WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-22 09:34:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

Linux: Shift linux plugins to using kernel as their default module

Browse Source
This commit is contained in:
Mike Auty
2021-08-25 15:48:53 +01:00
parent b90fd6bbb2
commit ad3560e1bc
16 changed files with 82 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/bash.py
+6 -4
View File
@@ -26,7 +26,8 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
return [
requirements.ModuleRequirement(name = 'vmlinux', architectures = ["Intel32", "Intel64"]),
requirements.ModuleRequirement(name = 'kernel', description = 'Linux kernel',
architectures = ["Intel32", "Intel64"]),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
requirements.ListRequirement(name = 'pid',
element_type = int,
@@ -35,7 +36,8 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
]
def _generator(self, tasks):
is_32bit = not symbols.symbol_table_is_64bit(self.context, self.config["vmlinux.symbol_table_name"])
vmlinux = self.context.modules[self.config["kernel"]]
is_32bit = not symbols.symbol_table_is_64bit(self.context, vmlinux.symbol_table_name)
if is_32bit:
pack_format = "I"
bash_json_file = "bash32"
@@ -90,7 +92,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
("Command", str)],
self._generator(
pslist.PsList.list_tasks(self.context,
self.config['vmlinux'],
self.config['kernel'],
filter_func = filter_func)))
def generate_timeline(self):
@@ -98,7 +100,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
for row in self._generator(
pslist.PsList.list_tasks(self.context,
self.config['vmlinux'],
self.config['kernel'],
filter_func = filter_func)):
_depth, row_data = row
description = f"{row_data[0]} ({row_data[1]}): \"{row_data[3]}\""