From 2d4e0f66d87cdce6a3d75db6df8b566c83409669 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 01:09:52 +0000 Subject: [PATCH 1/2] Update fbdev plugin to gracefully handle old/broken symbol tables --- .../framework/plugins/linux/graphics/fbdev.py | 20 ++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/linux/graphics/fbdev.py b/volatility3/framework/plugins/linux/graphics/fbdev.py index 7b644eccf..d436bbcb9 100644 --- a/volatility3/framework/plugins/linux/graphics/fbdev.py +++ b/volatility3/framework/plugins/linux/graphics/fbdev.py @@ -255,22 +255,28 @@ You can try using ffmpeg to decode the raw buffer. Example usage: vollog.error( "PIL (pillow) module is required to use this plugin. Please install it manually or through pyproject.toml." ) - return None + return kernel_name = self.config["kernel"] kernel = self.context.modules[kernel_name] if not kernel.has_symbol("num_registered_fb"): - raise exceptions.SymbolError( - "num_registered_fb", - kernel.symbol_table_name, - "The provided symbol does not exist in the symbol table. This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt.", + vollog.error( + '"num_registered_fb" symbol does not exist in the symbol table. This means you are either analyzing an unsupported kernel version, your symbol table is corrupt, or the fbdev driver is compiled as a kernel module..' ) + return + + try: + num_registered_fb = kernel.object_from_symbol("num_registered_fb") + except exceptions.SymbolError: + vollog.error( + 'Creating an object from "num_registered_fb" caused a symbol error. This is a sign that the symbol table is outdated. Please re-generate your symbol table using the latest dwarf2json' + ) + return - num_registered_fb = kernel.object_from_symbol("num_registered_fb") if num_registered_fb < 1: vollog.info("No registered framebuffer in the fbdev API.") - return None + return registered_fb = kernel.object_from_symbol("registered_fb") fb_info_list = utility.array_of_pointers( From 6c96ffacddc0bc3ad461b1fd1042e572ec5d344a Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 01:13:03 +0000 Subject: [PATCH 2/2] Update fbdev plugin to gracefully handle old/broken symbol tables --- volatility3/framework/plugins/linux/graphics/fbdev.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/graphics/fbdev.py b/volatility3/framework/plugins/linux/graphics/fbdev.py index d436bbcb9..f7cde1bf0 100644 --- a/volatility3/framework/plugins/linux/graphics/fbdev.py +++ b/volatility3/framework/plugins/linux/graphics/fbdev.py @@ -262,7 +262,7 @@ You can try using ffmpeg to decode the raw buffer. Example usage: if not kernel.has_symbol("num_registered_fb"): vollog.error( - '"num_registered_fb" symbol does not exist in the symbol table. This means you are either analyzing an unsupported kernel version, your symbol table is corrupt, or the fbdev driver is compiled as a kernel module..' + '"num_registered_fb" symbol does not exist in the symbol table. This means you are either analyzing an unsupported kernel version, your symbol table is corrupt, or the fbdev driver is compiled as a kernel module.' ) return