black formatting

This commit is contained in:
Abyss Watcher
2025-11-20 15:57:56 +01:00
parent b8e12bec29
commit e9ce095b29
2 changed files with 8 additions and 11 deletions
@@ -11,12 +11,7 @@ from typing import (
)
from volatility3 import framework
from volatility3.framework import (
interfaces,
exceptions,
symbols,
deprecation
)
from volatility3.framework import interfaces, exceptions, symbols, deprecation
from volatility3.framework.constants import linux as linux_constants
from volatility3.framework.symbols.linux import extensions
@@ -35,6 +30,7 @@ vollog = logging.getLogger(__name__)
# ModuleExtract.extract_module is the entry point and only visible method for plugins
# See PR #1773
@deprecation.renamed_class(
deprecated_class_name="ModuleExtract",
@@ -25,7 +25,7 @@ from volatility3.framework import (
interfaces,
objects,
renderers,
symbols
symbols,
)
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
@@ -784,6 +784,7 @@ class Modules(interfaces.configuration.VersionableInterface):
yield name, value
# This module is responsible for producing an ELF file of a kernel module (LKM) loaded in memory
# This extraction task is quite complicated as the Linux kernel discards the ELF header at load time
# Due to this, to support static analysis, we must create an ELF header and proper file based on the sections
@@ -795,6 +796,7 @@ class Modules(interfaces.configuration.VersionableInterface):
# Not having the .shstrtab makes analysis impossible-to-difficult for static analysis tools. To work around this,
# we create the .shstrtab based on the sections in memory and then glue it in as the final section
# ModuleExtract.extract_module is the entry point and only visible method for plugins
class ModuleExtract(interfaces.configuration.VersionableInterface):
"""Extracts Linux kernel module structures into an analyzable ELF file"""
@@ -1010,10 +1012,8 @@ class ModuleExtract(interfaces.configuration.VersionableInterface):
"""
kernel = context.modules[vmlinux_name]
kernel_layer = context.layers[kernel.layer_name]
modules_addr_min, modules_addr_max = (
Modules.get_modules_memory_boundaries(
context, vmlinux_name
)
modules_addr_min, modules_addr_max = Modules.get_modules_memory_boundaries(
context, vmlinux_name
)
modules_addr_min &= kernel_layer.address_mask
modules_addr_max &= kernel_layer.address_mask
@@ -1509,6 +1509,7 @@ class ModuleExtract(interfaces.configuration.VersionableInterface):
# Return our beautiful, hand-crafted, farm raised ELF file
return header + sections_data + sections_headers
class ModuleGathererLsmod(ModuleGathererInterface):
"""
Gathers modules from the main kernel list