|
13 | 13 |
|
14 | 14 | from volatility3.framework import constants, exceptions, objects, interfaces, symbols |
15 | 15 | from volatility3.framework.renderers import conversion |
16 | | -from volatility3.framework.configuration import requirements |
17 | 16 | from volatility3.framework.constants.linux import SOCK_TYPES, SOCK_FAMILY |
18 | 17 | from volatility3.framework.constants.linux import IP_PROTOCOLS, IPV6_PROTOCOLS |
19 | 18 | from volatility3.framework.constants.linux import TCP_STATES, NETLINK_PROTOCOLS |
@@ -56,88 +55,80 @@ def mod_mem_type(self): |
56 | 55 | self._mod_mem_type = {} |
57 | 56 | return self._mod_mem_type |
58 | 57 |
|
| 58 | + def _get_mem_type(self, mod_mem_type_name): |
| 59 | + module_mem_index = self.mod_mem_type.get(mod_mem_type_name) |
| 60 | + if module_mem_index is None: |
| 61 | + raise AttributeError(f"Unknown module memory type '{mod_mem_type_name}'") |
| 62 | + |
| 63 | + if not (0 <= module_mem_index < self.mem.count): |
| 64 | + raise AttributeError( |
| 65 | + f"Invalid module memory type index '{module_mem_index}'" |
| 66 | + ) |
| 67 | + |
| 68 | + return self.mem[module_mem_index] |
| 69 | + |
| 70 | + def _get_mem_size(self, mod_mem_type_name): |
| 71 | + return self._get_mem_type(mod_mem_type_name).size |
| 72 | + |
| 73 | + def _get_mem_base(self, mod_mem_type_name): |
| 74 | + return self._get_mem_type(mod_mem_type_name).base |
| 75 | + |
59 | 76 | def get_module_base(self): |
60 | 77 | if self.has_member("mem"): # kernels 6.4+ |
61 | | - try: |
62 | | - return self.mem[self.mod_mem_type["MOD_TEXT"]].base |
63 | | - except KeyError: |
64 | | - raise AttributeError( |
65 | | - "module -> get_module_base: Unable to get module base. Cannot read base from MOD_TEXT." |
66 | | - ) |
| 78 | + return self._get_mem_base("MOD_TEXT") |
67 | 79 | elif self.has_member("core_layout"): |
68 | 80 | return self.core_layout.base |
69 | 81 | elif self.has_member("module_core"): |
70 | 82 | return self.module_core |
71 | | - raise AttributeError("module -> get_module_base: Unable to get module base") |
| 83 | + |
| 84 | + raise AttributeError("Unable to get module base") |
72 | 85 |
|
73 | 86 | def get_init_size(self): |
74 | 87 | if self.has_member("mem"): # kernels 6.4+ |
75 | | - try: |
76 | | - return ( |
77 | | - self.mem[self.mod_mem_type["MOD_INIT_TEXT"]].size |
78 | | - + self.mem[self.mod_mem_type["MOD_INIT_DATA"]].size |
79 | | - + self.mem[self.mod_mem_type["MOD_INIT_RODATA"]].size |
80 | | - ) |
81 | | - except KeyError: |
82 | | - raise AttributeError( |
83 | | - "module -> get_init_size: Unable to determine .init section size of module. Cannot read size of MOD_INIT_TEXT, MOD_INIT_DATA, and MOD_INIT_RODATA" |
84 | | - ) |
| 88 | + return ( |
| 89 | + self._get_mem_size("MOD_INIT_TEXT") |
| 90 | + + self._get_mem_size("MOD_INIT_DATA") |
| 91 | + + self._get_mem_size("MOD_INIT_RODATA") |
| 92 | + ) |
85 | 93 | elif self.has_member("init_layout"): |
86 | 94 | return self.init_layout.size |
87 | 95 | elif self.has_member("init_size"): |
88 | 96 | return self.init_size |
89 | | - raise AttributeError( |
90 | | - "module -> get_init_size: Unable to determine .init section size of module" |
91 | | - ) |
| 97 | + |
| 98 | + raise AttributeError("Unable to determine .init section size of module") |
92 | 99 |
|
93 | 100 | def get_core_size(self): |
94 | 101 | if self.has_member("mem"): # kernels 6.4+ |
95 | | - try: |
96 | | - return ( |
97 | | - self.mem[self.mod_mem_type["MOD_TEXT"]].size |
98 | | - + self.mem[self.mod_mem_type["MOD_DATA"]].size |
99 | | - + self.mem[self.mod_mem_type["MOD_RODATA"]].size |
100 | | - + self.mem[self.mod_mem_type["MOD_RO_AFTER_INIT"]].size |
101 | | - ) |
102 | | - except KeyError: |
103 | | - raise AttributeError( |
104 | | - "module -> get_core_size: Unable to determine core size of module. Cannot read size of MOD_TEXT, MOD_DATA, MOD_RODATA, and MOD_RO_AFTER_INIT." |
105 | | - ) |
| 102 | + return ( |
| 103 | + self._get_mem_size("MOD_TEXT") |
| 104 | + + self._get_mem_size("MOD_DATA") |
| 105 | + + self._get_mem_size("MOD_RODATA") |
| 106 | + + self._get_mem_size("MOD_RO_AFTER_INIT") |
| 107 | + ) |
106 | 108 | elif self.has_member("core_layout"): |
107 | 109 | return self.core_layout.size |
108 | 110 | elif self.has_member("core_size"): |
109 | 111 | return self.core_size |
110 | | - raise AttributeError( |
111 | | - "module -> get_core_size: Unable to determine core size of module" |
112 | | - ) |
| 112 | + |
| 113 | + raise AttributeError("Unable to determine core size of module") |
113 | 114 |
|
114 | 115 | def get_module_core(self): |
115 | 116 | if self.has_member("mem"): # kernels 6.4+ |
116 | | - try: |
117 | | - return self.mem[self.mod_mem_type["MOD_TEXT"]].base |
118 | | - except KeyError: |
119 | | - raise AttributeError( |
120 | | - "module -> get_module_core: Unable to get module core. Cannot read base from MOD_TEXT." |
121 | | - ) |
| 117 | + return self._get_mem_base("MOD_TEXT") |
122 | 118 | elif self.has_member("core_layout"): |
123 | 119 | return self.core_layout.base |
124 | 120 | elif self.has_member("module_core"): |
125 | 121 | return self.module_core |
126 | | - raise AttributeError("module -> get_module_core: Unable to get module core") |
| 122 | + raise AttributeError("Unable to get module core") |
127 | 123 |
|
128 | 124 | def get_module_init(self): |
129 | 125 | if self.has_member("mem"): # kernels 6.4+ |
130 | | - try: |
131 | | - return self.mem[self.mod_mem_type["MOD_INIT_TEXT"]].base |
132 | | - except KeyError: |
133 | | - raise AttributeError( |
134 | | - "module -> get_module_core: Unable to get module init. Cannot read base from MOD_INIT_TEXT." |
135 | | - ) |
| 126 | + return self._get_mem_base("MOD_INIT_TEXT") |
136 | 127 | elif self.has_member("init_layout"): |
137 | 128 | return self.init_layout.base |
138 | 129 | elif self.has_member("module_init"): |
139 | 130 | return self.module_init |
140 | | - raise AttributeError("module -> get_module_init: Unable to get module init") |
| 131 | + raise AttributeError("Unable to get module init") |
141 | 132 |
|
142 | 133 | def get_name(self): |
143 | 134 | """Get the name of the module as a string""" |
|
0 commit comments