diff --git a/test/test_volatility.py b/test/test_volatility.py index bc63ab356..d5b59b15c 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -848,7 +848,7 @@ def test_linux_kallsyms(image, volatility, python): image, volatility, python, - pluginargs=["--only-modules"], + pluginargs=["--modules"], ) # linux-sample-1.bin has no hidden modules. # This validates that plugin requirements are met and exceptions are not raised. diff --git a/volatility3/framework/plugins/linux/kallsyms.py b/volatility3/framework/plugins/linux/kallsyms.py index c97fafbcf..c575c54e7 100644 --- a/volatility3/framework/plugins/linux/kallsyms.py +++ b/volatility3/framework/plugins/linux/kallsyms.py @@ -19,8 +19,8 @@ class Kallsyms(plugins.PluginInterface): """Kallsyms symbols enumeration plugin. If no arguments are provided, all symbols are included: core, modules, ftrace, and BPF. - Alternatively, you can use any combination of --only-core, --only-modules, --only-ftrace, - and --only-bpf to customize the output. + Alternatively, you can use any combination of --core, --modules, --ftrace, and --bpf + to customize the output. """ _required_framework_version = (2, 19, 0) @@ -39,26 +39,26 @@ class Kallsyms(plugins.PluginInterface): name="Kallsyms", component=kallsyms.Kallsyms, version=(1, 0, 0) ), requirements.BooleanRequirement( - name="only_core", + name="core", description="Include core symbols", default=False, optional=True, ), requirements.BooleanRequirement( - name="only_modules", + name="modules", description="Include module symbols", default=False, optional=True, ), requirements.BooleanRequirement( - name="only_ftrace", + name="ftrace", description="Include ftrace symbols", default=False, optional=True, ), requirements.BooleanRequirement( - name="only_bpf", - description="Include bpf symbols", + name="bpf", + description="Include BPF symbols", default=False, optional=True, ), @@ -85,23 +85,23 @@ class Kallsyms(plugins.PluginInterface): module_name=self.config["kernel"], ) - only_core = self.config.get("only_core", False) - only_modules = self.config.get("only_modules", False) - only_ftrace = self.config.get("only_ftrace", False) - only_bpf = self.config.get("only_bpf", False) + include_core = self.config.get("core", False) + include_modules = self.config.get("modules", False) + include_ftrace = self.config.get("ftrace", False) + include_bpf = self.config.get("bpf", False) - symbols_flags = (only_core, only_modules, only_ftrace, only_bpf) + symbols_flags = (include_core, include_modules, include_ftrace, include_bpf) if not any(symbols_flags): - only_core = only_modules = only_ftrace = only_bpf = True + include_core = include_modules = include_ftrace = include_bpf = True symbol_geneators = [] - if only_core: + if include_core: symbol_geneators.append(kas.get_core_symbols()) - if only_modules: + if include_modules: symbol_geneators.append(kas.get_modules_symbols()) - if only_ftrace: + if include_ftrace: symbol_geneators.append(kas.get_ftrace_symbols()) - if only_bpf: + if include_bpf: symbol_geneators.append(kas.get_bpf_symbols()) for symbols_generator in symbol_geneators: