diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index d06622cf0..dd247006a 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -271,7 +271,7 @@ class CommandLine(interfaces.plugins.FileConsumerInterface): # It should be up to the UI to determine which automagics to run, so this is before BACK TO THE FRAMEWORK automagics = automagic.choose_automagic(automagics, plugin) - ctx.config['automagic.LayerStacker.stackers'] = stacker.choose_stackers(plugin) + ctx.config['automagic.LayerStacker.stackers'] = stacker.choose_os_stackers(plugin) self.output_dir = args.output_dir ### diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index 4ec720445..abb8350d3 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -16,6 +16,7 @@ vollog = logging.getLogger(__name__) class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): stack_order = 45 + exclusion_list = ['mac', 'windows'] @classmethod def stack(cls, diff --git a/volatility/framework/automagic/mac.py b/volatility/framework/automagic/mac.py index 6e6e61cb5..cc3445488 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility/framework/automagic/mac.py @@ -16,6 +16,7 @@ vollog = logging.getLogger(__name__) class MacIntelStacker(interfaces.automagic.StackerLayerInterface): stack_order = 45 + exclusion_list = ['windows', 'linux'] @classmethod def stack(cls, diff --git a/volatility/framework/automagic/stacker.py b/volatility/framework/automagic/stacker.py index 12d312717..a2e9b2d20 100644 --- a/volatility/framework/automagic/stacker.py +++ b/volatility/framework/automagic/stacker.py @@ -245,32 +245,14 @@ class LayerStacker(interfaces.automagic.AutomagicInterface): ] -def choose_stackers(plugin): - """Chooses the available stackers based on the plugin""" - plugin_module_components = plugin.__module__.split('.') - oses = ['windows', 'linux', 'mac'] - - operating_system = 'unknown' - lowest_index = len(plugin_module_components) - - for os in oses: - try: - if plugin_module_components.index(os) < lowest_index: - lowest_index = plugin_module_components.index(os) - operating_system = os - except ValueError: - # The value wasn't found, try the next one - pass +def choose_os_stackers(plugin): + """Identifies the stackers that should be run, based on the plugin (and thus os) provided""" + plugin_first_level = plugin.__module__.split('.')[0] result = [] for stacker in sorted(framework.class_subclasses(interfaces.automagic.StackerLayerInterface), key = lambda x: x.stack_order): - stacker_name = stacker.__name__.lower() - append = True - if 'intel' in stacker_name: - if operating_system in oses: - if not stacker_name.startswith(operating_system): - append = False - if append: - result.append(stacker.__name__) + if plugin_first_level in stacker.exclusion_list: + continue + result.append(stacker.__name__) return result diff --git a/volatility/framework/automagic/windows.py b/volatility/framework/automagic/windows.py index ec07e6114..7f9ae0b68 100644 --- a/volatility/framework/automagic/windows.py +++ b/volatility/framework/automagic/windows.py @@ -288,6 +288,7 @@ class WintelHelper(interfaces.automagic.AutomagicInterface): class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface): stack_order = 40 + exclusion_list = ['mac', 'linux'] @classmethod def stack(cls, diff --git a/volatility/framework/interfaces/automagic.py b/volatility/framework/interfaces/automagic.py index 913cd043c..456d817c6 100644 --- a/volatility/framework/interfaces/automagic.py +++ b/volatility/framework/interfaces/automagic.py @@ -104,6 +104,9 @@ class StackerLayerInterface(metaclass = ABCMeta): """ stack_order = 0 + """The order in which to attempt stacking, the lower the earlier""" + exclusion_list = [] + """The list operating systems/first-level plugin hierarchy that should exclude this stacker""" @classmethod def stack(self,