WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-05 01:07:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refactor SymbolRequirement to SymbolTableRequirement for clarity.

Browse Source
This commit is contained in:
Mike Auty
2019-02-06 21:26:32 +00:00
parent d23e6474ce
commit f898dca296
44 changed files with 67 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/linux/bash.py
+1 -1
View File
@@ -43,7 +43,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
]
def _generator(self, tasks):
volatility/framework/plugins/linux/check_afinfo.py
+3 -6
View File
@@ -41,7 +41,7 @@ class Check_afinfo(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
]
# returns whether the symbol is found within the kernel (system.map) or not
@@ -80,11 +80,8 @@ class Check_afinfo(plugins.PluginInterface):
def _generator(self):
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
vmlinux = contexts.Module(self.context,
self.config['vmlinux'],
self.config['primary'],
0,
absolute_symbol_addresses = True)
vmlinux = contexts.Module(
self.context, self.config['vmlinux'], self.config['primary'], 0, absolute_symbol_addresses = True)
op_members = vmlinux.get_type('file_operations').members
seq_members = vmlinux.get_type('seq_operations').members
volatility/framework/plugins/linux/check_syscall.py
+3 -6
View File
@@ -48,7 +48,7 @@ class Check_syscall(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
]
def _get_table_size_next_symbol(self, table_addr, ptr_sz, vmlinux):
@@ -145,11 +145,8 @@ class Check_syscall(plugins.PluginInterface):
def _generator(self):
linux.LinuxUtilities.aslr_mask_symbol_table(self.context, self.config['vmlinux'], self.config['primary'])
vmlinux = contexts.Module(self.context,
self.config['vmlinux'],
self.config['primary'],
0,
absolute_symbol_addresses = True)
vmlinux = contexts.Module(
self.context, self.config['vmlinux'], self.config['primary'], 0, absolute_symbol_addresses = True)
ptr_sz = vmlinux.get_type("pointer").size
if ptr_sz == 4:
volatility/framework/plugins/linux/elfs.py
+1 -1
View File
@@ -39,7 +39,7 @@ class Elfs(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
]
def _generator(self, tasks):
volatility/framework/plugins/linux/lsmod.py
+3 -7
View File
@@ -40,7 +40,7 @@ class Lsmod(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
]
@classmethod
@@ -48,12 +48,8 @@ class Lsmod(plugins.PluginInterface):
"""Lists all the modules in the primary layer"""
linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
vmlinux = contexts.Module(context,
vmlinux_symbols,
layer_name,
0,
absolute_symbol_addresses = True)
vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0, absolute_symbol_addresses = True)
modules = vmlinux.object(symbol_name = "modules").cast("list_head")
table_name = modules.vol.type_name.split(constants.BANG)[0]
volatility/framework/plugins/linux/lsof.py
+1 -1
View File
@@ -41,7 +41,7 @@ class Lsof(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
]
def _generator(self, tasks):
volatility/framework/plugins/linux/malfind.py
+1 -1
View File
@@ -38,7 +38,7 @@ class Malfind(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
]
def _list_injections(self, task):
volatility/framework/plugins/linux/proc.py
+1 -1
View File
@@ -38,7 +38,7 @@ class Maps(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
]
def _generator(self, tasks):
volatility/framework/plugins/linux/pslist.py
+3 -7
View File
@@ -35,7 +35,7 @@ class PsList(interfaces_plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols")
requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols")
]
@classmethod
@@ -74,12 +74,8 @@ class PsList(interfaces_plugins.PluginInterface):
"""Lists all the tasks in the primary layer"""
linux.LinuxUtilities.aslr_mask_symbol_table(context, vmlinux_symbols, layer_name)
vmlinux = contexts.Module(context,
vmlinux_symbols,
layer_name,
0,
absolute_symbol_addresses = True)
vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0, absolute_symbol_addresses = True)
init_task = vmlinux.object(symbol_name = "init_task")
for task in init_task.tasks: