WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 17:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Automagic: Minor fixes for jar files and layers

Browse Source
This commit is contained in:
Mike Auty
2021-08-11 21:51:41 +01:00
parent e7623baf45
commit 3ad20d566c
2 changed files with 13 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/automagic/symbol_cache.py
+11 -10
View File
@@ -10,6 +10,7 @@ import pickle
import urllib
import urllib.parse
import urllib.request
import zipfile
from typing import Dict, List, Optional
from volatility3.framework import constants, exceptions, interfaces
@@ -53,13 +54,13 @@ class SymbolBannerCache(interfaces.automagic.AutomagicInterface):
path, str(banner or b'', 'latin-1')))
banners[banner].remove(path)
# This is probably excessive, but it's here if we need it
# if url.scheme == 'jar':
# zip_file, zip_path = url.path.split("!")
# zip_file = urllib.parse.urlparse(zip_file).path
# if ((not os.path.exists(zip_file)) or (zip_path not in zipfile.ZipFile(zip_file).namelist())):
# vollog.log(constants.LOGLEVEL_VV,
# "Removing cached path {} for banner {}: file does not exist".format(path, banner))
# banners[banner].remove(path)
if url.scheme == 'jar':
zip_file, zip_path = url.path.split("!")
zip_file = urllib.parse.urlparse(zip_file).path
if ((not os.path.exists(zip_file)) or (zip_path not in zipfile.ZipFile(zip_file).namelist())):
vollog.log(constants.LOGLEVEL_VV,
"Removing cached path {} for banner {}: file does not exist".format(path, banner))
banners[banner].remove(path)
if not banners[banner]:
remove_banners.append(banner)
@@ -100,7 +101,7 @@ class SymbolBannerCache(interfaces.automagic.AutomagicInterface):
self.save_banners(banners)
if progress_callback is not None:
progress_callback(100, "Built {} caches".format(self.os))
progress_callback(100, f"Built {self.os} caches")
@classmethod
def read_new_banners(cls, context: interfaces.context.ContextInterface, config_path: str, new_urls: List[str],
@@ -114,10 +115,10 @@ class SymbolBannerCache(interfaces.automagic.AutomagicInterface):
total = len(new_urls)
if total > 0:
vollog.info(f"Building {self.os} caches...")
vollog.info(f"Building {operating_system} caches...")
for current in range(total):
if progress_callback is not None:
progress_callback(current * 100 / total, f"Building {self.os} caches")
progress_callback(current * 100 / total, f"Building {operating_system} caches")
isf_url = new_urls[current]
isf = None
volatility3/framework/automagic/symbol_finder.py
+2 -1
View File
@@ -94,7 +94,8 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface):
else:
# Swap to the physical layer for scanning
# TODO: Fix this so it works for layers other than just Intel
layer = context.layers[layer.config['memory_layer']]
if isinstance(layer, layers.intel.Intel):
layer = context.layers[layer.config['memory_layer']]
banner_list = layer.scan(context = context, scanner = mss, progress_callback = progress_callback)
for _, banner in banner_list: