mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-12 12:47:39 +02:00
black formatting
This commit is contained in:
@@ -11,12 +11,7 @@ from typing import (
|
||||
)
|
||||
|
||||
from volatility3 import framework
|
||||
from volatility3.framework import (
|
||||
interfaces,
|
||||
exceptions,
|
||||
symbols,
|
||||
deprecation
|
||||
)
|
||||
from volatility3.framework import interfaces, exceptions, symbols, deprecation
|
||||
from volatility3.framework.constants import linux as linux_constants
|
||||
from volatility3.framework.symbols.linux import extensions
|
||||
|
||||
@@ -35,6 +30,7 @@ vollog = logging.getLogger(__name__)
|
||||
|
||||
# ModuleExtract.extract_module is the entry point and only visible method for plugins
|
||||
|
||||
|
||||
# See PR #1773
|
||||
@deprecation.renamed_class(
|
||||
deprecated_class_name="ModuleExtract",
|
||||
|
||||
@@ -25,7 +25,7 @@ from volatility3.framework import (
|
||||
interfaces,
|
||||
objects,
|
||||
renderers,
|
||||
symbols
|
||||
symbols,
|
||||
)
|
||||
from volatility3.framework.configuration import requirements
|
||||
from volatility3.framework.objects import utility
|
||||
@@ -784,6 +784,7 @@ class Modules(interfaces.configuration.VersionableInterface):
|
||||
|
||||
yield name, value
|
||||
|
||||
|
||||
# This module is responsible for producing an ELF file of a kernel module (LKM) loaded in memory
|
||||
# This extraction task is quite complicated as the Linux kernel discards the ELF header at load time
|
||||
# Due to this, to support static analysis, we must create an ELF header and proper file based on the sections
|
||||
@@ -795,6 +796,7 @@ class Modules(interfaces.configuration.VersionableInterface):
|
||||
# Not having the .shstrtab makes analysis impossible-to-difficult for static analysis tools. To work around this,
|
||||
# we create the .shstrtab based on the sections in memory and then glue it in as the final section
|
||||
|
||||
|
||||
# ModuleExtract.extract_module is the entry point and only visible method for plugins
|
||||
class ModuleExtract(interfaces.configuration.VersionableInterface):
|
||||
"""Extracts Linux kernel module structures into an analyzable ELF file"""
|
||||
@@ -1010,10 +1012,8 @@ class ModuleExtract(interfaces.configuration.VersionableInterface):
|
||||
"""
|
||||
kernel = context.modules[vmlinux_name]
|
||||
kernel_layer = context.layers[kernel.layer_name]
|
||||
modules_addr_min, modules_addr_max = (
|
||||
Modules.get_modules_memory_boundaries(
|
||||
context, vmlinux_name
|
||||
)
|
||||
modules_addr_min, modules_addr_max = Modules.get_modules_memory_boundaries(
|
||||
context, vmlinux_name
|
||||
)
|
||||
modules_addr_min &= kernel_layer.address_mask
|
||||
modules_addr_max &= kernel_layer.address_mask
|
||||
@@ -1509,6 +1509,7 @@ class ModuleExtract(interfaces.configuration.VersionableInterface):
|
||||
# Return our beautiful, hand-crafted, farm raised ELF file
|
||||
return header + sections_data + sections_headers
|
||||
|
||||
|
||||
class ModuleGathererLsmod(ModuleGathererInterface):
|
||||
"""
|
||||
Gathers modules from the main kernel list
|
||||
|
||||
Reference in New Issue
Block a user