WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-authored-by: ikelos <ikelos@users.noreply.github.com>
This commit is contained in:
Eve
2025-12-31 12:22:48 +00:00
committed by GitHub
co-authored by ikelos
parent c47ab6ba11
commit f11347739b
1 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/sockscan.py
+9 -9
View File
@@ -117,14 +117,14 @@ class Sockscan(plugins.PluginInterface):
and will warn the user if multiple layers are found.
Args:
symbol_table_name: The name of the kernel module on which to operate.
kernel_module_name: The name of the kernel module on which to operate.
Returns:
memory_layer_name: The name of the layer below the kernel to be scanned.
"""
# get vmlinux module from context in order to build objects and read symbols
vmlinux = self.context.modules[symbol_table_name]
vmlinux = self.context.modules[kernel_module_name]
# get kernel layer from context so that it's dependencies can be found, and therefore scanned.
# kernel layer will be virtual and built ontop of a physical layer.
@@ -150,16 +150,16 @@ class Sockscan(plugins.PluginInterface):
return memory_layer_name
def _find_file_ops_needles(self, symbol_table_name: str):
def _find_file_ops_needles(self, kernel_module_name: str):
# get vmlinux module from context in order to read symbols
vmlinux = self.context.modules[symbol_table_name]
vmlinux = self.context.modules[kernel_module_name]
file_ops_symbol_names = [
"socket_file_ops",
"sockfs_dentry_operations",
]
file_ops_needles = self._canonicalize_symbol_addrs(
symbol_table_name, file_ops_symbol_names
kernel_module_name, file_ops_symbol_names
)
# get file struct to find the offset to the f_op pointer
# this is so that the file object can be created at the correct offset,
@@ -168,9 +168,9 @@ class Sockscan(plugins.PluginInterface):
return (file_ops_needles, f_op_offset)
def _find_sk_destruct_needles(self, symbol_table_name: str):
def _find_sk_destruct_needles(self, kernel_module_name: str):
# get vmlinux module from context in order to read symbols
vmlinux = self.context.modules[symbol_table_name]
vmlinux = self.context.modules[kernel_module_name]
socket_destructor_symbol_names = [
"sock_def_destruct",
@@ -180,7 +180,7 @@ class Sockscan(plugins.PluginInterface):
"inet_sock_destruct",
]
socket_destructor_needles = self._canonicalize_symbol_addrs(
symbol_table_name, socket_destructor_symbol_names
kernel_module_name, socket_destructor_symbol_names
)
# get sock struct to find the offset to the sk_destruct pointer
# this is so that the sock object can be created at the correct offset,
@@ -191,7 +191,7 @@ class Sockscan(plugins.PluginInterface):
return (socket_destructor_needles, sk_destruct_offset)
def _walk_file_ops_needles(
self, symbol_table_name, memory_layer_name, needle_addr, f_op_offset
self, kernel_module_name, memory_layer_name, needle_addr, f_op_offset
):
vmlinux = self.context.modules[kernel_module_name]
try: