diff --git a/volatility3/framework/plugins/linux/bash.py b/volatility3/framework/plugins/linux/bash.py index 471f4cbe7..dd2cb2c0f 100644 --- a/volatility3/framework/plugins/linux/bash.py +++ b/volatility3/framework/plugins/linux/bash.py @@ -26,7 +26,8 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.ModuleRequirement(name = 'vmlinux', architectures = ["Intel32", "Intel64"]), + requirements.ModuleRequirement(name = 'kernel', description = 'Linux kernel', + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.ListRequirement(name = 'pid', element_type = int, @@ -35,7 +36,8 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): ] def _generator(self, tasks): - is_32bit = not symbols.symbol_table_is_64bit(self.context, self.config["vmlinux.symbol_table_name"]) + vmlinux = self.context.modules[self.config["kernel"]] + is_32bit = not symbols.symbol_table_is_64bit(self.context, vmlinux.symbol_table_name) if is_32bit: pack_format = "I" bash_json_file = "bash32" @@ -90,7 +92,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): ("Command", str)], self._generator( pslist.PsList.list_tasks(self.context, - self.config['vmlinux'], + self.config['kernel'], filter_func = filter_func))) def generate_timeline(self): @@ -98,7 +100,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): for row in self._generator( pslist.PsList.list_tasks(self.context, - self.config['vmlinux'], + self.config['kernel'], filter_func = filter_func)): _depth, row_data = row description = f"{row_data[0]} ({row_data[1]}): \"{row_data[3]}\"" diff --git a/volatility3/framework/plugins/linux/check_afinfo.py b/volatility3/framework/plugins/linux/check_afinfo.py index 9105247be..f54b89ee3 100644 --- a/volatility3/framework/plugins/linux/check_afinfo.py +++ b/volatility3/framework/plugins/linux/check_afinfo.py @@ -23,7 +23,8 @@ class Check_afinfo(plugins.PluginInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.ModuleRequirement(name = 'vmlinux', architectures = ["Intel32", "Intel64"]), + requirements.ModuleRequirement(name = 'kernel', description = 'Linux kernel', + architectures = ["Intel32", "Intel64"]), ] # returns whether the symbol is found within the kernel (system.map) or not @@ -61,7 +62,7 @@ class Check_afinfo(plugins.PluginInterface): def _generator(self): - vmlinux = self.context.modules[self.config['vmlinux']] + vmlinux = self.context.modules[self.config['kernel']] op_members = vmlinux.get_type('file_operations').members seq_members = vmlinux.get_type('seq_operations').members diff --git a/volatility3/framework/plugins/linux/check_creds.py b/volatility3/framework/plugins/linux/check_creds.py index 28f3d178b..06ac392db 100644 --- a/volatility3/framework/plugins/linux/check_creds.py +++ b/volatility3/framework/plugins/linux/check_creds.py @@ -19,12 +19,13 @@ class Check_creds(interfaces.plugins.PluginInterface): @classmethod def get_requirements(cls): return [ - requirements.ModuleRequirement(name = 'vmlinux', architectures = ["Intel32", "Intel64"]), + requirements.ModuleRequirement(name = 'kernel', description = 'Linux kernel', + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)) ] def _generator(self): - vmlinux = self.context.modules[self.config['vmlinux']] + vmlinux = self.context.modules[self.config['kernel']] type_task = vmlinux.get_type("task_struct") diff --git a/volatility3/framework/plugins/linux/check_idt.py b/volatility3/framework/plugins/linux/check_idt.py index 016717841..e61230041 100644 --- a/volatility3/framework/plugins/linux/check_idt.py +++ b/volatility3/framework/plugins/linux/check_idt.py @@ -22,13 +22,14 @@ class Check_idt(interfaces.plugins.PluginInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.ModuleRequirement(name = 'vmlinux', architectures = ["Intel32", "Intel64"]), + requirements.ModuleRequirement(name = 'kernel', description = 'Linux kernel', + architectures = ["Intel32", "Intel64"]), requirements.VersionRequirement(name = 'linuxutils', component = linux.LinuxUtilities, version = (2, 0, 0)), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0)) ] def _generator(self): - vmlinux = self.context.modules[self.config['vmlinux']] + vmlinux = self.context.modules[self.config['kernel']] modules = lsmod.Lsmod.list_modules(self.context, vmlinux.name) diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index 362dce692..40b4f6e0c 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -23,7 +23,8 @@ class Check_modules(plugins.PluginInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.ModuleRequirement(name = 'vmlinux', architectures = ["Intel32", "Intel64"]), + requirements.ModuleRequirement(name = 'kernel', description = 'Linux kernel', + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0)) ] @@ -60,11 +61,11 @@ class Check_modules(plugins.PluginInterface): return ret def _generator(self): - kset_modules = self.get_kset_modules(self.context, self.config['vmlinux']) + kset_modules = self.get_kset_modules(self.context, self.config['kernel']) lsmod_modules = set( str(utility.array_to_string(modules.name)) - for modules in lsmod.Lsmod.list_modules(self.context, self.config['vmlinux'])) + for modules in lsmod.Lsmod.list_modules(self.context, self.config['kernel'])) for mod_name in set(kset_modules.keys()).difference(lsmod_modules): yield (0, (format_hints.Hex(kset_modules[mod_name]), str(mod_name))) diff --git a/volatility3/framework/plugins/linux/check_syscall.py b/volatility3/framework/plugins/linux/check_syscall.py index 3acd2877a..e1ba41361 100644 --- a/volatility3/framework/plugins/linux/check_syscall.py +++ b/volatility3/framework/plugins/linux/check_syscall.py @@ -30,7 +30,8 @@ class Check_syscall(plugins.PluginInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.ModuleRequirement(name = 'vmlinux', architectures = ["Intel32", "Intel64"]), + requirements.ModuleRequirement(name = 'kernel', description = 'Linux kernel', + architectures = ["Intel32", "Intel64"]), ] def _get_table_size_next_symbol(self, table_addr, ptr_sz, vmlinux): @@ -101,7 +102,8 @@ class Check_syscall(plugins.PluginInterface): # if we can't find the disassemble function then bail and rely on a different method return 0 - data = self.context.layers.read(self.config['vmlinux.layer_name'], func_addr, 6) + vmlinux = self.context.modules[self.config['kernel']] + data = self.context.layers.read(vmlinux.layer_name, func_addr, 6) for (address, size, mnemonic, op_str) in md.disasm_lite(data, func_addr): if mnemonic == 'CMP': @@ -126,7 +128,7 @@ class Check_syscall(plugins.PluginInterface): # TODO - add finding and parsing unistd.h once cached file enumeration is added def _generator(self): - vmlinux = self.context.modules[self.config['vmlinux']] + vmlinux = self.context.modules[self.config['kernel']] ptr_sz = vmlinux.get_type("pointer").size if ptr_sz == 4: diff --git a/volatility3/framework/plugins/linux/elfs.py b/volatility3/framework/plugins/linux/elfs.py index 3fcb017cd..5b072ed7d 100644 --- a/volatility3/framework/plugins/linux/elfs.py +++ b/volatility3/framework/plugins/linux/elfs.py @@ -22,7 +22,8 @@ class Elfs(plugins.PluginInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.ModuleRequirement(name = 'vmlinux', architectures = ["Intel32", "Intel64"]), + requirements.ModuleRequirement(name = 'kernel', description = 'Linux kernel', + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', @@ -56,5 +57,5 @@ class Elfs(plugins.PluginInterface): ("End", format_hints.Hex), ("File Path", str)], self._generator( pslist.PsList.list_tasks(self.context, - self.config['vmlinux'], + self.config['kernel'], filter_func = filter_func))) diff --git a/volatility3/framework/plugins/linux/keyboard_notifiers.py b/volatility3/framework/plugins/linux/keyboard_notifiers.py index 012632bb6..8bb79b6ec 100644 --- a/volatility3/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility3/framework/plugins/linux/keyboard_notifiers.py @@ -21,13 +21,14 @@ class Keyboard_notifiers(interfaces.plugins.PluginInterface): @classmethod def get_requirements(cls): return [ - requirements.ModuleRequirement(name = 'vmlinux', architectures = ["Intel32", "Intel64"]), + requirements.ModuleRequirement(name = 'kernel', description = 'Linux kernel', + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0)), requirements.VersionRequirement(name = 'linuxutils', component = linux.LinuxUtilities, version = (2, 0, 0)) ] def _generator(self): - vmlinux = self.context.modules[self.config['vmlinux']] + vmlinux = self.context.modules[self.config['kernel']] modules = lsmod.Lsmod.list_modules(self.context, vmlinux.name) diff --git a/volatility3/framework/plugins/linux/kmsg.py b/volatility3/framework/plugins/linux/kmsg.py index 67a554067..27327e97b 100644 --- a/volatility3/framework/plugins/linux/kmsg.py +++ b/volatility3/framework/plugins/linux/kmsg.py @@ -2,17 +2,15 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import List, Iterator, Tuple, Generator - from abc import ABC, abstractmethod from enum import Enum +from typing import List, Iterator, Tuple, Generator from volatility3.framework import renderers, interfaces, constants, contexts, class_subclasses from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility - vollog = logging.getLogger(__name__) @@ -53,14 +51,15 @@ class ABCKmsg(ABC): ) def __init__( - self, - context: interfaces.context.ContextInterface, - config: interfaces.configuration.HierarchicalDict + self, + context: interfaces.context.ContextInterface, + config: interfaces.configuration.HierarchicalDict ): self._context = context self._config = config - self.layer_name = self._config['primary'] # type: ignore - symbol_table_name = self._config['vmlinux'] # type: ignore + vmlinux = context.modules[self._config['kernel']] + self.layer_name = kernel.layer_name # type: ignore + symbol_table_name = vmlinux.symbol_table_name # type: ignore self.vmlinux = contexts.Module(context, symbol_table_name, self.layer_name, 0) # type: ignore self.long_unsigned_int_size = self.vmlinux.get_type('long unsigned int').size @@ -80,20 +79,17 @@ class ABCKmsg(ABC): Yields: kmsg records """ - - symbol_table_name = config['vmlinux'] # type: ignore - layer_name = config['primary'] # type: ignore - vmlinux = contexts.Module(context, symbol_table_name, layer_name, 0) # type: ignore + vmlinux = context.modules[config['kernel']] kmsg_inst = None # type: ignore for subclass in class_subclasses(cls): - if not subclass.symtab_checks(vmlinux=vmlinux): + if not subclass.symtab_checks(vmlinux = vmlinux): vollog.log(constants.LOGLEVEL_VVVV, "Kmsg implementation '%s' doesn't match this memory dump", subclass.__name__) continue vollog.log(constants.LOGLEVEL_VVVV, "Kmsg implementation '%s' matches!", subclass.__name__) - kmsg_inst = subclass(context=context, config=config) + kmsg_inst = subclass(context = context, config = config) # More than one class could be executed for an specific kernel # version i.e. Netfilter Ingress hooks # We expect just one implementation to be executed for an specific kernel @@ -120,7 +116,7 @@ class ABCKmsg(ABC): def get_string(self, addr: int, length: int) -> str: txt = self._context.layers[self.layer_name].read(addr, length) # type: ignore - return txt.decode(encoding='utf8', errors='replace') + return txt.decode(encoding = 'utf8', errors = 'replace') def nsec_to_sec_str(self, nsec: int) -> str: # See kernel/printk/printk.c:print_time() @@ -172,6 +168,7 @@ class ABCKmsg(ABC): vollog.debug(f"Facility {facility} unknown") return str(facility) + class KmsgLegacy(ABCKmsg): """Linux kernels prior to v5.10, the ringbuffer is initially kept in __log_buf, and log_buf is a pointer to the former. __log_buf is declared as @@ -185,6 +182,7 @@ class KmsgLegacy(ABCKmsg): consequently to the new buffer. In that case, the original static buffer in __log_buf is unused. """ + @classmethod def symtab_checks(cls, vmlinux) -> bool: return vmlinux.has_type('printk_log') @@ -207,20 +205,20 @@ class KmsgLegacy(ABCKmsg): yield " " + chunk.decode() def run(self) -> Iterator[Tuple[str, str, str, str, str]]: - log_buf_ptr = self.vmlinux.object_from_symbol(symbol_name='log_buf') + log_buf_ptr = self.vmlinux.object_from_symbol(symbol_name = 'log_buf') if log_buf_ptr == 0: # This is weird, let's fallback to check the static ringbuffer. - log_buf_ptr = self.vmlinux.object_from_symbol(symbol_name='__log_buf').vol.offset + log_buf_ptr = self.vmlinux.object_from_symbol(symbol_name = '__log_buf').vol.offset if log_buf_ptr == 0: raise ValueError("Log buffer is not available") - log_first_idx = int(self.vmlinux.object_from_symbol(symbol_name='log_first_idx')) + log_first_idx = int(self.vmlinux.object_from_symbol(symbol_name = 'log_first_idx')) cur_idx = log_first_idx end_idx = None # We don't need log_next_idx here. See below msg.len == 0 while cur_idx != end_idx: end_idx = log_first_idx msg_offset = log_buf_ptr + cur_idx # type: ignore - msg = self.vmlinux.object(object_type='printk_log', offset=msg_offset) + msg = self.vmlinux.object(object_type = 'printk_log', offset = msg_offset) if msg.len == 0: # As per kernel/printk/printk.c: # A length == 0 for the next message indicates a wrap-around to @@ -273,6 +271,7 @@ class KmsgFiveTen(ABCKmsg): See printk.c and printk_ringbuffer.c in kernel/printk/ folder for more details. """ + @classmethod def symtab_checks(cls, vmlinux) -> bool: return vmlinux.has_symbol('prb') @@ -318,20 +317,20 @@ class KmsgFiveTen(ABCKmsg): def run(self) -> Iterator[Tuple[str, str, str, str, str]]: # static struct printk_ringbuffer *prb = &printk_rb_static; - ringbuffers = self.vmlinux.object_from_symbol(symbol_name='prb').dereference() + ringbuffers = self.vmlinux.object_from_symbol(symbol_name = 'prb').dereference() desc_ring = ringbuffers.desc_ring text_data_ring = ringbuffers.text_data_ring desc_count = 1 << desc_ring.count_bits - desc_arr = self.vmlinux.object(object_type="array", - offset=desc_ring.descs, - subtype=self.vmlinux.get_type("prb_desc"), - count=desc_count) - info_arr = self.vmlinux.object(object_type="array", - offset=desc_ring.infos, - subtype=self.vmlinux.get_type("printk_info"), - count=desc_count) + desc_arr = self.vmlinux.object(object_type = "array", + offset = desc_ring.descs, + subtype = self.vmlinux.get_type("prb_desc"), + count = desc_count) + info_arr = self.vmlinux.object(object_type = "array", + offset = desc_ring.infos, + subtype = self.vmlinux.get_type("printk_info"), + count = desc_count) # See kernel/printk/printk_ringbuffer.h desc_state_var_bytes_sz = self.long_unsigned_int_size @@ -371,15 +370,12 @@ class Kmsg(plugins.PluginInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.TranslationLayerRequirement(name='primary', - description="Memory layer for the kernel", - architectures=['Intel32', 'Intel64']), - requirements.SymbolTableRequirement(name='vmlinux', - description="Linux kernel symbols"), + requirements.ModuleRequirement(name = 'kernel', description = 'Linux kernel', + architectures = ['Intel32', 'Intel64']), ] def _generator(self) -> Iterator[Tuple[int, Tuple[str, str, str, str, str]]]: - for values in ABCKmsg.run_all(context=self.context, config=self.config): + for values in ABCKmsg.run_all(context = self.context, config = self.config): yield (0, values) def run(self): diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index a871ebed9..7b70db4ba 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -25,7 +25,8 @@ class Lsmod(plugins.PluginInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.ModuleRequirement(name = 'vmlinux', architectures = ["Intel32", "Intel64"]), + requirements.ModuleRequirement(name = 'kernel', description = 'Linux kernel', + architectures = ["Intel32", "Intel64"]), ] @classmethod @@ -54,7 +55,7 @@ class Lsmod(plugins.PluginInterface): def _generator(self): try: - for module in self.list_modules(self.context, self.config['vmlinux']): + for module in self.list_modules(self.context, self.config['kernel']): mod_size = module.get_init_size() + module.get_core_size() diff --git a/volatility3/framework/plugins/linux/lsof.py b/volatility3/framework/plugins/linux/lsof.py index 3b21d9682..b452bf0ba 100644 --- a/volatility3/framework/plugins/linux/lsof.py +++ b/volatility3/framework/plugins/linux/lsof.py @@ -24,7 +24,8 @@ class Lsof(plugins.PluginInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.ModuleRequirement(name = 'vmlinux', architectures = ["Intel32", "Intel64"]), + requirements.ModuleRequirement(name = 'kernel', description = 'Linux kernel', + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.VersionRequirement(name = 'linuxutils', component = linux.LinuxUtilities, version = (2, 0, 0)), requirements.ListRequirement(name = 'pid', @@ -34,7 +35,7 @@ class Lsof(plugins.PluginInterface): ] def _generator(self, tasks): - vmlinux = self.context.modules[self.config['vmlinux']] + vmlinux = self.context.modules[self.config['kernel']] symbol_table = None for task in tasks: @@ -56,5 +57,5 @@ class Lsof(plugins.PluginInterface): return renderers.TreeGrid([("PID", int), ("Process", str), ("FD", int), ("Path", str)], self._generator( pslist.PsList.list_tasks(self.context, - self.config['vmlinux'], + self.config['kernel'], filter_func = filter_func))) diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py index c7fbd9ad1..fcfd68855 100644 --- a/volatility3/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -20,7 +20,8 @@ class Malfind(interfaces.plugins.PluginInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.ModuleRequirement(name = 'vmlinux', architectures = ["Intel32", "Intel64"]), + requirements.ModuleRequirement(name = 'kernel', description = 'Linux kernel', + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', @@ -45,8 +46,8 @@ class Malfind(interfaces.plugins.PluginInterface): def _generator(self, tasks): # determine if we're on a 32 or 64 bit kernel - if self.context.symbol_space.get_type( - self.config["vmlinux.symbol_table_name"] + constants.BANG + "pointer").size == 4: + vmlinux = self.context.modules[self.config['kernel']] + if self.context.symbol_space.get_type(vmlinux.symbol_table_name + constants.BANG + "pointer").size == 4: is_32bit_arch = True else: is_32bit_arch = False diff --git a/volatility3/framework/plugins/linux/proc.py b/volatility3/framework/plugins/linux/proc.py index 893646d04..2c4cd2aff 100644 --- a/volatility3/framework/plugins/linux/proc.py +++ b/volatility3/framework/plugins/linux/proc.py @@ -21,7 +21,8 @@ class Maps(plugins.PluginInterface): def get_requirements(cls): # Since we're calling the plugin, make sure we have the plugin's requirements return [ - requirements.ModuleRequirement(name = 'vmlinux', architectures = ["Intel32", "Intel64"]), + requirements.ModuleRequirement(name = 'kernel', description = 'Linux kernel', + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', @@ -65,5 +66,5 @@ class Maps(plugins.PluginInterface): ("File Path", str)], self._generator( pslist.PsList.list_tasks(self.context, - self.config['vmlinux'], + self.config['kernel'], filter_func = filter_func))) diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index 02d5118c2..ed7374f2f 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -18,7 +18,8 @@ class PsList(interfaces.plugins.PluginInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.ModuleRequirement(name = 'vmlinux', architectures = ["Intel32", "Intel64"]), + requirements.ModuleRequirement(name = 'kernel', description = 'Linux kernel', + architectures = ["Intel32", "Intel64"]), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, @@ -49,7 +50,7 @@ class PsList(interfaces.plugins.PluginInterface): def _generator(self): for task in self.list_tasks(self.context, - self.config['vmlinux'], + self.config['kernel'], filter_func = self.create_pid_filter(self.config.get('pid', None))): pid = task.pid ppid = 0 diff --git a/volatility3/framework/plugins/linux/pstree.py b/volatility3/framework/plugins/linux/pstree.py index 2f11cf5ec..9b24c27f7 100644 --- a/volatility3/framework/plugins/linux/pstree.py +++ b/volatility3/framework/plugins/linux/pstree.py @@ -34,8 +34,8 @@ class PsTree(pslist.PsList): def _generator(self): """Generates the.""" - for proc in self.list_tasks(self.context, self.config['vmlinux.layer_name'], - self.config['vmlinux.symbol_table_name']): + vmlinux = self.context.modules[self.config['kernel']] + for proc in self.list_tasks(self.context, vmlinux.layer_name, vmlinux.symbol_table_name): self._processes[proc.pid] = proc # Build the child/level maps diff --git a/volatility3/framework/plugins/linux/tty_check.py b/volatility3/framework/plugins/linux/tty_check.py index f4a4a2820..8c0662ca7 100644 --- a/volatility3/framework/plugins/linux/tty_check.py +++ b/volatility3/framework/plugins/linux/tty_check.py @@ -24,13 +24,14 @@ class tty_check(plugins.PluginInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.ModuleRequirement(name = 'vmlinux', architectures = ["Intel32", "Intel64"]), + requirements.ModuleRequirement(name = 'kernel', description = 'Linux kernel', + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (2, 0, 0)), requirements.VersionRequirement(name = 'linuxutils', component = linux.LinuxUtilities, version = (2, 0, 0)) ] def _generator(self): - vmlinux = self.context.modules[self.config['vmlinux']] + vmlinux = self.context.modules[self.config['kernel']] modules = lsmod.Lsmod.list_modules(self.context, vmlinux.name)