From 106b3b3dd0849194c4b83b9e254365b0c8f6070c Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 12 Nov 2024 16:01:04 +1100 Subject: [PATCH 1/4] Linux: PageCache: Fix inode offset when logging an error --- volatility3/framework/plugins/linux/pagecache.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 81e1f3601..005fc9acc 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -454,7 +454,7 @@ class InodePages(plugins.PluginInterface): if current_fp + len(page_bytes) > inode_size: vollog.error( "Page out of file bounds: inode 0x%x, inode size %d, page index %d", - inode.vol.object, + inode.vol.offset, inode_size, page_idx, ) From 3216700d8b6b0488f4a7431d6c1d940fc5299f24 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 12 Nov 2024 16:05:59 +1100 Subject: [PATCH 2/4] Linux: module object extension: Fix recursion call issue --- volatility3/framework/symbols/linux/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index d05c34304..bc8e25105 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -294,7 +294,7 @@ class module(generic.GenericIntelProcess): if self.has_member("kallsyms"): return int(self.kallsyms.num_symtab) elif self.has_member("num_symtab"): - return int(self.num_symtab) + return int(self.member("num_symtab")) raise AttributeError( "module -> num_symtab: Unable to determine number of symbols" ) From a2e99b2633a0099e19bbb5692d7919a9e5cd17cd Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 12 Nov 2024 16:13:50 +1100 Subject: [PATCH 3/4] Linux: Object extensions: Fix type annotations for improved clarity and accuracy. --- .../framework/symbols/linux/extensions/__init__.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index bc8e25105..41d764f94 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -240,7 +240,7 @@ class module(generic.GenericIntelProcess): for sym in syms: yield sym - def get_symbols_names_and_addresses(self) -> Tuple[str, int]: + def get_symbols_names_and_addresses(self) -> Iterable[Tuple[str, int]]: """Get names and addresses for each symbol of the module Yields: @@ -1098,7 +1098,7 @@ class dentry(objects.StructType): current_dentry = current_dentry.d_parent return None - def get_subdirs(self) -> interfaces.objects.ObjectInterface: + def get_subdirs(self) -> Iterable[interfaces.objects.ObjectInterface]: """Walks dentry subdirs Yields: @@ -2435,7 +2435,7 @@ class inode(objects.StructType): """ return stat.filemode(self.i_mode) - def get_pages(self) -> interfaces.objects.ObjectInterface: + def get_pages(self) -> Iterable[interfaces.objects.ObjectInterface]: """Gets the inode's cached pages Yields: @@ -2643,7 +2643,7 @@ class IDR(objects.StructType): return idr_layer - def _old_kernel_get_entries(self) -> int: + def _old_kernel_get_entries(self) -> Iterable[int]: # Kernels < 4.11 cur = self.cur total = next_id = 0 @@ -2655,7 +2655,7 @@ class IDR(objects.StructType): next_id += 1 - def _new_kernel_get_entries(self) -> int: + def _new_kernel_get_entries(self) -> Iterable[int]: # Kernels >= 4.11 id_storage = linux.IDStorage.choose_id_storage( self._context, kernel_module_name="kernel" @@ -2663,7 +2663,7 @@ class IDR(objects.StructType): for page_addr in id_storage.get_entries(root=self.idr_rt): yield page_addr - def get_entries(self) -> int: + def get_entries(self) -> Iterable[int]: """Walks the IDR and yield a pointer associated with each element. Args: From 3a734fdeb159c8ff31b216b5ef1249d1dd4d3df7 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 12 Nov 2024 16:23:33 +1100 Subject: [PATCH 4/4] Linux: Object extensions: Remove redundant log message header; the logger handles this formatting. If needed, we can adjust the logger's format instead --- .../framework/symbols/linux/extensions/__init__.py | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 41d764f94..927f767e2 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -287,7 +287,7 @@ class module(generic.GenericIntelProcess): return self.kallsyms.symtab elif self.has_member("symtab"): return self.symtab - raise AttributeError("module -> symtab: Unable to get symtab") + raise AttributeError("Unable to get symtab") @property def num_symtab(self): @@ -295,9 +295,7 @@ class module(generic.GenericIntelProcess): return int(self.kallsyms.num_symtab) elif self.has_member("num_symtab"): return int(self.member("num_symtab")) - raise AttributeError( - "module -> num_symtab: Unable to determine number of symbols" - ) + raise AttributeError("Unable to determine number of symbols") @property def section_strtab(self): @@ -307,7 +305,7 @@ class module(generic.GenericIntelProcess): # Older kernels elif self.has_member("strtab"): return self.strtab - raise AttributeError("module -> strtab: Unable to get strtab") + raise AttributeError("Unable to get strtab") class task_struct(generic.GenericIntelProcess):