WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-28 04:24:53 +02:00
Code Issues Packages Projects Releases Wiki Activity

Plugins: Version Mac/LinuxUtilities classes

Browse Source
This commit is contained in:
Mike Auty
2020-08-18 09:07:32 +01:00
committed by ikelos
parent 75719c8393
commit 9b57d7a58c
15 changed files with 39 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/linux/check_idt.py
+10 -8
View File
@@ -5,7 +5,7 @@
import logging
from typing import List
from volatility.framework import interfaces, renderers, constants, contexts, exceptions, symbols
from volatility.framework import interfaces, renderers, contexts, symbols
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import linux
@@ -25,7 +25,7 @@ class Check_idt(interfaces.plugins.PluginInterface):
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"),
requirements.VersionRequirement(name = 'linuxutils', component = linux.LinuxUtilities, version = (1, 0, 0)),
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0))
]
@@ -34,8 +34,8 @@ class Check_idt(interfaces.plugins.PluginInterface):
modules = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['vmlinux'])
handlers = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'], self.config['vmlinux'], modules)
handlers = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'],
self.config['vmlinux'], modules)
is_32bit = not symbols.symbol_table_is_64bit(self.context, self.config["vmlinux"])
@@ -61,7 +61,8 @@ class Check_idt(interfaces.plugins.PluginInterface):
addrs = vmlinux.object_from_symbol("idt_table")
table = vmlinux.object(object_type = 'array', offset = addrs.vol.offset, subtype = vmlinux.get_type(idt_type), count = idt_table_size)
table = vmlinux.object(object_type = 'array', offset = addrs.vol.offset, subtype = vmlinux.get_type(idt_type),
count = idt_table_size)
for i in check_idxs:
ent = table[i]
@@ -86,8 +87,9 @@ class Check_idt(interfaces.plugins.PluginInterface):
module_name, symbol_name = linux.LinuxUtilities.lookup_module_address(self.context, handlers, idt_addr)
yield(0, [format_hints.Hex(i), format_hints.Hex(idt_addr), module_name, symbol_name])
yield (0, [format_hints.Hex(i), format_hints.Hex(idt_addr), module_name, symbol_name])
def run(self):
return renderers.TreeGrid([("Index", format_hints.Hex), ("Address", format_hints.Hex), ("Module", str), ("Symbol", str)], self._generator())
return renderers.TreeGrid(
[("Index", format_hints.Hex), ("Address", format_hints.Hex), ("Module", str), ("Symbol", str)],
self._generator())
volatility/framework/plugins/linux/keyboard_notifiers.py
+4 -3
View File
@@ -4,10 +4,10 @@
import logging
from volatility.framework import interfaces, renderers, constants, contexts, exceptions
from volatility.framework.symbols import linux
from volatility.framework import interfaces, renderers, contexts, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import linux
from volatility.plugins.linux import lsmod
vollog = logging.getLogger(__name__)
@@ -23,7 +23,8 @@ class Keyboard_notifiers(interfaces.plugins.PluginInterface):
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"),
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0))
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)),
requirements.VersionRequirement(name = 'linuxutils', component = linux.LinuxUtilities, version = (1, 0, 0))
]
def _generator(self):
volatility/framework/plugins/linux/lsof.py
+1
View File
@@ -27,6 +27,7 @@ class Lsof(plugins.PluginInterface):
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)),
requirements.VersionRequirement(name = 'linuxutils', component = linux.LinuxUtilities, version = (1, 0, 0)),
requirements.ListRequirement(name = 'pid',
description = 'Filter on specific process IDs',
element_type = int,
volatility/framework/plugins/linux/tty_check.py
+4 -3
View File
@@ -6,12 +6,12 @@ import logging
from typing import List
from volatility.framework import interfaces, renderers, exceptions, constants, contexts
from volatility.framework.symbols import linux
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.plugins.linux import lsmod
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import linux
from volatility.plugins.linux import lsmod
vollog = logging.getLogger(__name__)
@@ -26,7 +26,8 @@ class tty_check(plugins.PluginInterface):
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"),
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0))
requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)),
requirements.VersionRequirement(name = 'linuxutils', component = linux.LinuxUtilities, version = (1, 0, 0))
]
def _generator(self):