From ddec0d482ddc152629a0a884b06fdd4f1d7385bd Mon Sep 17 00:00:00 2001 From: Matt Tressler Date: Mon, 27 Jul 2020 10:46:23 -0400 Subject: [PATCH] added kernel string to linux constants file; changed automagic methods so that they reconstruct the kernel object within the method for consistancy with other methods --- volatility/framework/automagic/linux.py | 8 +++++--- volatility/framework/constants/linux/__init__.py | 2 ++ volatility/framework/plugins/linux/tty_check.py | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index b2a35df93..26830c6a8 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -152,13 +152,15 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): cls, context: interfaces.context.ContextInterface, layer_name: str, - kernel, # ikelos - how to type this?? + kernel_name, # ikelos - how to type this?? mods_list: Iterator[interfaces.objects.ObjectInterface]) -> List[Tuple[str, int, int]]: """ A helper function that gets the beginning and end address of the kernel module """ + kernel = contexts.Module(context, kernel_name, layer_name, 0) + mask = context.layers[layer_name].address_mask start_addr = kernel.object_from_symbol("_text") @@ -167,7 +169,7 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): end_addr = kernel.object_from_symbol("_etext") end_addr = end_addr.vol.offset & mask - return [("__kernel__", start_addr, end_addr)] + \ + return [(constants.linux.KERNEL_NAME, start_addr, end_addr)] + \ LinuxUtilities.mask_mods_list(context, layer_name, mods_list) @classmethod @@ -184,7 +186,7 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): for name, start, end in handlers: if start <= target_address <= end: mod_name = name - if name == "__kernel__": + if name == constants.linux.KERNEL_NAME: symbols = list( context.symbol_space.get_symbols_by_location(target_address)) diff --git a/volatility/framework/constants/linux/__init__.py b/volatility/framework/constants/linux/__init__.py index 8b614b55f..c25ea0e2f 100644 --- a/volatility/framework/constants/linux/__init__.py +++ b/volatility/framework/constants/linux/__init__.py @@ -6,6 +6,8 @@ Linux-specific values that aren't found in debug symbols """ +KERNEL_NAME = "__kernel__" + # arch/x86/include/asm/page_types.h PAGE_SHIFT = 12 """The value hard coded from the Linux Kernel (hence not extracted from the layer itself)""" diff --git a/volatility/framework/plugins/linux/tty_check.py b/volatility/framework/plugins/linux/tty_check.py index 641838d34..c061249a9 100644 --- a/volatility/framework/plugins/linux/tty_check.py +++ b/volatility/framework/plugins/linux/tty_check.py @@ -37,7 +37,7 @@ class tty_check(plugins.PluginInterface): modules = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['vmlinux']) - handlers = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'], vmlinux, modules) + handlers = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'], self.config['vmlinux'], modules) try: tty_drivers = vmlinux.object_from_symbol("tty_drivers")