Code

Add linux hidden_modules plugin#1283

Code

Merged

ikelos merged 19 commits intovolatilityfoundation:developvolatilityfoundation/volatility3:developfrom gcmoreira:linux_hidden_modulesgcmoreira/volatility3:linux_hidden_modulesCopy head branch name to clipboardOct 30, 2024

+378-91

Commits

Commits on Oct 1, 2024

• Refactor of module object. Adding function helpers to simplify the control of exceptions and errors and consolidate everything on them.

  gcmoreira

  committed
  6cd39c0

• Add linux.hidden_modules plugin

  gcmoreira

  committed
  5dee3ae

• Allow any module state value in both traditional and fast scan methods

  gcmoreira

  committed
  d5e6e7c

Commits on Oct 3, 2024

• Make it callable from other plugins.

  Show description for 590aa9c
  gcmoreira

  committed
  590aa9c

• Added the --heuristic-mode option, which relaxes constraints to improve detection of more advanced threats

  gcmoreira

  committed
  8d925bd

• Fix typo in usage help

  gcmoreira

  committed
  e8754fa

• Linux: hidden_modules: Add @Abyss-W4tcher suggestion to optimize the fast scan method for even better performance, using the mkobj.mod self referential validation used in module.is_valid() as pre-f…

  Show description for b5948d7
  gcmoreira

  committed
  b5948d7

• Linux: hidden_modules: remove missed optional heuristic_mode argument

  gcmoreira

  committed
  f455c30

Commits on Oct 16, 2024

• linux: hidden_modules: Make the fast method the default. Remove vol2 and fall back to a 1-byte alignment scan if addresses aren't aligned to the L1 cache size

  gcmoreira

  committed
  d98c7eb

• linux: hidden_modules: Remove unused module imports

  gcmoreira

  committed
  0ddd921

Commits on Oct 29, 2024

• Linux: hidden_modules: Use child_template

  gcmoreira

  committed
  526007f

• Linux: hidden_modules: Import the whole architectures module

  gcmoreira

  committed
  cbe071f

• Linux: hidden_modules: Include kernel version and commit details

  gcmoreira

  committed
  dfd8a1f

• Linux: hidden_modules: Simplify symbols type checks

  gcmoreira

  committed
  1c6a548

• Linux: hidden_modules: Add a symbol table check for a recent dwarf2json version

  gcmoreira

  committed
  8960bda

• Merge branch 'develop' into linux_hidden_modules

  gcmoreira

  committed
  f537c4a

• Linux: hidden_modules: Add docstrings and comments to enhance the documentation of the module verification process. Move the hardcoded values to the linux constants file.

  gcmoreira

  committed
  4b76b69

Commits on Oct 30, 2024

• Linux: Extensions: Clean up the Linux constants imports in the object extension file

  gcmoreira

  committed
  722ccd5

• Merge branch 'develop' into linux_hidden_modules

  gcmoreira

  committed
  4f86b3f