diff --git a/volatility3/framework/plugins/linux/malware/malfind.py b/volatility3/framework/plugins/linux/malware/malfind.py index 39d885f68..577c6c1e8 100644 --- a/volatility3/framework/plugins/linux/malware/malfind.py +++ b/volatility3/framework/plugins/linux/malware/malfind.py @@ -38,12 +38,12 @@ class Malfind(interfaces.plugins.PluginInterface): optional=True, ), requirements.IntRequirement( - name="dump_size", + name="dump-size", description="Amount of bytes to dump for each dirty region/page found - Default 64 bytes", optional=True, ), requirements.BooleanRequirement( - name="dump_page", + name="dump-page", description="Dump each dirty page and content - Default off", optional=True, ), @@ -62,12 +62,12 @@ class Malfind(interfaces.plugins.PluginInterface): proc_layer = self.context.layers[proc_layer_name] # Allowing a dump_size of 0 (no dump) - dump_size = self.config.get("dump_size") if self.config.get("dump_size") is not None else 64 + dump_size = self.config.get("dump-size") if self.config.get("dump-size") is not None else 64 # Dumping page defaults to off, as in case a whole r-xp region is dirty # this would likely dump 1000's of pages which might not always be wise nor necessary - dump_page = self.config.get("dump_page") or False + dump_page = self.config.get("dump-page") or False for vma in task.mm.get_vma_iter(): vma_name = vma.get_name(self.context, task) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 236d28bb1..94dfb0576 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1284,7 +1284,7 @@ class vm_area_struct(objects.StructType): for i in range(self.vm_start, self.vm_end, proclayer.page_size): try: if proclayer.is_dirty(i): - vollog.warning( + vollog.debug( f"Found malicious (dirty+exec) page at {hex(i)} !" ) malicious_pages.append(i) @@ -2757,7 +2757,6 @@ class page(objects.StructType): for name, value in self.pageflags_enum.items(): if self.flags & (1 << value) != 0: flags.append(name) - print(name,value) return flags