Minor changes 2

This commit is contained in:
tvanegro
2025-06-17 11:33:44 +02:00
parent 96fe242c9d
commit ba9e13698d
2 changed files with 5 additions and 6 deletions
@@ -38,12 +38,12 @@ class Malfind(interfaces.plugins.PluginInterface):
optional=True,
),
requirements.IntRequirement(
name="dump_size",
name="dump-size",
description="Amount of bytes to dump for each dirty region/page found - Default 64 bytes",
optional=True,
),
requirements.BooleanRequirement(
name="dump_page",
name="dump-page",
description="Dump each dirty page and content - Default off",
optional=True,
),
@@ -62,12 +62,12 @@ class Malfind(interfaces.plugins.PluginInterface):
proc_layer = self.context.layers[proc_layer_name]
# Allowing a dump_size of 0 (no dump)
dump_size = self.config.get("dump_size") if self.config.get("dump_size") is not None else 64
dump_size = self.config.get("dump-size") if self.config.get("dump-size") is not None else 64
# Dumping page defaults to off, as in case a whole r-xp region is dirty
# this would likely dump 1000's of pages which might not always be wise nor necessary
dump_page = self.config.get("dump_page") or False
dump_page = self.config.get("dump-page") or False
for vma in task.mm.get_vma_iter():
vma_name = vma.get_name(self.context, task)
@@ -1284,7 +1284,7 @@ class vm_area_struct(objects.StructType):
for i in range(self.vm_start, self.vm_end, proclayer.page_size):
try:
if proclayer.is_dirty(i):
vollog.warning(
vollog.debug(
f"Found malicious (dirty+exec) page at {hex(i)} !"
)
malicious_pages.append(i)
@@ -2757,7 +2757,6 @@ class page(objects.StructType):
for name, value in self.pageflags_enum.items():
if self.flags & (1 << value) != 0:
flags.append(name)
print(name,value)
return flags