Refactor all references to Context.memory to Context.layers.

development/dtbfinder.py

@@ -35,13 +35,13 @@ if __name__ == '__main__':
                                                       "filename")] = filename
         data = layers.physical.FileLayer(ctx, 'config' + str(args.filenames.index(filename)),
                                          'data' + str(args.filenames.index(filename)))
-        ctx.memory.add_layer(data)
+        ctx.layers.add_layer(data)
         if args.lime:
             ctx.config[interfaces.configuration.path_join('lime-config' + str(args.filenames.index(filename)),
                                                           "base_layer")] = 'data' + str(args.filenames.index(filename))
             data = layers.lime.LimeLayer(ctx, 'lime-config' + str(args.filenames.index(filename)),
                                          'lime-data' + str(args.filenames.index(filename)))
-            ctx.memory.add_layer(data)
+            ctx.layers.add_layer(data)
 
     layername = 'data'
     if args.lime:
@@ -64,7 +64,7 @@ if __name__ == '__main__':
     if tests:
         for i in range(len(args.filenames)):
             print("[*] Scanning " + args.filenames[i] + "...")
-            scan_results = ctx.memory[layername + str(i)].scan(ctx, windows.PageMapScanner(tests))
+            scan_results = ctx.layers[layername + str(i)].scan(ctx, windows.PageMapScanner(tests))
 
             # Self-referential tests need post-processing to gather the most likely offset
             if args.selfref:

development/nlpdtbfinder.py

@@ -85,7 +85,7 @@ def find_pd_mapping(ctx, layer_name, entries):
 
         pt_offset = (entry & PHYS_MASK) >> 12
         try:
-            pt = ctx.memory.read(baselayer_name, pt_offset, PAGE_SIZE)
+            pt = ctx.layers.read(baselayer_name, pt_offset, PAGE_SIZE)
         except exceptions.InvalidAddressException:
             # print("page fault at " + hex(pt_offset))
             return False
@@ -109,7 +109,7 @@ def find_pdpt_mapping(ctx, layer_name, entries):
 
         pd_offset = (entry & PHYS_MASK) >> 12
         try:
-            pd = ctx.memory.read(baselayer_name, pd_offset, PAGE_SIZE)
+            pd = ctx.layers.read(baselayer_name, pd_offset, PAGE_SIZE)
         except exceptions.InvalidAddressException:
             # print("page fault at " + hex(pd_offset))
             return False
@@ -129,7 +129,7 @@ def find_pml4_mapping(ctx, layer_name, entries):
         pdpte_offset = (entry & PHYS_MASK) >> 12
 
         try:
-            pdpte = ctx.memory.read(baselayer_name, pdpte_offset, PAGE_SIZE)
+            pdpte = ctx.layers.read(baselayer_name, pdpte_offset, PAGE_SIZE)
         except exceptions.InvalidAddressException:
             # print("page fault at " + hex(pdpte_offset))
             return False
@@ -158,13 +158,13 @@ if __name__ == '__main__':
                                                       "filename")] = filename
         data = layers.physical.FileLayer(ctx, 'config' + str(args.filenames.index(filename)),
                                          'data' + str(args.filenames.index(filename)))
-        ctx.memory.add_layer(data)
+        ctx.layers.add_layer(data)
         if args.lime:
             ctx.config[interfaces.configuration.path_join('lime-config' + str(args.filenames.index(filename)),
                                                           "base_layer")] = 'data' + str(args.filenames.index(filename))
             data = layers.lime.LimeLayer(ctx, 'lime-config' + str(args.filenames.index(filename)),
                                          'lime-data' + str(args.filenames.index(filename)))
-            ctx.memory.add_layer(data)
+            ctx.layers.add_layer(data)
 
         layername = 'data'
         if args.lime:
@@ -175,7 +175,7 @@ if __name__ == '__main__':
         for i in range(len(args.filenames)):
             print("[*] Scanning " + args.filenames[i] + "...")
             baselayer_name = layername + str(i)
-            scan_results = ctx.memory[baselayer_name].scan(ctx, PML4EScanner())
+            scan_results = ctx.layers[baselayer_name].scan(ctx, PML4EScanner())
 
             for (dtb, entries) in scan_results:
                 # print("trying: " + hex(dtb))

development/pdbscanner.py

@@ -27,17 +27,17 @@ if __name__ == '__main__':
         ctx.config[interfaces.configuration.path_join(config_name, "filename")] = filename
         base = layers.physical.FileLayer(ctx, config_name, base_name)
 
-        ctx.memory.add_layer(base)
+        ctx.layers.add_layer(base)
 
         # XXX What's the right way to check for LiME?
-        (magic, ) = struct.unpack('<I', ctx.memory.read(base_name, 0, 4))
+        (magic, ) = struct.unpack('<I', ctx.layers.read(base_name, 0, 4))
         if magic == layers.lime.LimeLayer.MAGIC:
             lime_name = 'data-lime' + str(index)
             lime_config_name = 'config-lime' + str(index)
             ctx.config[interfaces.configuration.path_join(lime_config_name, "base_layer")] = base_name
             lime = layers.lime.LimeLayer(ctx, lime_config_name, lime_name)
 
-            ctx.memory.add_layer(lime)
+            ctx.layers.add_layer(lime)
             base_name = lime_name
         scan_layers.append((filename, base_name))
 

volatility/cli/volshell/shellplugin.py

@@ -48,7 +48,7 @@ class Volshell(interfaces.plugins.PluginInterface):
         context = self.context
         config = self.config
         layer_name = self.config['primary']
-        kvo = context.memory[layer_name].config.get('kernel_virtual_offset')
+        kvo = context.layers[layer_name].config.get('kernel_virtual_offset')
         members = lambda x: list(sorted(x.vol.members))
 
         # Determine locals

volatility/cli/volshell/windows.py

@@ -40,7 +40,7 @@ class Volshell(shellplugin.Volshell):
 
         # We only use the object factory to demonstrate how to use one
         layer_name = self.config['primary']
-        kvo = self.context.memory[layer_name].config['kernel_virtual_offset']
+        kvo = self.context.layers[layer_name].config['kernel_virtual_offset']
         ntkrnlmp = self.context.module(self.config['nt_symbols'], layer_name = layer_name, offset = kvo)
 
         ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address
@@ -74,7 +74,7 @@ class Volshell(shellplugin.Volshell):
 
         # Provide some OS-agnostic convenience elements for ease
         layer_name = self.config['primary']
-        kvo = self.context.memory[layer_name].config['kernel_virtual_offset']
+        kvo = self.context.layers[layer_name].config['kernel_virtual_offset']
         nt = self.context.module(self.config['nt_symbols'], layer_name = layer_name, offset = kvo)
         ps = lambda: list(self.list_processes())
 

volatility/framework/automagic/linux.py

@@ -56,7 +56,7 @@ class LintelStacker(interfaces.automagic.StackerLayerInterface):
               progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]:
         """Attempts to identify linux within this layer"""
         # Bail out by default unless we can stack properly
-        layer = context.memory[layer_name]
+        layer = context.layers[layer_name]
         join = interfaces.configuration.path_join
 
         # Never stack on top of an intel layer
@@ -96,7 +96,7 @@ class LintelStacker(interfaces.automagic.StackerLayerInterface):
                     table.get_symbol(dtb_symbol_name).address + kaslr_shift)
 
                 # Build the new layer
-                new_layer_name = context.memory.free_layer_name("IntelLayer")
+                new_layer_name = context.layers.free_layer_name("IntelLayer")
                 config_path = join("IntelHelper", new_layer_name)
                 context.config[join(config_path, "memory_layer")] = layer_name
                 context.config[join(config_path, "page_map_offset")] = dtb
@@ -274,7 +274,7 @@ class LinuxUtilities(object):
                                aslr_shift = 0):
 
         sym_table = context.symbol_space[symbol_table]
-        sym_layer = context.memory[layer_name]
+        sym_layer = context.layers[layer_name]
 
         if aslr_shift == 0:
             if not isinstance(sym_layer, layers.intel.Intel):
@@ -297,7 +297,7 @@ class LinuxUtilities(object):
         swapper_signature = rb"swapper(\/0|\x00\x00)\x00\x00\x00\x00\x00\x00"
         module = context.module(symbol_table, layer_name, 0)
 
-        for offset in context.memory[layer_name].scan(
+        for offset in context.layers[layer_name].scan(
                 scanner = scanners.RegExScanner(swapper_signature),
                 context = context,
                 progress_callback = progress_callback):

volatility/framework/automagic/mac.py

@@ -56,7 +56,7 @@ class MacintelStacker(interfaces.automagic.StackerLayerInterface):
               progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]:
         """Attempts to identify mac within this layer"""
         # Bail out by default unless we can stack properly
-        layer = context.memory[layer_name]
+        layer = context.layers[layer_name]
         new_layer = None
         join = interfaces.configuration.path_join
 
@@ -102,7 +102,7 @@ class MacintelStacker(interfaces.automagic.StackerLayerInterface):
                 bootpml4_addr = MacUtilities.virtual_to_physical_address(
                     table.get_symbol("BootPML4").address + kaslr_shift)
 
-                new_layer_name = context.memory.free_layer_name("MacDTBTempLayer")
+                new_layer_name = context.layers.free_layer_name("MacDTBTempLayer")
                 config_path = join("automagic", "MacIntelHelper", new_layer_name)
                 context.config[join(config_path, "memory_layer")] = layer_name
                 context.config[join(config_path, "page_map_offset")] = bootpml4_addr
@@ -117,7 +117,7 @@ class MacintelStacker(interfaces.automagic.StackerLayerInterface):
                 dtb = idlepml4_addr
 
                 # Build the new layer
-                new_layer_name = context.memory.free_layer_name("IntelLayer")
+                new_layer_name = context.layers.free_layer_name("IntelLayer")
                 config_path = join("automagic", "MacIntelHelper", new_layer_name)
                 context.config[join(config_path, "memory_layer")] = layer_name
                 context.config[join(config_path, "page_map_offset")] = dtb
@@ -142,7 +142,7 @@ class MacUtilities(object):
                                aslr_shift = 0):
 
         sym_table = context.symbol_space[symbol_table]
-        sym_layer = context.memory[layer_name]
+        sym_layer = context.layers[layer_name]
 
         if aslr_shift == 0:
             if not isinstance(sym_layer, layers.intel.Intel):
@@ -156,11 +156,11 @@ class MacUtilities(object):
     def _scan_generator(cls, context, layer_name, progress_callback):
         darwin_signature = rb"Darwin Kernel Version \d{1,3}\.\d{1,3}\.\d{1,3}: [^\x00]+\x00"
 
-        for offset in context.memory[layer_name].scan(
+        for offset in context.layers[layer_name].scan(
                 scanner = scanners.RegExScanner(darwin_signature), context = context,
                 progress_callback = progress_callback):
 
-            banner = context.memory[layer_name].read(offset, 128)
+            banner = context.layers[layer_name].read(offset, 128)
 
             idx = banner.find(b"\x00")
             if idx != -1:
@@ -200,13 +200,13 @@ class MacUtilities(object):
 
             tmp_aslr_shift = offset - cls.virtual_to_physical_address(version_json_address)
 
-            major_string = context.memory[layer_name].read(version_major_phys_offset + tmp_aslr_shift, 4)
+            major_string = context.layers[layer_name].read(version_major_phys_offset + tmp_aslr_shift, 4)
             major = struct.unpack("<I", major_string)[0]
 
             if major != banner_major:
                 continue
 
-            minor_string = context.memory[layer_name].read(version_minor_phys_offset + tmp_aslr_shift, 4)
+            minor_string = context.layers[layer_name].read(version_minor_phys_offset + tmp_aslr_shift, 4)
             minor = struct.unpack("<I", minor_string)[0]
 
             if minor != banner_minor:

volatility/framework/automagic/pdbscan.py

@@ -110,21 +110,21 @@ def scan(ctx: interfaces.context.ContextInterface,
     pdb_names = [bytes(name + ".pdb", "utf-8") for name in constants.windows.KERNEL_MODULE_NAMES]
 
     if start is None:
-        start = ctx.memory[layer_name].minimum_address
+        start = ctx.layers[layer_name].minimum_address
     if end is None:
-        end = ctx.memory[layer_name].maximum_address
+        end = ctx.layers[layer_name].maximum_address
 
-    for (GUID, age, pdb_name, signature_offset) in ctx.memory[layer_name].scan(
+    for (GUID, age, pdb_name, signature_offset) in ctx.layers[layer_name].scan(
             ctx, PdbSignatureScanner(pdb_names), progress_callback = progress_callback, sections = [(start,
                                                                                                      end - start)]):
         mz_offset = None
         sig_pfn = signature_offset // page_size
 
         for i in range(sig_pfn, min_pfn, -1):
-            if not ctx.memory[layer_name].is_valid(i * page_size, 2):
+            if not ctx.layers[layer_name].is_valid(i * page_size, 2):
                 break
 
-            data = ctx.memory[layer_name].read(i * page_size, 2)
+            data = ctx.layers[layer_name].read(i * page_size, 2)
             if data == b'MZ':
                 mz_offset = i * page_size
                 break
@@ -179,7 +179,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
             virtual_layer_name = context.config.get(sub_config_path, None)
             layer_name = context.config.get(interfaces.configuration.path_join(sub_config_path, "memory_layer"), None)
             if layer_name and virtual_layer_name:
-                memlayer = context.memory[virtual_layer_name]
+                memlayer = context.layers[virtual_layer_name]
                 if isinstance(memlayer, intel.Intel):
                     results = [virtual_layer_name]
         else:
@@ -285,7 +285,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
         """
         for virtual_layer in valid_kernels:
             # Set the virtual offset under the TranslationLayer it applies to
-            kvo_path = interfaces.configuration.path_join(context.memory[virtual_layer].config_path,
+            kvo_path = interfaces.configuration.path_join(context.layers[virtual_layer].config_path,
                                                           'kernel_virtual_offset')
             kvo, kernel = valid_kernels[virtual_layer]
             context.config[kvo_path] = kvo
@@ -345,7 +345,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
         # If we're here, chances are high we're in a Win10 x64 image with kernel base randomization
         virtual_layer_name = vlayer.name
         physical_layer_name = self.get_physical_layer_name(context, vlayer)
-        physical_layer = context.memory[physical_layer_name]
+        physical_layer = context.layers[physical_layer_name]
         # TODO:  On older windows, this might be \WINDOWS\system32\nt rather than \SystemRoot\system32\nt
         results = physical_layer.scan(
             context, scanners.BytesScanner(b"\\SystemRoot\\system32\\nt"), progress_callback = progress_callback)
@@ -375,7 +375,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
         vollog.debug("Kernel base determination - using KDBG structure for kernel offset")
         valid_kernels = {}  # type: ValidKernelsType
         physical_layer_name = self.get_physical_layer_name(context, vlayer)
-        physical_layer = context.memory[physical_layer_name]
+        physical_layer = context.layers[physical_layer_name]
         results = physical_layer.scan(context, scanners.BytesScanner(b"KDBG"), progress_callback = progress_callback)
 
         seen = set()  # type: Set[int]
@@ -446,7 +446,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
         """
         valid_kernels = {}  # type: ValidKernelsType
         for virtual_layer_name in potential_layers:
-            vlayer = context.memory.get(virtual_layer_name, None)
+            vlayer = context.layers.get(virtual_layer_name, None)
             if isinstance(vlayer, layers.intel.Intel):
                 for method in self.methods:
                     valid_kernels = method(self, context, vlayer, progress_callback)

volatility/framework/automagic/stacker.py

@@ -107,7 +107,7 @@ class LayerStacker(interfaces.automagic.AutomagicInterface):
         location = self.config.get('single_location', None)
 
         # Setup the local copy of the resource
-        current_layer_name = context.memory.free_layer_name("FileLayer")
+        current_layer_name = context.layers.free_layer_name("FileLayer")
         current_config_path = interfaces.configuration.path_join(config_path, "stack", current_layer_name)
 
         # This must be specific to get us started, setup the config and run
@@ -130,7 +130,7 @@ class LayerStacker(interfaces.automagic.AutomagicInterface):
                     vollog.log(constants.LOGLEVEL_VVVV, "Attempting to stack using {}".format(stacker_cls.__name__))
                     new_layer = stacker.stack(new_context, current_layer_name, progress_callback)
                     if new_layer:
-                        new_context.memory.add_layer(new_layer)
+                        new_context.layers.add_layer(new_layer)
                         vollog.log(constants.LOGLEVEL_VVVV,
                                    "Stacked {} using {}".format(new_layer.name, stacker_cls.__name__))
                         break
@@ -153,7 +153,7 @@ class LayerStacker(interfaces.automagic.AutomagicInterface):
             if result:
                 path, layer = result
                 # splice in the new configuration into the original context
-                context.config.merge(path, new_context.memory[layer].build_configuration())
+                context.config.merge(path, new_context.layers[layer].build_configuration())
 
                 # Call the construction magic now we may have new things to construct
                 constructor = construct_layers.ConstructionMagic(

volatility/framework/automagic/symbol_finder.py

@@ -98,7 +98,7 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface):
 
         mss = scanners.MultiStringScanner([x for x in self.banners if x is not None])
 
-        layer = context.memory[layer_name]
+        layer = context.layers[layer_name]
 
         # Check if the Stacker has already found what we're looking for
         if layer.config.get(self.banner_config_key, None):
@@ -106,7 +106,7 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface):
         else:
             # Swap to the physical layer for scanning
             # TODO: Fix this so it works for layers other than just Intel
-            layer = context.memory[layer.config['memory_layer']]
+            layer = context.layers[layer.config['memory_layer']]
             banner_list = layer.scan(context = context, scanner = mss, progress_callback = progress_callback)
 
         for _, banner in banner_list:

volatility/framework/automagic/windows.py

@@ -263,7 +263,7 @@ class WintelHelper(interfaces.automagic.AutomagicInterface):
                         context, sub_config_path)
                     if not isinstance(physical_layer_name, str):
                         raise TypeError("Physical layer name is not a string: {}".format(sub_config_path))
-                    physical_layer = context.memory[physical_layer_name]
+                    physical_layer = context.layers[physical_layer_name]
                     # Check lower layer metadata first
                     if physical_layer.metadata.get('page_map_offset', None):
                         context.config[page_map_offset_path] = physical_layer.metadata['page_map_offset']
@@ -296,7 +296,7 @@ class WintelStacker(interfaces.automagic.StackerLayerInterface):
         that range, and ignore any that contain multiple self-references (since the DTB is very unlikely to point to
         itself more than once).
         """
-        base_layer = context.memory[layer_name]
+        base_layer = context.layers[layer_name]
         if isinstance(base_layer, intel.Intel):
             return None
         if base_layer.metadata.get('os', None) not in ['Windows', 'Unknown']:
@@ -315,7 +315,7 @@ class WintelStacker(interfaces.automagic.StackerLayerInterface):
             elif base_layer.metadata.get('pae', False):
                 layer_type = intel.WindowsIntelPAE
             # Construct the layer
-            new_layer_name = context.memory.free_layer_name("IntelLayer")
+            new_layer_name = context.layers.free_layer_name("IntelLayer")
             config_path = interfaces.configuration.path_join("IntelHelper", new_layer_name)
             context.config[interfaces.configuration.path_join(config_path, "memory_layer")] = layer_name
             context.config[interfaces.configuration.path_join(
@@ -328,7 +328,7 @@ class WintelStacker(interfaces.automagic.StackerLayerInterface):
             layer = None
             config_path = None
             for test, dtb in hits:
-                new_layer_name = context.memory.free_layer_name("IntelLayer")
+                new_layer_name = context.layers.free_layer_name("IntelLayer")
                 config_path = interfaces.configuration.path_join("IntelHelper", new_layer_name)
                 context.config[interfaces.configuration.path_join(config_path, "memory_layer")] = layer_name
                 context.config[interfaces.configuration.path_join(config_path, "page_map_offset")] = dtb
@@ -340,7 +340,7 @@ class WintelStacker(interfaces.automagic.StackerLayerInterface):
         if layer is None:
             vollog.debug("Self-referential pointer not in well-known location, moving to recent windows heuristic")
             # There is a very high chance that the DTB will live in this narrow segment, assuming we couldn't find it previously
-            hits = context.memory[layer_name].scan(
+            hits = context.layers[layer_name].scan(
                 context,
                 PageMapScanner([DtbSelfRef64bit()]),
                 sections = [(0x1a0000, 0x50000)],
@@ -350,7 +350,7 @@ class WintelStacker(interfaces.automagic.StackerLayerInterface):
             if hits:
                 # TODO: Decide which to use if there are multiple options
                 test, page_map_offset = hits[0]
-                new_layer_name = context.memory.free_layer_name("IntelLayer")
+                new_layer_name = context.layers.free_layer_name("IntelLayer")
                 config_path = interfaces.configuration.path_join("IntelHelper", new_layer_name)
                 context.config[interfaces.configuration.path_join(config_path, "memory_layer")] = layer_name
                 context.config[interfaces.configuration.path_join(config_path, "page_map_offset")] = page_map_offset

volatility/framework/configuration/requirements.py

@@ -197,7 +197,7 @@ class ComplexListRequirement(MultiRequirement, configuration.ConfigurableRequire
                 value_path = configuration.path_join(config_path, self.name, req.name)
                 value = context.config.get(value_path, None)
                 if value is not None:
-                    result.splice(req.name, context.memory[value].build_configuration())
+                    result.splice(req.name, context.layers[value].build_configuration())
                     result[req.name] = value
         return result
 
@@ -260,14 +260,14 @@ class TranslationLayerRequirement(configuration.ConstructableRequirementInterfac
         config_path = configuration.path_join(config_path, self.name)
         value = self.config_value(context, config_path, None)
         if isinstance(value, str):
-            if value not in context.memory:
+            if value not in context.layers:
                 vollog.log(constants.LOGLEVEL_V, "IndexError - Layer not found in memory space: {}".format(value))
                 return {config_path: self}
-            if self.oses and context.memory[value].metadata.get('os', None) not in self.oses:
+            if self.oses and context.layers[value].metadata.get('os', None) not in self.oses:
                 vollog.log(constants.LOGLEVEL_V, "TypeError - Layer is not the required OS: {}".format(value))
                 return {config_path: self}
             if (self.architectures
-                    and context.memory[value].metadata.get('architecture', None) not in self.architectures):
+                    and context.layers[value].metadata.get('architecture', None) not in self.architectures):
                 vollog.log(constants.LOGLEVEL_V, "TypeError - Layer is not the required Architecture: {}".format(value))
                 return {config_path: self}
             return {}
@@ -292,7 +292,7 @@ class TranslationLayerRequirement(configuration.ConstructableRequirementInterfac
         # Determine the layer name
         name = self.name
         counter = 2
-        while name in context.memory:
+        while name in context.layers:
             name = self.name + str(counter)
             counter += 1
 
@@ -312,7 +312,7 @@ class TranslationLayerRequirement(configuration.ConstructableRequirementInterfac
     def build_configuration(self, context: interfaces.context.ContextInterface, _: str,
                             value: Any) -> configuration.HierarchicalDict:
         """Builds the appropriate configuration for the specified requirement"""
-        return context.memory[value].build_configuration()
+        return context.layers[value].build_configuration()
 
 
 class SymbolTableRequirement(configuration.ConstructableRequirementInterface,

volatility/framework/contexts/__init__.py

@@ -46,7 +46,7 @@ class Context(interfaces.context.ContextInterface):
         """Initializes the context."""
         super().__init__()
         self._symbol_space = symbols.SymbolSpace()
-        self._memory = interfaces.layers.Memory()
+        self._memory = interfaces.layers.LayerContainer()
         self._config = interfaces.configuration.HierarchicalDict()
 
     # ## Symbol Space Functions
@@ -69,8 +69,8 @@ class Context(interfaces.context.ContextInterface):
         return self._symbol_space
 
     @property
-    def memory(self) -> interfaces.layers.Memory:
+    def layers(self) -> interfaces.layers.LayerContainer:
-        """A Memory object, allowing access to all data and translation layers currently available within the context"""
+        """A LayerContainer object, allowing access to all data and translation layers currently available within the context"""
         return self._memory
 
     # ## Translation Layer Functions
@@ -240,7 +240,7 @@ class SizedModule(Module):
 
         The mapping should be sorted and should be quicker than reading the data
         We turn it into JSON to make a common string and use a quick hash, because collissions are unlikely"""
-        layer = self._context.memory[self.layer_name]
+        layer = self._context.layers[self.layer_name]
         if not isinstance(layer, interfaces.layers.TranslationLayerInterface):
             raise TypeError("Hashing modules on non-TranslationLayers is not allowed")
         return hashlib.md5(bytes(str(list(layer.mapping(self.offset, self.size, ignore_errors = True))),

volatility/framework/interfaces/context.py

@@ -58,9 +58,9 @@ class ContextInterface(object, metaclass = ABCMeta):
 
     @property
     @abstractmethod
-    def memory(self) -> 'interfaces.layers.Memory':
+    def layers(self) -> 'interfaces.layers.LayerContainer':
         """Returns the memory object for the context"""
-        raise NotImplementedError("Memory has not been implemented.")
+        raise NotImplementedError("LayerContainer has not been implemented.")
 
     def add_layer(self, layer: 'interfaces.layers.DataLayerInterface'):
         """Adds a named translation layer to the context memory
@@ -68,7 +68,7 @@ class ContextInterface(object, metaclass = ABCMeta):
         Args:
             layer: Layer object to be added to the context memory
         """
-        self.memory.add_layer(layer)
+        self.layers.add_layer(layer)
 
     # ## Object Factory Functions
 

volatility/framework/interfaces/layers.py

@@ -296,7 +296,7 @@ class DataLayerInterface(interfaces.configuration.ConfigurableInterface, metacla
         data = b''
         for layer_name, address, chunk_size in data_to_scan:
             try:
-                data += self.context.memory[layer_name].read(address, chunk_size)
+                data += self.context.layers[layer_name].read(address, chunk_size)
             except exceptions.InvalidAddressException:
                 vollog.debug("Invalid address in layer {} found scanning {} at address {:x}".format(
                     layer_name, self.name, address))
@@ -329,7 +329,7 @@ class DataLayerInterface(interfaces.configuration.ConfigurableInterface, metacla
     @property
     def metadata(self) -> Mapping:
         """Returns a ReadOnly copy of the metadata published by this layer"""
-        maps = [self.context.memory[layer_name].metadata for layer_name in self.dependencies]
+        maps = [self.context.layers[layer_name].metadata for layer_name in self.dependencies]
         return interfaces.objects.ReadOnlyMapping(collections.ChainMap({}, self._direct_metadata, *maps))
 
 
@@ -384,7 +384,7 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta):
             elif offset < current_offset:
                 raise exceptions.LayerException("Mapping returned an overlapping element")
             if mapped_length > 0:
-                output += [self._context.memory.read(layer, mapped_offset, mapped_length, pad)]
+                output += [self._context.layers.read(layer, mapped_offset, mapped_length, pad)]
             current_offset += mapped_length
         recovered_data = b"".join(output)
         return recovered_data + b"\x00" * (length - len(recovered_data))
@@ -399,7 +399,7 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta):
                     self.name, current_offset, "Layer {} cannot map offset: {}".format(self.name, current_offset))
             elif offset < current_offset:
                 raise exceptions.LayerException("Mapping returned an overlapping element")
-            self._context.memory.write(layer, mapped_offset, value)
+            self._context.layers.write(layer, mapped_offset, value)
             current_offset += length
 
     # ## Scan implementation with knowledge of pages
@@ -420,7 +420,7 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta):
                     offset += chunk_size
 
 
-class Memory(collections.abc.Mapping):
+class LayerContainer(collections.abc.Mapping):
     """Container for multiple layers of data"""
 
     def __init__(self) -> None:

volatility/framework/interfaces/objects.py

@@ -104,7 +104,7 @@ class ObjectInterface(metaclass = ABCMeta):
         #
 
         # Normalize offsets
-        mask = context.memory[object_info.layer_name].address_mask
+        mask = context.layers[object_info.layer_name].address_mask
         normalized_offset = object_info.offset & mask
 
         self._vol = collections.ChainMap({}, object_info, {'type_name': type_name, 'offset': normalized_offset}, kwargs)

volatility/framework/layers/crash.py

@@ -54,7 +54,7 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer):
         # Create a custom SymbolSpace
         self._crash_table_name = intermed.IntermediateSymbolTable.create(context, self._config_path, 'windows', 'crash')
         # Check Header
-        hdr_layer = self._context.memory[self._base_layer]
+        hdr_layer = self._context.layers[self._base_layer]
         hdr_offset = 0
         self._check_header(hdr_layer, hdr_offset)
 
@@ -118,9 +118,9 @@ class WindowsCrashDump32Stacker(interfaces.automagic.StackerLayerInterface):
               layer_name: str,
               progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]:
         try:
-            WindowsCrashDump32Layer._check_header(context.memory[layer_name])
+            WindowsCrashDump32Layer._check_header(context.layers[layer_name])
         except WindowsCrashDump32FormatException:
             return None
-        new_name = context.memory.free_layer_name("WindowsCrashDump32Layer")
+        new_name = context.layers.free_layer_name("WindowsCrashDump32Layer")
         context.config[interfaces.configuration.path_join(new_name, "base_layer")] = layer_name
         return WindowsCrashDump32Layer(context, new_name, new_name)

volatility/framework/layers/intel.py

@@ -179,7 +179,7 @@ class Intel(interfaces.layers.TranslationLayerInterface):
     @functools.lru_cache(1025)
     def _get_valid_table(self, base_address: int) -> Optional[bytes]:
         """Extracts the table, validates it and returns it if it's valid"""
-        table = self._context.memory.read(self._base_layer, base_address, self.page_size)
+        table = self._context.layers.read(self._base_layer, base_address, self.page_size)
 
         # If the table is entirely duplicates, then mark the whole table as bad
         if (table == table[:self._entry_size] * self._entry_number):
@@ -191,7 +191,7 @@ class Intel(interfaces.layers.TranslationLayerInterface):
         try:
             # TODO: Consider reimplementing this, since calls to mapping can call is_valid
             return all([
-                self._context.memory[layer].is_valid(mapped_offset)
+                self._context.layers[layer].is_valid(mapped_offset)
                 for _, mapped_offset, _, layer in self.mapping(offset, length)
             ])
         except exceptions.InvalidAddressException:
@@ -205,7 +205,7 @@ class Intel(interfaces.layers.TranslationLayerInterface):
         if length == 0:
             try:
                 mapped_offset, _, layer_name = self._translate(offset)
-                if not self._context.memory[layer_name].is_valid(mapped_offset):
+                if not self._context.layers[layer_name].is_valid(mapped_offset):
                     raise exceptions.InvalidAddressException(layer_name = layer_name, invalid_address = mapped_offset)
             except exceptions.InvalidAddressException:
                 if not ignore_errors:
@@ -217,7 +217,7 @@ class Intel(interfaces.layers.TranslationLayerInterface):
             try:
                 chunk_offset, page_size, layer_name = self._translate(offset)
                 chunk_size = min(page_size - (chunk_offset % page_size), length)
-                if not self._context.memory[layer_name].is_valid(chunk_offset, chunk_size):
+                if not self._context.layers[layer_name].is_valid(chunk_offset, chunk_size):
                     raise exceptions.InvalidAddressException(layer_name = layer_name, invalid_address = chunk_offset)
             except (exceptions.PagedInvalidAddressException, exceptions.InvalidAddressException) as excp:
                 if not ignore_errors:

volatility/framework/layers/lime.py

@@ -49,7 +49,7 @@ class LimeLayer(segmented.SegmentedLayer):
         # The base class loads the segments on initialization, but otherwise this must to get the right min/max addresses
 
     def _load_segments(self) -> None:
-        base_layer = self._context.memory[self._base_layer]
+        base_layer = self._context.layers[self._base_layer]
         base_maxaddr = base_layer.maximum_address
         maxaddr = 0
         offset = 0
@@ -96,9 +96,9 @@ class LimeStacker(interfaces.automagic.StackerLayerInterface):
               layer_name: str,
               progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]:
         try:
-            LimeLayer._check_header(context.memory[layer_name])
+            LimeLayer._check_header(context.layers[layer_name])
         except LimeFormatException:
             return None
-        new_name = context.memory.free_layer_name("LimeLayer")
+        new_name = context.layers.free_layer_name("LimeLayer")
         context.config[interfaces.configuration.path_join(new_name, "base_layer")] = layer_name
         return LimeLayer(context, new_name, new_name)

volatility/framework/layers/segmented.py

@@ -56,7 +56,7 @@ class SegmentedLayer(interfaces.layers.TranslationLayerInterface, metaclass = AB
     def is_valid(self, offset: int, length: int = 1) -> bool:
         """Returns whether the address offset can be translated to a valid address"""
         try:
-            base_layer = self._context.memory[self._base_layer]
+            base_layer = self._context.layers[self._base_layer]
             return all(
                 [base_layer.is_valid(mapped_offset) for _i, mapped_offset, _i, _s in self.mapping(offset, length)])
         except exceptions.InvalidAddressException:
@@ -72,7 +72,7 @@ class SegmentedLayer(interfaces.layers.TranslationLayerInterface, metaclass = AB
             self._load_segments()
 
         # Find rightmost value less than or equal to x
-        i = bisect_right(self._segments, (offset, self.context.memory[self._base_layer].maximum_address))
+        i = bisect_right(self._segments, (offset, self.context.layers[self._base_layer].maximum_address))
         if i and not next:
             segment = self._segments[i - 1]
             if segment[0] <= offset < segment[0] + segment[2]:

volatility/framework/layers/vmware.py

@@ -55,7 +55,7 @@ class VmwareLayer(segmented.SegmentedLayer):
         if "vmware" not in self._context.symbol_space:
             self._context.symbol_space.append(native.NativeTable("vmware", native.std_ctypes))
 
-        meta_layer = self.context.memory.get(self._meta_layer, None)
+        meta_layer = self.context.layers.get(self._meta_layer, None)
         header_size = struct.calcsize(self.header_structure)
         data = meta_layer.read(0, header_size)
         magic, unknown, groupCount = struct.unpack(self.header_structure, data)
@@ -131,21 +131,21 @@ class VmwareStacker(interfaces.automagic.StackerLayerInterface):
               layer_name: str,
               progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]:
         """Attempt to stack this based on the starting information"""
-        memlayer = context.memory[layer_name]
+        memlayer = context.layers[layer_name]
         if not isinstance(memlayer, physical.FileLayer):
             return None
         location = memlayer.location
         if location.endswith(".vmem"):
             vmss = location[:-5] + ".vmss"
             vmsn = location[:-5] + ".vmsn"
-            current_layer_name = context.memory.free_layer_name("VmwareMetaLayer")
+            current_layer_name = context.layers.free_layer_name("VmwareMetaLayer")
             current_config_path = interfaces.configuration.path_join("automagic", "layer_stacker", "stack",
                                                                      current_layer_name)
 
             try:
                 _ = resources.ResourceAccessor().open(vmss).read(10)
                 context.config[interfaces.configuration.path_join(current_config_path, "location")] = vmss
-                context.memory.add_layer(physical.FileLayer(context, current_config_path, current_layer_name))
+                context.layers.add_layer(physical.FileLayer(context, current_config_path, current_layer_name))
                 vmss_success = True
             except IOError:
                 vmss_success = False
@@ -154,14 +154,14 @@ class VmwareStacker(interfaces.automagic.StackerLayerInterface):
                 try:
                     _ = resources.ResourceAccessor().open(vmsn).read(10)
                     context.config[interfaces.configuration.path_join(current_config_path, "location")] = vmsn
-                    context.memory.add_layer(physical.FileLayer(context, current_config_path, current_layer_name))
+                    context.layers.add_layer(physical.FileLayer(context, current_config_path, current_layer_name))
                     vmsn_success = True
                 except IOError:
                     vmsn_success = False
 
             if not vmss_success and not vmsn_success:
                 return None
-            new_layer_name = context.memory.free_layer_name("VmwareLayer")
+            new_layer_name = context.layers.free_layer_name("VmwareLayer")
             context.config[interfaces.configuration.path_join(current_config_path, "base_layer")] = layer_name
             context.config[interfaces.configuration.path_join(current_config_path, "meta_layer")] = current_layer_name
             new_layer = VmwareLayer(context, current_config_path, new_layer_name)

volatility/framework/objects/__init__.py

@@ -143,7 +143,7 @@ class PrimitiveObject(interfaces.objects.ObjectInterface):
     @classmethod
     def _unmarshall(cls, context: interfaces.context.ContextInterface, data_format: DataFormatInfo,
                     object_info: ObjectInformation) -> TUnion[int, float, bool, bytes, str]:
-        data = context.memory.read(object_info.layer_name, object_info.offset, data_format.length)
+        data = context.layers.read(object_info.layer_name, object_info.offset, data_format.length)
         return convert_data_to_value(data, cls._struct_type, data_format)
 
     class VolTemplateProxy(interfaces.objects.ObjectInterface.VolTemplateProxy):
@@ -156,7 +156,7 @@ class PrimitiveObject(interfaces.objects.ObjectInterface):
     def write(self, value: TUnion[int, float, bool, bytes, str]) -> None:
         """Writes the object into the layer of the context at the current offset"""
         data = convert_value_to_data(value, self._struct_type, self._data_format)
-        return self._context.memory.write(self.vol.layer_name, self.vol.offset, data)
+        return self._context.layers.write(self.vol.layer_name, self.vol.offset, data)
 
 
 class Boolean(PrimitiveObject, int):
@@ -285,8 +285,8 @@ class Pointer(Integer):
         length, endian, signed = data_format
         if signed:
             raise TypeError("Pointers cannot have signed values")
-        mask = context.memory[object_info.native_layer_name].address_mask
+        mask = context.layers[object_info.native_layer_name].address_mask
-        data = context.memory.read(object_info.layer_name, object_info.offset, length)
+        data = context.layers.read(object_info.layer_name, object_info.offset, length)
         value = int.from_bytes(data, byteorder = endian, signed = signed)
         return value & mask
 
@@ -297,7 +297,7 @@ class Pointer(Integer):
            If layer_name is None, it defaults to the same layer that the pointer is currently instantiated in.
         """
         layer_name = layer_name or self.vol.native_layer_name
-        mask = self._context.memory[layer_name].address_mask
+        mask = self._context.layers[layer_name].address_mask
         offset = self & mask
         return self.vol.subtype(
             context = self._context,
@@ -306,7 +306,7 @@ class Pointer(Integer):
     def is_readable(self, layer_name: Optional[str] = None) -> bool:
         """Determines whether the address of this pointer can be read from memory"""
         layer_name = layer_name or self.vol.layer_name
-        return self._context.memory[layer_name].is_valid(self)
+        return self._context.layers[layer_name].is_valid(self)
 
     def __getattr__(self, attr: str) -> Any:
         """Convenience function to access unknown attributes by getting them from the subtype object"""
@@ -547,7 +547,7 @@ class Array(interfaces.objects.ObjectInterface, abc.Sequence):
     def __getitem__(self, i):
         """Returns the i-th item from the array"""
         result = []  # type: List[interfaces.objects.Template]
-        mask = self._context.memory[self.vol.layer_name].address_mask
+        mask = self._context.layers[self.vol.layer_name].address_mask
         # We use the range function to deal with slices for us
         series = range(self.vol.count)[i]
         return_list = True
@@ -652,7 +652,7 @@ class Struct(interfaces.objects.ObjectInterface):
         if attr in self._concrete_members:
             return self._concrete_members[attr]
         elif attr in self.vol.members:
-            mask = self._context.memory[self.vol.layer_name].address_mask
+            mask = self._context.layers[self.vol.layer_name].address_mask
             relative_offset, member = self.vol.members[attr]
             member = member(
                 context = self._context,

volatility/framework/plugins/layerwriter.py

@@ -56,16 +56,16 @@ class LayerWriter(plugins.PluginInterface):
 
     def _generator(self):
         if self.config.get('layer_name', None) is None:
-            for layer_name in self.context.memory:
+            for layer_name in self.context.layers:
                 yield 0, ("Layer '{}' available as '{}'".format(layer_name,
-                                                                self.context.memory[layer_name].__class__.__name__), )
+                                                                self.context.layers[layer_name].__class__.__name__), )
-        elif self.config['layer_name'] not in self.context.memory:
+        elif self.config['layer_name'] not in self.context.layers:
             yield 0, ('Layer Name does not exist', )
         elif os.path.exists(self.config.get('output', self.default_output_name)):
             yield 0, ('Refusing to overwrite existing output file', )
         else:
             chunk_size = self.config.get('block_size', self.default_block_size)
-            layer = self.context.memory[self.config['layer_name']]
+            layer = self.context.layers[self.config['layer_name']]
 
             try:
                 filedata = plugins.FileInterface(self.config.get('output', self.default_output_name))

volatility/framework/plugins/linux/bash.py

@@ -69,7 +69,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
             if not proc_layer_name:
                 continue
 
-            proc_layer = self.context.memory[proc_layer_name]
+            proc_layer = self.context.layers[proc_layer_name]
 
             bang_addrs = []
 

volatility/framework/plugins/linux/check_syscall.py

@@ -118,7 +118,7 @@ class Check_syscall(plugins.PluginInterface):
             # if we can't find the disassemble function then bail and rely on a different method
             return 0
 
-        data = self.context.memory.read(self.config['primary'], func_addr, 6)
+        data = self.context.layers.read(self.config['primary'], func_addr, 6)
 
         for (address, size, mnemonic, op_str) in md.disasm_lite(data, func_addr):
             if mnemonic == 'CMP':

volatility/framework/plugins/linux/elfs.py

@@ -48,7 +48,7 @@ class Elfs(plugins.PluginInterface):
             if not proc_layer_name:
                 continue
 
-            proc_layer = self.context.memory[proc_layer_name]
+            proc_layer = self.context.layers[proc_layer_name]
 
             name = utility.array_to_string(task.comm)
 

volatility/framework/plugins/linux/malfind.py

@@ -50,7 +50,7 @@ class Malfind(interfaces_plugins.PluginInterface):
         if not proc_layer_name:
             return
 
-        proc_layer = self.context.memory[proc_layer_name]
+        proc_layer = self.context.layers[proc_layer_name]
 
         for vma in task.mm.get_mmap_iter():
             if vma.is_suspicious() and vma.get_name(self.context, task) != "[vdso]":

volatility/framework/plugins/mac/bash.py

@@ -69,7 +69,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
             if proc_layer_name == None:
                 continue
 
-            proc_layer = self.context.memory[proc_layer_name]
+            proc_layer = self.context.layers[proc_layer_name]
 
             bang_addrs = []
 

volatility/framework/plugins/mac/malfind.py

@@ -48,7 +48,7 @@ class Malfind(interfaces_plugins.PluginInterface):
         if proc_layer_name is None:
             return
 
-        proc_layer = self.context.memory[proc_layer_name]
+        proc_layer = self.context.layers[proc_layer_name]
 
         for vma in task.get_map_iter():
             if vma.is_suspicious(self.context, self.config['darwin']):

volatility/framework/plugins/mac/psaux.py

@@ -44,7 +44,7 @@ class Psaux(plugins.PluginInterface):
             if proc_layer_name is None:
                 continue
 
-            proc_layer = self.context.memory[proc_layer_name]
+            proc_layer = self.context.layers[proc_layer_name]
 
             argsstart = task.user_stack - task.p_argslen
 

volatility/framework/plugins/mac/trustedbsd.py

@@ -58,7 +58,7 @@ class Check_syscall(plugins.PluginInterface):
             subtype = kernel.get_type('mac_policy_list_element'),
             count = policy_list.staticmax + 1)
 
-        mask = self.context.memory[self.config['primary']].address_mask
+        mask = self.context.layers[self.config['primary']].address_mask
         mods_list = [(mod.name, mod.address & mask, (mod.address & mask) + mod.size) for mod in mods]
 
         for i, ent in enumerate(entries):

volatility/framework/plugins/windows/handles.py

@@ -79,7 +79,7 @@ class Handles(interfaces_plugins.PluginInterface):
 
         try:
             # before windows 7
-            if not self.context.memory[virtual].is_valid(handle_table_entry.Object):
+            if not self.context.layers[virtual].is_valid(handle_table_entry.Object):
                 return None
             fast_ref = handle_table_entry.Object.cast(self.config["nt_symbols"] + constants.BANG + "_EX_FAST_REF")
             object_header = fast_ref.dereference().cast(self.config["nt_symbols"] + constants.BANG + "_OBJECT_HEADER")
@@ -116,7 +116,7 @@ class Handles(interfaces_plugins.PluginInterface):
                 return None
 
             virtual_layer_name = self.config['primary']
-            kvo = self.context.memory[virtual_layer_name].config['kernel_virtual_offset']
+            kvo = self.context.layers[virtual_layer_name].config['kernel_virtual_offset']
             ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = virtual_layer_name, offset = kvo)
 
             try:
@@ -124,7 +124,7 @@ class Handles(interfaces_plugins.PluginInterface):
             except exceptions.SymbolError:
                 return None
 
-            data = self.context.memory.read(virtual_layer_name, kvo + func_addr, 0x200)
+            data = self.context.layers.read(virtual_layer_name, kvo + func_addr, 0x200)
             if data == None:
                 return None
 
@@ -153,7 +153,7 @@ class Handles(interfaces_plugins.PluginInterface):
 
         type_map = {}
 
-        kvo = context.memory[layer_name].config['kernel_virtual_offset']
+        kvo = context.layers[layer_name].config['kernel_virtual_offset']
         ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo)
 
         try:
@@ -192,7 +192,7 @@ class Handles(interfaces_plugins.PluginInterface):
         except exceptions.SymbolError:
             return None
 
-        kvo = context.memory[layer_name].config['kernel_virtual_offset']
+        kvo = context.layers[layer_name].config['kernel_virtual_offset']
         return context.object(symbol_table + constants.BANG + "unsigned int", layer_name, offset = kvo + offset)
 
     def _make_handle_array(self, offset, level, depth = 0):
@@ -200,7 +200,7 @@ class Handles(interfaces_plugins.PluginInterface):
         entries, going as deep into the table "levels" as necessary."""
 
         virtual = self.config["primary"]
-        kvo = self.context.memory[virtual].config['kernel_virtual_offset']
+        kvo = self.context.layers[virtual].config['kernel_virtual_offset']
 
         ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = virtual, offset = kvo)
 
@@ -211,12 +211,12 @@ class Handles(interfaces_plugins.PluginInterface):
             subtype = ntkrnlmp.get_type("_HANDLE_TABLE_ENTRY")
             count = 0x1000 / subtype.size
 
-        if not self.context.memory[virtual].is_valid(offset):
+        if not self.context.layers[virtual].is_valid(offset):
             return
 
         table = ntkrnlmp.object(type_name = "array", offset = offset, subtype = subtype, count = int(count))
 
-        layer_object = self.context.memory[virtual]
+        layer_object = self.context.layers[virtual]
         masked_offset = (offset & layer_object.maximum_address)
 
         for entry in table:

volatility/framework/plugins/windows/info.py

@@ -48,12 +48,12 @@ class Info(plugins.PluginInterface):
             layer_name: the name of the starting layer
             index: the index/order of the layer
         """
-        layer = self.context.memory[layer_name]
+        layer = self.context.layers[layer_name]
         yield index, layer
         try:
             for depends in layer.dependencies:
                 for j, dep in self.get_depends(depends, index + 1):
-                    yield j, self.context.memory[dep.name]
+                    yield j, self.context.layers[dep.name]
         except AttributeError:
             # FileLayer won't have dependencies
             pass
@@ -61,7 +61,7 @@ class Info(plugins.PluginInterface):
     def _generator(self):
 
         virtual_layer_name = self.config["primary"]
-        virtual_layer = self.context.memory[virtual_layer_name]
+        virtual_layer = self.context.layers[virtual_layer_name]
         if not isinstance(virtual_layer, layers.intel.Intel):
             raise TypeError("Virtual Layer is not an intel layer")
 

volatility/framework/plugins/windows/malfind.py

@@ -78,7 +78,7 @@ class Malfind(interfaces.plugins.PluginInterface):
         """
 
         proc_layer_name = proc.add_process_layer()
-        proc_layer = context.memory[proc_layer_name]
+        proc_layer = context.layers[proc_layer_name]
 
         for vad in proc.get_vad_root().traverse():
             protection_string = vad.get_protection(

volatility/framework/plugins/windows/moddump.py

@@ -98,7 +98,7 @@ class ModDump(interfaces.plugins.PluginInterface):
         """
 
         for layer_name in session_layers:
-            if context.memory[layer_name].is_valid(base_address):
+            if context.layers[layer_name].is_valid(base_address):
                 return layer_name
 
         return None

volatility/framework/plugins/windows/modules.py

@@ -63,7 +63,7 @@ class Modules(interfaces.plugins.PluginInterface):
     def list_modules(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str):
         """Lists all the modules in the primary layer"""
 
-        kvo = context.memory[layer_name].config['kernel_virtual_offset']
+        kvo = context.layers[layer_name].config['kernel_virtual_offset']
         ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo)
 
         try:

volatility/framework/plugins/windows/poolscanner.py

@@ -260,9 +260,9 @@ class PoolScanner(plugins.PluginInterface):
             # registry hives
             PoolConstraint(
                 b'CM10',
-                type_name=symbol_table + constants.BANG + "_CMHIVE",
+                type_name = symbol_table + constants.BANG + "_CMHIVE",
-                size=(800, None),
+                size = (800, None),
-                page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE),
+                page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE),
         ]
 
         if not tags_filter:
@@ -292,7 +292,7 @@ class PoolScanner(plugins.PluginInterface):
 
         # switch to a non-virtual layer if necessary
         if not is_windows_10:
-            scan_layer = context.memory[scan_layer].config['memory_layer']
+            scan_layer = context.layers[scan_layer].config['memory_layer']
 
         for constraint, header in cls.pool_scan(context, scan_layer, symbol_table, constraints, alignment = 8):
 
@@ -355,7 +355,7 @@ class PoolScanner(plugins.PluginInterface):
         header_offset = header_type.relative_child_offset('PoolTag')
 
         # Run the scan locating the offsets of a particular tag
-        layer = context.memory[layer_name]
+        layer = context.layers[layer_name]
         scanner = scanners.MultiStringScanner([c for c in constraint_lookup.keys()])
         for offset, pattern in layer.scan(context, scanner, progress_callback = progress_callback):
             for constraint in constraint_lookup[pattern]:

volatility/framework/plugins/windows/pslist.py

@@ -72,7 +72,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
         """Lists all the processes in the primary layer that are in the pid config option"""
 
         # We only use the object factory to demonstrate how to use one
-        kvo = context.memory[layer_name].config['kernel_virtual_offset']
+        kvo = context.layers[layer_name].config['kernel_virtual_offset']
         ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo)
 
         ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address
@@ -108,7 +108,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
                 offset = proc.vol.offset
             else:
                 layer_name = self.config['primary']
-                memory = self.context.memory[layer_name]
+                memory = self.context.layers[layer_name]
                 if not isinstance(memory, layers.intel.Intel):
                     raise TypeError("Primary layer is not an intel layer")
                 (_, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0]

volatility/framework/plugins/windows/pstree.py

@@ -56,7 +56,7 @@ class PsTree(pslist.PsList):
                 offset = proc.vol.offset
             else:
                 layer_name = self.config['primary']
-                memory = self.context.memory[layer_name]
+                memory = self.context.layers[layer_name]
                 (_, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0]
 
             self._processes[proc.UniqueProcessId] = proc

volatility/framework/plugins/windows/registry/hivelist.py

@@ -59,7 +59,7 @@ class HiveList(plugins.PluginInterface):
         """Lists all the hives in the primary layer"""
 
         # We only use the object factory to demonstrate how to use one
-        kvo = context.memory[layer_name].config['kernel_virtual_offset']
+        kvo = context.layers[layer_name].config['kernel_virtual_offset']
         ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo)
 
         list_head = ntkrnlmp.get_symbol("CmpHiveListHead").address

volatility/framework/plugins/windows/registry/printkey.py

@@ -98,7 +98,7 @@ class PrintKey(interfaces.plugins.PluginInterface):
                 hive_offset = hive_offset, base_layer = self.config['primary'], nt_symbols = self.config['nt_symbols'])
             hive = RegistryHive(self.context, reg_config_path, name = 'hive' + hex(hive_offset))
             try:
-                self.context.memory.add_layer(hive)
+                self.context.layers.add_layer(hive)
 
                 # Walk it
                 if 'key' in self.config:

volatility/framework/plugins/windows/registry/userassist.py

@@ -82,7 +82,7 @@ class UserAssist(interfaces.plugins.PluginInterface):
         if len(userassist_data) < self._userassist_size:
             return item
 
-        userassist_layer_name = self.context.memory.free_layer_name("userassist_buffer")
+        userassist_layer_name = self.context.layers.free_layer_name("userassist_buffer")
         buffer = BufferDataLayer(self.context, self._config_path, userassist_layer_name, userassist_data)
         self.context.add_layer(buffer)
         userassist_obj = self.context.object(
@@ -247,7 +247,7 @@ class UserAssist(interfaces.plugins.PluginInterface):
             try:
                 hive = RegistryHive(self.context, reg_config_path, name = 'hive' + hex(hive_offset))
                 hive_name = hive.hive.cast(self.config["nt_symbols"] + constants.BANG + "_CMHIVE").get_name()
-                self.context.memory.add_layer(hive)
+                self.context.layers.add_layer(hive)
                 yield from self.list_userassist(hive)
                 continue
             except exceptions.PagedInvalidAddressException as excp:

volatility/framework/plugins/windows/ssdt.py

@@ -77,7 +77,7 @@ class SSDT(plugins.PluginInterface):
         layer_name = self.config['primary']
         collection = self.build_module_collection(self.context, self.config["primary"], self.config["nt_symbols"])
 
-        kvo = self.context.memory[layer_name].config['kernel_virtual_offset']
+        kvo = self.context.layers[layer_name].config['kernel_virtual_offset']
         ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = layer_name, offset = kvo)
 
         # this is just one way to enumerate the native (NT) service table.

volatility/framework/plugins/windows/strings.py

@@ -78,7 +78,7 @@ class Strings(interfaces.plugins.PluginInterface):
 
     def generate_mapping(self, layer_name: str) -> Dict[int, Set[Tuple[str, int]]]:
         """Creates a reverse mapping between virtual addresses and physical addresses"""
-        layer = self._context.memory[layer_name]
+        layer = self._context.layers[layer_name]
         reverse_map = dict()  # type: Dict[int, Set[Tuple[str, int]]]
         if isinstance(layer, intel.Intel):
             # We don't care about errors, we just wanted chunks that map correctly
@@ -95,7 +95,7 @@ class Strings(interfaces.plugins.PluginInterface):
             for process in pslist.PsList.list_processes(self.context, self.config['primary'],
                                                         self.config['nt_symbols']):
                 proc_layer_name = process.add_process_layer()
-                proc_layer = self.context.memory[proc_layer_name]
+                proc_layer = self.context.layers[proc_layer_name]
                 if isinstance(proc_layer, interfaces.layers.TranslationLayerInterface):
                     for mapval in proc_layer.mapping(0x0, proc_layer.maximum_address, ignore_errors = True):
                         kpage, vpage, page_size, maplayer = mapval

volatility/framework/plugins/windows/vaddump.py

@@ -62,7 +62,7 @@ class VadDump(interfaces_plugins.PluginInterface):
 
             # TODO: what kind of exceptions could this raise and what should we do?
             proc_layer_name = proc.add_process_layer()
-            proc_layer = self.context.memory[proc_layer_name]
+            proc_layer = self.context.layers[proc_layer_name]
 
             for vad in vadinfo.VadInfo.list_vads(proc, filter_func = filter_func):
                 try:

volatility/framework/plugins/windows/vadinfo.py

@@ -75,7 +75,7 @@ class VadInfo(interfaces.plugins.PluginInterface):
         These don't change often, but if they do in the future, then finding them
         # dynamically versus hard-coding here will ensure we parse them properly."""
 
-        kvo = context.memory[virtual_layer].config["kernel_virtual_offset"]
+        kvo = context.layers[virtual_layer].config["kernel_virtual_offset"]
         ntkrnlmp = context.module(nt_symbols, layer_name = virtual_layer, offset = kvo)
         addr = ntkrnlmp.get_symbol("MmProtectToValue").address
         values = ntkrnlmp.object(

volatility/framework/plugins/windows/vadyarascan.py

@@ -58,7 +58,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
 
     def _generator(self):
 
-        layer = self.context.memory[self.config['primary']]
+        layer = self.context.layers[self.config['primary']]
         rules = None
         if self.config.get('yara_rules', None) is not None:
             rule = self.config['yara_rules']

volatility/framework/plugins/yarascan.py

@@ -80,7 +80,7 @@ class YaraScan(plugins.PluginInterface):
 
     def _generator(self):
 
-        layer = self.context.memory[self.config['primary']]
+        layer = self.context.layers[self.config['primary']]
         rules = None
         if self.config.get('yara_rules', None) is not None:
             rule = self.config['yara_rules']

volatility/framework/symbols/generic/__init__.py

@@ -42,13 +42,13 @@ class GenericIntelProcess(objects.Struct):
 
         # Figure out a suitable name we can use for the new layer
         if preferred_name is None:
-            preferred_name = context.memory.free_layer_name(prefix = self.vol.layer_name + "_Process_")
+            preferred_name = context.layers.free_layer_name(prefix = self.vol.layer_name + "_Process_")
         else:
-            if preferred_name in context.memory:
+            if preferred_name in context.layers:
-                preferred_name = context.memory.free_layer_name(prefix = preferred_name)
+                preferred_name = context.layers.free_layer_name(prefix = preferred_name)
 
         # Copy the parent's config and then make suitable changes
-        parent_layer = context.memory[self.vol.layer_name]
+        parent_layer = context.layers[self.vol.layer_name]
         parent_config = parent_layer.build_configuration()
         # It's an intel layer, because we hardwire the "memory_layer" config option
         # FIXME: this could be for other architectures if we don't hardwire this/these values
@@ -61,5 +61,5 @@ class GenericIntelProcess(objects.Struct):
         new_layer = parent_layer.__class__(context, config_path = config_path, name = preferred_name)
 
         # Add the constructed layer and return the name
-        context.memory.add_layer(new_layer)
+        context.layers.add_layer(new_layer)
         return preferred_name

volatility/framework/symbols/linux/extensions/__init__.py

@@ -61,7 +61,7 @@ class task_struct(generic.GenericIntelProcess):
         Returns the name of the Layer or None.
         """
 
-        parent_layer = self._context.memory[self.vol.layer_name]
+        parent_layer = self._context.layers[self.vol.layer_name]
         try:
             pgd = self.mm.pgd
         except exceptions.PagedInvalidAddressException:

volatility/framework/symbols/mac/extensions/__init__.py

@@ -36,7 +36,7 @@ class proc(generic.GenericIntelProcess):
         """Constructs a new layer based on the process's DTB.
         Returns the name of the Layer or None.
         """
-        parent_layer = self._context.memory[self.vol.layer_name]
+        parent_layer = self._context.layers[self.vol.layer_name]
 
         if not isinstance(parent_layer, interfaces.layers.TranslationLayerInterface):
             raise TypeError("Parent layer is not a translation layer, unable to construct process layer")

volatility/framework/symbols/windows/extensions/__init__.py

@@ -472,12 +472,12 @@ class _FILE_OBJECT(objects.Struct, ExecutiveObject):
 
     def is_valid(self) -> bool:
         """Determine if the object is valid"""
-        return self.FileName.Length > 0 and self._context.memory[self.vol.layer_name].is_valid(self.FileName.Buffer)
+        return self.FileName.Length > 0 and self._context.layers[self.vol.layer_name].is_valid(self.FileName.Buffer)
 
     def file_name_with_device(self) -> Union[str, interfaces.renderers.BaseAbsentValue]:
         name = renderers.UnreadableValue()  # type: Union[str, interfaces.renderers.BaseAbsentValue]
 
-        if self._context.memory[self.vol.layer_name].is_valid(self.DeviceObject):
+        if self._context.layers[self.vol.layer_name].is_valid(self.DeviceObject):
             name = "\\Device\\{}".format(self.DeviceObject.get_device_name())
 
         try:
@@ -550,7 +550,7 @@ class _OBJECT_HEADER(objects.Struct):
             # http://codemachine.com/article_objectheader.html (Windows 7 and later)
             name_info_bit = 0x2
 
-            layer = self._context.memory[self.vol.native_layer_name]
+            layer = self._context.layers[self.vol.native_layer_name]
             kvo = layer.config.get("kernel_virtual_offset", None)
 
             if kvo == None:
@@ -638,7 +638,7 @@ class _EPROCESS(generic.GenericIntelProcess, ExecutiveObject):
     def add_process_layer(self, config_prefix: str = None, preferred_name: str = None):
         """Constructs a new layer based on the process's DirectoryTableBase"""
 
-        parent_layer = self._context.memory[self.vol.layer_name]
+        parent_layer = self._context.layers[self.vol.layer_name]
 
         if not isinstance(parent_layer, intel.Intel):
             # We can't get bits_per_register unless we're an intel space (since that's not defined at the higher layer)
@@ -663,7 +663,7 @@ class _EPROCESS(generic.GenericIntelProcess, ExecutiveObject):
 
         proc_layer_name = self.add_process_layer()
 
-        proc_layer = self._context.memory[proc_layer_name]
+        proc_layer = self._context.layers[proc_layer_name]
         if not proc_layer.is_valid(self.Peb):
             return
 
@@ -694,7 +694,7 @@ class _EPROCESS(generic.GenericIntelProcess, ExecutiveObject):
                     return renderers.NotApplicableValue()
 
                 symbol_table_name = self.get_symbol_table().name
-                kvo = self._context.memory[self.vol.native_layer_name].config['kernel_virtual_offset']
+                kvo = self._context.layers[self.vol.native_layer_name].config['kernel_virtual_offset']
                 ntkrnlmp = self._context.module(
                     symbol_table_name,
                     layer_name = self.vol.native_layer_name,

volatility/framework/symbols/windows/extensions/pe.py

@@ -119,7 +119,7 @@ class _IMAGE_DOS_HEADER(objects.Struct):
         if size_of_image > (1024 * 1024 * 100):
             raise ValueError("The claimed SizeOfImage is too large: {}".format(size_of_image))
 
-        read_layer = self._context.memory[layer_name]
+        read_layer = self._context.layers[layer_name]
 
         raw_data = read_layer.read(self.vol.offset, nt_header.OptionalHeader.SizeOfImage, pad = True)
 

volatility/framework/symbols/windows/extensions/registry.py

@@ -140,13 +140,13 @@ class _CM_KEY_NODE(objects.Struct):
     """Extension to allow traversal of registry keys"""
 
     def get_volatile(self) -> bool:
-        if not isinstance(self._context.memory[self.vol.layer_name], RegistryHive):
+        if not isinstance(self._context.layers[self.vol.layer_name], RegistryHive):
             raise ValueError("Cannot determine volatility of registry key without an offset in a RegistryHive layer")
         return bool(self.vol.offset & 0x80000000)
 
     def get_subkeys(self) -> Iterable[interfaces.objects.ObjectInterface]:
         """Returns a list of the key nodes"""
-        hive = self._context.memory[self.vol.layer_name]
+        hive = self._context.layers[self.vol.layer_name]
         if not isinstance(hive, RegistryHive):
             raise TypeError("CM_KEY_NODE was not instantiated on a RegistryHive layer")
         for index in range(2):
@@ -184,7 +184,7 @@ class _CM_KEY_NODE(objects.Struct):
 
     def get_values(self) -> Iterable[interfaces.objects.ObjectInterface]:
         """Returns a list of the Value nodes for a key"""
-        hive = self._context.memory[self.vol.layer_name]
+        hive = self._context.layers[self.vol.layer_name]
         if not isinstance(hive, RegistryHive):
             raise TypeError("CM_KEY_NODE was not instantiated on a RegistryHive layer")
         child_list = hive.get_cell(self.ValueList.List).u.KeyList
@@ -200,7 +200,7 @@ class _CM_KEY_NODE(objects.Struct):
         return self.Name.cast("string", max_length = self.NameLength, encoding = "latin-1")
 
     def get_key_path(self) -> interfaces.objects.ObjectInterface:
-        reg = self._context.memory[self.vol.layer_name]
+        reg = self._context.layers[self.vol.layer_name]
         if not isinstance(reg, RegistryHive):
             raise TypeError("Key was not instantiated on a RegistryHive layer")
         # Using the offset adds a significant delay (since it cannot be cached easily)
@@ -224,7 +224,7 @@ class _CM_KEY_VALUE(objects.Struct):
         datalen = self.DataLength & 0x7fffffff
         data = b""
         # Check if the data is stored inline
-        layer = self._context.memory[self.vol.layer_name]
+        layer = self._context.layers[self.vol.layer_name]
         if not isinstance(layer, RegistryHive):
             raise TypeError("Key value was not instantiated on a RegistryHive layer")
 

volatility/plugins/windows/statistics.py

@@ -37,7 +37,7 @@ class Statistics(plugins.PluginInterface):
 
     def _generator(self):
         # Do mass mapping and determine the number of different layers and how many pages go to each one
-        layer = self.context.memory[self.config['primary']]
+        layer = self.context.layers[self.config['primary']]
 
         page_count = swap_count = invalid_page_count = large_page_count = large_swap_count = large_invalid_count = 0