From dc91a16a2f0132372c58992cfdb45cd297f52d7a Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Dec 2018 12:05:46 -0600 Subject: [PATCH] update check syscall --- volatility/plugins/linux/check_syscall.py | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/volatility/plugins/linux/check_syscall.py b/volatility/plugins/linux/check_syscall.py index 348859407..c85efdb6d 100644 --- a/volatility/plugins/linux/check_syscall.py +++ b/volatility/plugins/linux/check_syscall.py @@ -5,10 +5,11 @@ import logging from volatility.framework import renderers, constants from volatility.framework.automagic import linux +from volatility.framework.interfaces import plugins from volatility.framework.renderers import format_hints from volatility.framework.objects import utility from volatility.framework import exceptions -from volatility.plugins.linux import lsmod +from volatility.framework.configuration import requirements vollog = logging.getLogger(__name__) @@ -19,9 +20,17 @@ try: except ImportError: has_capstone = False -class Check_syscall(lsmod.Lsmod): +class Check_syscall(plugins.PluginInterface): """Check system call table for hooks""" + @classmethod + def get_requirements(cls): + return [requirements.TranslationLayerRequirement(name = 'primary', + description = 'Kernel Address Space', + architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "vmlinux", + description = "Linux Kernel")] + def _get_table_size_next_symbol(self, table_addr, ptr_sz, vmlinux): """ Returns the size of the table based on the next symbol @@ -157,7 +166,7 @@ class Check_syscall(lsmod.Lsmod): symbols = list(self.context.symbol_space.get_symbols_by_location(call_addr)) if len(symbols) > 0: - sym_name = str(symbols[0]) + sym_name = str(symbols[0].split("!")[1]) else: sym_name = "UNKNOWN"