WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Linux: update tests for sockscan

Browse Source
This commit is contained in:
eve
2025-04-24 09:16:23 +01:00
parent 1a57a66ce6
commit e55ab3313f
2 changed files with 34 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/plugins/linux/linux.py
+34
View File
@@ -615,3 +615,37 @@ class TestLinuxPscallstack:
rb"1\s+init\s+39\s+0x88001f999a40.*?0xffff81109039\s+do_select\s+T\s+kernel",
out,
)
class TestLinuxSockscan:
def test_linux_sockscan(image, volatility, python):
# designed for linux-sample-1.dmp SHA1:1C3A4627EDCA94A7ADE3414592BEF0E62D7D3BB6
image = LinuxSamples.LINUX_GENERIC.value.path
rc, out, err = test_volatility.runvol_plugin(
"linux.sockscan.Sockscan", image, volatility, python
)
# ensure that multiple unix paths for sockets have been found
assert (
len(
re.findall(
rb"(/[ -~]+?){1,8}",
out,
)
)
>= 10
)
# ensure that multiple IPv4 addresses have been found
assert (
len(
re.findall(
rb"((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}",
out,
)
)
>= 10
)
assert out.count(b"\n") >= 50
assert rc == 0
test/test_volatility.py
-29
View File
@@ -381,32 +381,3 @@ def test_mac_trustedbsd(image, volatility, python):
assert out.count(b"\n") > 10
assert rc == 0
def test_linux_sockscan(image, volatility, python):
# designed for linux-sample-1.dmp SHA1:1C3A4627EDCA94A7ADE3414592BEF0E62D7D3BB6
rc, out, err = runvol_plugin("linux.sockscan.Sockscan", image, volatility, python)
# ensure that multiple unix paths for sockets have been found
assert (
len(
re.findall(
rb"(/[ -~]+?){1,8}",
out,
)
)
>= 10
)
# ensure that multiple IPv4 addresses have been found
assert (
len(
re.findall(
rb"((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}",
out,
)
)
>= 10
)
assert out.count(b"\n") >= 50
assert rc == 0