_suspicious(self):
-        ret = True
+        ret = False
 
         flags_str = self.get_protection()
 
-        if flags_str.find("VM_READ|VM_WRITE|VM_EXEC") != -1:
+        if flags_str == "rwx":
             ret = True
 
-        elif flags_str == "VM_READ|VM_EXEC" and self.vm_file != 0:
+        elif flags_str == "r-x" and self.vm_file.dereference().vol.offset == 0:
             ret = True
-
+        
         return ret
 
-
 class qstr(objects.Struct):
 
     def name_as_str(self) -> str: