From e9ce095b2924eb7d143aa7da24b79ed69850097b Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 20 Nov 2025 15:57:56 +0100 Subject: [PATCH] black formatting --- .../symbols/linux/utilities/module_extract.py | 8 ++------ .../framework/symbols/linux/utilities/modules.py | 11 ++++++----- 2 files changed, 8 insertions(+), 11 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index 3cc15085a..5ec254368 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -11,12 +11,7 @@ from typing import ( ) from volatility3 import framework -from volatility3.framework import ( - interfaces, - exceptions, - symbols, - deprecation -) +from volatility3.framework import interfaces, exceptions, symbols, deprecation from volatility3.framework.constants import linux as linux_constants from volatility3.framework.symbols.linux import extensions @@ -35,6 +30,7 @@ vollog = logging.getLogger(__name__) # ModuleExtract.extract_module is the entry point and only visible method for plugins + # See PR #1773 @deprecation.renamed_class( deprecated_class_name="ModuleExtract", diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 42383ecae..adacc54e3 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -25,7 +25,7 @@ from volatility3.framework import ( interfaces, objects, renderers, - symbols + symbols, ) from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility @@ -784,6 +784,7 @@ class Modules(interfaces.configuration.VersionableInterface): yield name, value + # This module is responsible for producing an ELF file of a kernel module (LKM) loaded in memory # This extraction task is quite complicated as the Linux kernel discards the ELF header at load time # Due to this, to support static analysis, we must create an ELF header and proper file based on the sections @@ -795,6 +796,7 @@ class Modules(interfaces.configuration.VersionableInterface): # Not having the .shstrtab makes analysis impossible-to-difficult for static analysis tools. To work around this, # we create the .shstrtab based on the sections in memory and then glue it in as the final section + # ModuleExtract.extract_module is the entry point and only visible method for plugins class ModuleExtract(interfaces.configuration.VersionableInterface): """Extracts Linux kernel module structures into an analyzable ELF file""" @@ -1010,10 +1012,8 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): """ kernel = context.modules[vmlinux_name] kernel_layer = context.layers[kernel.layer_name] - modules_addr_min, modules_addr_max = ( - Modules.get_modules_memory_boundaries( - context, vmlinux_name - ) + modules_addr_min, modules_addr_max = Modules.get_modules_memory_boundaries( + context, vmlinux_name ) modules_addr_min &= kernel_layer.address_mask modules_addr_max &= kernel_layer.address_mask @@ -1509,6 +1509,7 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): # Return our beautiful, hand-crafted, farm raised ELF file return header + sections_data + sections_headers + class ModuleGathererLsmod(ModuleGathererInterface): """ Gathers modules from the main kernel list