From e1b343a284436ee4d92a7b8a6daf0a98dd01fdeb Mon Sep 17 00:00:00 2001
From: Abyss Watcher <abyss-w4tcher@proton.me>
Date: Thu, 31 Oct 2024 12:33:54 +0100
Subject: [PATCH] add module taints parsing apis

---
 .../symbols/linux/extensions/__init__.py      | 82 +++++++++++++++++++
 1 file changed, 82 insertions(+)

diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index aa3e8c675..89e2cde27 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -279,6 +279,77 @@ class module(generic.GenericIntelProcess):
 
         return None
 
+    def _module_flags_taints_pre_4_10_rc1(self) -> str:
+        """Convert the module's taints value to a 1-1 character mapping.
+        Relies on statically defined taints mappings in the framework.
+
+        Returns:
+            The raw taints string.
+        """
+        taints_string = ""
+        for char, infos in linux_constants.TAINT_FLAGS.items():
+            if infos["module"] and self.taints_value & infos["shift"]:
+                taints_string += char
+
+        return taints_string
+
+    def _module_flags_taints_post_4_10_rc1(self) -> str:
+        """Convert the module's taints value to a 1-1 character mapping.
+        Relies on kernel symbol embedded taints definitions.
+
+            struct taint_flag {
+                char c_true;		/* character printed when tainted */
+                char c_false;		/* character printed when not tainted */
+                bool module;		/* also show as a per-module taint flag */
+            };
+
+        Returns:
+            The raw taints string.
+        """
+        taints_string = ""
+        for i, taint_flag in enumerate(self.taint_flags_list):
+            c_true = chr(taint_flag.c_true)
+            c_false = chr(taint_flag.c_false)
+            if taint_flag.module and (self.taints_value & (1 << i)):
+                taints_string += c_true
+            elif taint_flag.module and c_false != " ":
+                taints_string += c_false
+
+        return taints_string
+
+    def get_taints_as_plain_string(self) -> str:
+        """Convert the module's taints value to a 1-1 character mapping.
+
+        Returns:
+            The raw taints string.
+
+        Documentation:
+            - module_flags_taint kernel function
+        """
+
+        if self.taint_flags_list:
+            return self._module_flags_taints_post_4_10_rc1()
+        return self._module_flags_taints_pre_4_10_rc1()
+
+    def get_taints_parsed(self) -> List[str]:
+        """Convert the module's taints string to a 1-1 descriptor mapping.
+
+        Returns:
+            A comprehensive (user-friendly) taint descriptor list.
+
+        Documentation:
+            - module_flags_taint kernel function
+        """
+        comprehensive_taints = []
+        for c in self.get_taints_as_plain_string():
+            infos = linux_constants.TAINT_FLAGS.get(c)
+            if not infos:
+                comprehensive_taints.append(f"<UNKNOWN_TAINT_CHAR_{c}>")
+            elif infos["when_present"]:
+                comprehensive_taints.append(infos["desc"])
+
+        return comprehensive_taints
+
     @property
     def section_symtab(self):
         if self.has_member("kallsyms"):
@@ -307,6 +378,17 @@ class module(generic.GenericIntelProcess):
             return self.strtab
         raise AttributeError("module -> strtab: Unable to get strtab")
 
+    @property
+    def taints_value(self) -> int:
+        return self.taints
+
+    @property
+    def taint_flags_list(self) -> Optional[List[interfaces.objects.ObjectInterface]]:
+        kernel = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self)
+        if kernel.has_symbol("taint_flags"):
+            return list(kernel.object_from_symbol("taint_flags"))
+        return None
+
 
 class task_struct(generic.GenericIntelProcess):
     def add_process_layer(