Automagic: Change stackers to including an exclusion list

volatility/cli/__init__.py

@@ -271,7 +271,7 @@ class CommandLine(interfaces.plugins.FileConsumerInterface):
 
         # It should be up to the UI to determine which automagics to run, so this is before BACK TO THE FRAMEWORK
         automagics = automagic.choose_automagic(automagics, plugin)
-        ctx.config['automagic.LayerStacker.stackers'] = stacker.choose_stackers(plugin)
+        ctx.config['automagic.LayerStacker.stackers'] = stacker.choose_os_stackers(plugin)
         self.output_dir = args.output_dir
 
         ###

volatility/framework/automagic/linux.py

@@ -16,6 +16,7 @@ vollog = logging.getLogger(__name__)
 
 class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface):
     stack_order = 45
+    exclusion_list = ['mac', 'windows']
 
     @classmethod
     def stack(cls,

volatility/framework/automagic/mac.py

@@ -16,6 +16,7 @@ vollog = logging.getLogger(__name__)
 
 class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
     stack_order = 45
+    exclusion_list = ['windows', 'linux']
 
     @classmethod
     def stack(cls,

volatility/framework/automagic/stacker.py

@@ -245,32 +245,14 @@ class LayerStacker(interfaces.automagic.AutomagicInterface):
         ]
 
 
-def choose_stackers(plugin):
-    """Chooses the available stackers based on the plugin"""
-    plugin_module_components = plugin.__module__.split('.')
-    oses = ['windows', 'linux', 'mac']
-
-    operating_system = 'unknown'
-    lowest_index = len(plugin_module_components)
-
-    for os in oses:
-        try:
-            if plugin_module_components.index(os) < lowest_index:
-                lowest_index = plugin_module_components.index(os)
-                operating_system = os
-        except ValueError:
-            # The value wasn't found, try the next one
-            pass
+def choose_os_stackers(plugin):
+    """Identifies the stackers that should be run, based on the plugin (and thus os) provided"""
+    plugin_first_level = plugin.__module__.split('.')[0]
 
     result = []
     for stacker in sorted(framework.class_subclasses(interfaces.automagic.StackerLayerInterface),
                           key = lambda x: x.stack_order):
-        stacker_name = stacker.__name__.lower()
-        append = True
-        if 'intel' in stacker_name:
-            if operating_system in oses:
-                if not stacker_name.startswith(operating_system):
-                    append = False
-        if append:
-            result.append(stacker.__name__)
+        if plugin_first_level in stacker.exclusion_list:
+            continue
+        result.append(stacker.__name__)
     return result

volatility/framework/automagic/windows.py

@@ -288,6 +288,7 @@ class WintelHelper(interfaces.automagic.AutomagicInterface):
 
 class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface):
     stack_order = 40
+    exclusion_list = ['mac', 'linux']
 
     @classmethod
     def stack(cls,

volatility/framework/interfaces/automagic.py

@@ -104,6 +104,9 @@ class StackerLayerInterface(metaclass = ABCMeta):
     """
 
     stack_order = 0
+    """The order in which to attempt stacking, the lower the earlier"""
+    exclusion_list = []
+    """The list operating systems/first-level plugin hierarchy that should exclude this stacker"""
 
     @classmethod
     def stack(self,