Merge pull request #1746 from volatilityfoundation/fix_hidden_modules

Fix hidden_modules to actually list hidden modules...

Author: ikelos

volatility3/framework/plugins/linux/hidden_modules.py

@@ -17,8 +17,35 @@
 class Hidden_modules(plugins.PluginInterface):
     """Carves memory to find hidden kernel modules"""
 
-    _required_framework_version = (2, 10, 0)
-    _version = (3, 0, 1)
+    _required_framework_version = (2, 25, 0)
+    _version = (3, 0, 2)
+
+    @classmethod
+    def find_hidden_modules(
+        cls, context, vmlinux_module_name: str
+    ) -> extensions.module:
+        if context.symbol_space.verify_table_versions(
+            "dwarf2json", lambda version, _: (not version) or version < (0, 8, 0)
+        ):
+            raise exceptions.SymbolSpaceError(
+                "Invalid symbol table, please ensure the ISF table produced by dwarf2json was created with version 0.8.0 or later"
+            )
+
+        known_module_addresses = cls.get_lsmod_module_addresses(
+            context, vmlinux_module_name
+        )
+        modules_memory_boundaries = (
+            linux_utilities_modules.Modules.get_modules_memory_boundaries(
+                context, vmlinux_module_name
+            )
+        )
+
+        yield from linux_utilities_modules.Modules.get_hidden_modules(
+            context,
+            vmlinux_module_name,
+            known_module_addresses,
+            modules_memory_boundaries,
+        )
 
     @classmethod
     def get_hidden_modules(
@@ -56,7 +83,7 @@ def get_hidden_modules(
 
     run = linux_utilities_modules.ModuleDisplayPlugin.run
     _generator = linux_utilities_modules.ModuleDisplayPlugin.generator
-    implementation = linux_utilities_modules.Modules.list_modules
+    implementation = find_hidden_modules
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -163,30 +190,3 @@ def get_lsmod_module_addresses(
             )
         }
         return known_module_addresses
-
-    @classmethod
-    def find_hidden_modules(
-        cls, context, vmlinux_module_name: str
-    ) -> extensions.module:
-        if context.symbol_space.verify_table_versions(
-            "dwarf2json", lambda version, _: (not version) or version < (0, 8, 0)
-        ):
-            raise exceptions.SymbolSpaceError(
-                "Invalid symbol table, please ensure the ISF table produced by dwarf2json was created with version 0.8.0 or later"
-            )
-
-        known_module_addresses = cls.get_lsmod_module_addresses(
-            context, vmlinux_module_name
-        )
-        modules_memory_boundaries = (
-            linux_utilities_modules.Modules.get_modules_memory_boundaries(
-                context, vmlinux_module_name
-            )
-        )
-
-        yield from linux_utilities_modules.Modules.get_hidden_modules(
-            context,
-            vmlinux_module_name,
-            known_module_addresses,
-            modules_memory_boundaries,
-        )