[linux.malware.malfind] Allow dumping enumerated VMAs/pages

[Abyss-W4tcher]

Hi,

This PR adjusts the Linux malfind code to handle dumping the enumerated regions and pages. It removes calls to vm_area_struct.get_malicious_pages and vm_area_struct.is_malicious in favor of internal helpers instead. This allows adjusting malfind's behaviour without affecting the framework version.

The --dump-page option was inexact and not actually dumping pages as expected, but only listing/showing dirty pages inside VMAs.

Previous help options:

options:
  -h, --help            show this help message and exit
  --pid [PID ...]       Filter on specific process IDs
  --dump-size DUMP-SIZE
                        Amount of bytes to dump for each dirty region/page found - Default 64 bytes
  --dump-page           Dump each dirty page and content - Default off

New help options:

options:
  -h, --help            show this help message and exit
  --pid [PID ...]       Filter on specific process IDs
  --hexdump-size HEXDUMP-SIZE
                        Amount of bytes to show for each region/page found - Default 64 bytes
  --show-all-dirty-pages
                        Show all dirty pages in a VMA if at least one dirty page is found - Default off
  --dump-regions        Dump each suspicious memory region in output. All dirty pages will be dumped if --show-all-dirty-pages is enabled.
  --dump-maxsize DUMP-MAXSIZE
                        Maximum size for dumped memory regions (all the bigger regions will be ignored) - Default 1 GB

I've bumped the plugin's minor version as some parameters were renamed / rearranged.

Closes #1965.

[halpomeranz]

Yes, this looks like the functionality I wanted. Thanks very much!

[halpomeranz]

Could I suggest a wording change on the --dump-pages help text?

--dump-pages          Dump each dirty page in output. All dirty pages will be dumped if  
                      --show-all-dirty-pages is enabled. - Default off

[Abyss-W4tcher]

I've updated the wording to:

Dump each suspicious memory region in output. All dirty pages will be dumped if --show-all-dirty-pages is enabled.

[Abyss-W4tcher]

I've also renamed --dump-pages to --dump-regions as it can dump both VMAs and pages.

[ikelos]

Looks good, thanks. 5:)