From b8e8fb6e92e403bfad4e52675e2737b9eb7ba49c Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 21 Jan 2025 18:37:04 +0100 Subject: [PATCH] initial split linux modules utilities --- .../symbols/linux/utilities/modules.py | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 volatility3/framework/symbols/linux/utilities/modules.py diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py new file mode 100644 index 000000000..bb8519643 --- /dev/null +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -0,0 +1,41 @@ +from volatility3 import framework +from volatility3.framework import interfaces +from volatility3.framework.symbols.linux import extensions, LinuxUtilities +from typing import Iterable, Optional + + +class Modules(interfaces.configuration.VersionableInterface): + """Kernel modules related utilities.""" + + _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) + + framework.require_interface_version(*_required_framework_version) + + @classmethod + def module_lookup_by_address( + cls, + context: interfaces.context.ContextInterface, + layer_name: str, + modules: Iterable[extensions.module], + target_address: int, + ) -> Optional[extensions.module]: + """ + Determine if a target address lies in a module memory space. + Returns the module where the provided address lies. + + Args: + context: The context on which to operate + layer_name: The name of the layer on which to operate + modules: An iterable containing the modules to match the address against + target_address: The address to check for a match + """ + + for module in modules: + _, start, end = LinuxUtilities.mask_mods_list( + context, layer_name, [module] + )[0] + if start <= target_address <= end: + return module + + return None