From a3069a3192b7c704954ee2be29cc8383e5bf36ba Mon Sep 17 00:00:00 2001
From: Andrew Case <andrew@dfir.org>
Date: Thu, 27 Mar 2025 20:06:09 -0500
Subject: [PATCH] Fix hidden_modules to actually list hidden modules...

---
 .../framework/plugins/linux/hidden_modules.py | 60 +++++++++----------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py
index 38bddc9d8..136aafdd9 100644
--- a/volatility3/framework/plugins/linux/hidden_modules.py
+++ b/volatility3/framework/plugins/linux/hidden_modules.py
@@ -17,8 +17,35 @@ vollog = logging.getLogger(__name__)
 class Hidden_modules(plugins.PluginInterface):
     """Carves memory to find hidden kernel modules"""
 
-    _required_framework_version = (2, 10, 0)
-    _version = (3, 0, 1)
+    _required_framework_version = (2, 25, 0)
+    _version = (3, 0, 2)
+
+    @classmethod
+    def find_hidden_modules(
+        cls, context, vmlinux_module_name: str
+    ) -> extensions.module:
+        if context.symbol_space.verify_table_versions(
+            "dwarf2json", lambda version, _: (not version) or version < (0, 8, 0)
+        ):
+            raise exceptions.SymbolSpaceError(
+                "Invalid symbol table, please ensure the ISF table produced by dwarf2json was created with version 0.8.0 or later"
+            )
+
+        known_module_addresses = cls.get_lsmod_module_addresses(
+            context, vmlinux_module_name
+        )
+        modules_memory_boundaries = (
+            linux_utilities_modules.Modules.get_modules_memory_boundaries(
+                context, vmlinux_module_name
+            )
+        )
+
+        yield from linux_utilities_modules.Modules.get_hidden_modules(
+            context,
+            vmlinux_module_name,
+            known_module_addresses,
+            modules_memory_boundaries,
+        )
 
     @classmethod
     def get_hidden_modules(
@@ -56,7 +83,7 @@ class Hidden_modules(plugins.PluginInterface):
 
     run = linux_utilities_modules.ModuleDisplayPlugin.run
     _generator = linux_utilities_modules.ModuleDisplayPlugin.generator
-    implementation = linux_utilities_modules.Modules.list_modules
+    implementation = find_hidden_modules
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -163,30 +190,3 @@ class Hidden_modules(plugins.PluginInterface):
             )
         }
         return known_module_addresses
-
-    @classmethod
-    def find_hidden_modules(
-        cls, context, vmlinux_module_name: str
-    ) -> extensions.module:
-        if context.symbol_space.verify_table_versions(
-            "dwarf2json", lambda version, _: (not version) or version < (0, 8, 0)
-        ):
-            raise exceptions.SymbolSpaceError(
-                "Invalid symbol table, please ensure the ISF table produced by dwarf2json was created with version 0.8.0 or later"
-            )
-
-        known_module_addresses = cls.get_lsmod_module_addresses(
-            context, vmlinux_module_name
-        )
-        modules_memory_boundaries = (
-            linux_utilities_modules.Modules.get_modules_memory_boundaries(
-                context, vmlinux_module_name
-            )
-        )
-
-        yield from linux_utilities_modules.Modules.get_hidden_modules(
-            context,
-            vmlinux_module_name,
-            known_module_addresses,
-            modules_memory_boundaries,
-        )