diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index 266c279da..c9b94fd3d 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -139,6 +139,7 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): return addr - 0xffffffff80000000 return addr - 0xc0000000 + class LinuxBannerCache(symbol_cache.SymbolBannerCache): """Caches the banners found in the Linux symbol files.""" diff --git a/volatility/framework/plugins/linux/keyboard_notifiers.py b/volatility/framework/plugins/linux/keyboard_notifiers.py index fe3ce4523..668c0d97a 100644 --- a/volatility/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility/framework/plugins/linux/keyboard_notifiers.py @@ -15,26 +15,24 @@ vollog = logging.getLogger(__name__) class Keyboard_notifiers(interfaces.plugins.PluginInterface): """Parses the keyboard notifier call chain""" - + @classmethod def get_requirements(cls): return [ - requirements.TranslationLayerRequirement(name='primary', - description='Memory layer for the kernel', - architectures=["Intel32", "Intel64"]), - requirements.SymbolTableRequirement( - name="vmlinux", description="Linux kernel symbols"), - requirements.PluginRequirement( - name='lsmod', plugin=lsmod.Lsmod, version=(1, 0, 0)) + requirements.TranslationLayerRequirement(name = 'primary', + description = 'Memory layer for the kernel', + architectures = ["Intel32", "Intel64"]), + requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), + requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] def _generator(self): - vmlinux = contexts.Module( - self.context, self.config['vmlinux'], self.config['primary'], 0) + vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0) modules = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['vmlinux']) - handlers = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'], self.config['vmlinux'], modules) + handlers = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'], + self.config['vmlinux'], modules) try: knl_addr = vmlinux.object_from_symbol("keyboard_notifier_list") @@ -48,7 +46,7 @@ class Keyboard_notifiers(interfaces.plugins.PluginInterface): "This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt." ) - knl = vmlinux.object(object_type="atomic_notifier_head", offset=knl_addr.vol.offset) + knl = vmlinux.object(object_type = "atomic_notifier_head", offset = knl_addr.vol.offset) for call_back in linux.LinuxUtilities.walk_internal_list(vmlinux, "notifier_block", "next", knl.head): call_addr = call_back.notifier_call @@ -57,6 +55,5 @@ class Keyboard_notifiers(interfaces.plugins.PluginInterface): yield (0, [format_hints.Hex(call_addr), module_name, symbol_name]) - def run(self): return renderers.TreeGrid([("Address", format_hints.Hex), ("Module", str), ("Symbol", str)], self._generator()) diff --git a/volatility/framework/plugins/linux/tty_check.py b/volatility/framework/plugins/linux/tty_check.py index a5b78fbb5..d07a78bab 100644 --- a/volatility/framework/plugins/linux/tty_check.py +++ b/volatility/framework/plugins/linux/tty_check.py @@ -15,29 +15,27 @@ from volatility.framework.renderers import format_hints vollog = logging.getLogger(__name__) + class tty_check(plugins.PluginInterface): """Checks tty devices for hooks""" - + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.TranslationLayerRequirement(name='primary', - description='Memory layer for the kernel', - architectures=["Intel32", "Intel64"]), - requirements.SymbolTableRequirement( - name="vmlinux", description="Linux kernel symbols"), - - requirements.PluginRequirement( - name='lsmod', plugin=lsmod.Lsmod, version=(1, 0, 0)) + requirements.TranslationLayerRequirement(name = 'primary', + description = 'Memory layer for the kernel', + architectures = ["Intel32", "Intel64"]), + requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), + requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] def _generator(self): - vmlinux = contexts.Module( - self.context, self.config['vmlinux'], self.config['primary'], 0) + vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0) modules = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['vmlinux']) - handlers = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'], self.config['vmlinux'], modules) + handlers = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'], + self.config['vmlinux'], modules) try: tty_drivers = vmlinux.object_from_symbol("tty_drivers") @@ -46,7 +44,7 @@ class tty_check(plugins.PluginInterface): if not tty_drivers: raise TypeError( - "This plugin requires the tty_drivers structure." + "This plugin requires the tty_drivers structure." "This structure is not present in the supplied symbol table." "This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt." ) @@ -54,10 +52,13 @@ class tty_check(plugins.PluginInterface): for tty in tty_drivers.to_list(vmlinux.name + constants.BANG + "tty_driver", "tty_drivers"): try: - ttys = utility.array_of_pointers(tty.ttys.dereference(), count=tty.num, subtype=vmlinux.name + constants.BANG + "tty_struct", context=self.context) + ttys = utility.array_of_pointers(tty.ttys.dereference(), + count = tty.num, + subtype = vmlinux.name + constants.BANG + "tty_struct", + context = self.context) except exceptions.PagedInvalidAddressException: continue - + for tty_dev in ttys: if tty_dev == 0: @@ -70,7 +71,7 @@ class tty_check(plugins.PluginInterface): module_name, symbol_name = linux.LinuxUtilities.lookup_module_address(self.context, handlers, recv_buf) yield (0, (name, format_hints.Hex(recv_buf), module_name, symbol_name)) - + def run(self): - return renderers.TreeGrid([("Name", str), ("Address", format_hints.Hex), ("Module", str), - ("Symbol", str)], self._generator()) + return renderers.TreeGrid([("Name", str), ("Address", format_hints.Hex), ("Module", str), ("Symbol", str)], + self._generator()) diff --git a/volatility/framework/symbols/linux/__init__.py b/volatility/framework/symbols/linux/__init__.py index a77b06cce..9dd38b75e 100644 --- a/volatility/framework/symbols/linux/__init__.py +++ b/volatility/framework/symbols/linux/__init__.py @@ -199,15 +199,12 @@ class LinuxUtilities(object): """ mask = context.layers[layer_name].address_mask - return [(utility.array_to_string(mod.name), mod.get_module_base() & mask, (mod.get_module_base() & mask) + mod.get_core_size()) - for mod in mods] + return [(utility.array_to_string(mod.name), mod.get_module_base() & mask, + (mod.get_module_base() & mask) + mod.get_core_size()) for mod in mods] @classmethod def generate_kernel_handler_info( - cls, - context: interfaces.context.ContextInterface, - layer_name: str, - kernel_name: str, + cls, context: interfaces.context.ContextInterface, layer_name: str, kernel_name: str, mods_list: Iterator[interfaces.objects.ObjectInterface]) -> List[Tuple[str, int, int]]: """ A helper function that gets the beginning and end address of the kernel module @@ -241,8 +238,7 @@ class LinuxUtilities(object): if start <= target_address <= end: mod_name = name if name == constants.linux.KERNEL_NAME: - symbols = list( - context.symbol_space.get_symbols_by_location(target_address)) + symbols = list(context.symbol_space.get_symbols_by_location(target_address)) if len(symbols): symbol_name = symbols[0].split(constants.BANG)[1] if constants.BANG in symbols[0] else \ @@ -252,10 +248,9 @@ class LinuxUtilities(object): return mod_name, symbol_name - @classmethod + @classmethod def walk_internal_list(cls, vmlinux, struct_name, list_member, list_start): while list_start: - list_struct = vmlinux.object( - object_type=struct_name, offset=list_start.vol.offset) + list_struct = vmlinux.object(object_type = struct_name, offset = list_start.vol.offset) yield list_struct list_start = getattr(list_struct, list_member)