From 9d9b68eaa324ad87c938c73c38bdb3bc543e45e6 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Dec 2018 11:46:27 -0600 Subject: [PATCH] have check_afinfo not inherit from lsmod --- volatility/plugins/linux/check_afinfo.py | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/volatility/plugins/linux/check_afinfo.py b/volatility/plugins/linux/check_afinfo.py index 9ac76a939..4e09f9c3a 100644 --- a/volatility/plugins/linux/check_afinfo.py +++ b/volatility/plugins/linux/check_afinfo.py @@ -5,16 +5,25 @@ import logging from volatility.framework import renderers, constants from volatility.framework.automagic import linux +from volatility.framework.interfaces import plugins from volatility.framework.renderers import format_hints from volatility.framework.objects import utility from volatility.framework import exceptions -from volatility.plugins.linux import lsmod +from volatility.framework.configuration import requirements vollog = logging.getLogger(__name__) -class check_afinfo(lsmod.Lsmod): +class check_afinfo(plugins.PluginInterface): """Verifies the operation function pointers of network protocols""" - + + @classmethod + def get_requirements(cls): + return [requirements.TranslationLayerRequirement(name = 'primary', + description = 'Kernel Address Space', + architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "vmlinux", + description = "Linux Kernel")] + # returns whether the symbol is found within the kernel (system.map) or not def _is_known_address(self, handler_addr): symbols = list(self.context.symbol_space.get_symbols_by_location(handler_addr))