WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 18:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Automagic: Refactor ASLR finding for all symbol_finder using OSes

Browse Source
This commit is contained in:
Mike Auty
2020-06-10 19:39:20 +01:00
committed by ikelos
parent 863b9915c9
commit a6cd344e22
9 changed files with 72 additions and 101 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/linux/check_afinfo.py
+1 -3
View File
@@ -62,9 +62,7 @@ class Check_afinfo(plugins.PluginInterface):
yield var_name, "show", var.seq_show
def _generator(self):
masked_vmlinux_symbols = linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
vmlinux = contexts.Module(self.context, masked_vmlinux_symbols, self.config['primary'], 0)
vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0)
op_members = vmlinux.get_type('file_operations').members
seq_members = vmlinux.get_type('seq_operations').members
volatility/framework/plugins/linux/check_syscall.py
+1 -4
View File
@@ -122,10 +122,7 @@ class Check_syscall(plugins.PluginInterface):
# TODO - add finding and parsing unistd.h once cached file enumeration is added
def _generator(self):
masked_symbol_table = linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'],
self.config['primary'])
vmlinux = contexts.Module(self.context, masked_symbol_table, self.config['primary'], 0)
vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0)
ptr_sz = vmlinux.get_type("pointer").size
if ptr_sz == 4:
volatility/framework/plugins/linux/lsmod.py
+1 -3
View File
@@ -45,9 +45,7 @@ class Lsmod(plugins.PluginInterface):
This function will throw a SymbolError exception if kernel module support is not enabled.
"""
masked_vmlinux_symbols = linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
vmlinux = contexts.Module(context, masked_vmlinux_symbols, layer_name, 0)
vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0)
modules = vmlinux.object_from_symbol(symbol_name = "modules").cast("list_head")
volatility/framework/plugins/linux/lsof.py
+1 -4
View File
@@ -45,14 +45,11 @@ class Lsof(plugins.PluginInterface):
yield (0, (pid, name, fd_num, full_path))
def run(self):
masked_vmlinux_symbols = linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'],
self.config['primary'])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int), ("Process", str), ("FD", int), ("Path", str)],
self._generator(
pslist.PsList.list_tasks(self.context,
self.config['primary'],
masked_vmlinux_symbols,
self.config['vmlinux'],
filter_func = filter_func)))
volatility/framework/plugins/linux/pslist.py
+1 -3
View File
@@ -75,9 +75,7 @@ class PsList(interfaces.plugins.PluginInterface):
Yields:
Process objects
"""
masked_vmlinux_symbols = linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
vmlinux = contexts.Module(context, masked_vmlinux_symbols, layer_name, 0)
vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0)
init_task = vmlinux.object_from_symbol(symbol_name = "init_task")