From 3ad20d566c943c4ed2cd5017ea0cef1ff193eaae Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 11 Aug 2021 21:51:41 +0100
Subject: [PATCH] Automagic: Minor fixes for jar files and layers

---
 .../framework/automagic/symbol_cache.py       | 21 ++++++++++---------
 .../framework/automagic/symbol_finder.py      |  3 ++-
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/volatility3/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py
index 8010364f8..b2c227228 100644
--- a/volatility3/framework/automagic/symbol_cache.py
+++ b/volatility3/framework/automagic/symbol_cache.py
@@ -10,6 +10,7 @@ import pickle
 import urllib
 import urllib.parse
 import urllib.request
+import zipfile
 from typing import Dict, List, Optional
 
 from volatility3.framework import constants, exceptions, interfaces
@@ -53,13 +54,13 @@ class SymbolBannerCache(interfaces.automagic.AutomagicInterface):
                             path, str(banner or b'', 'latin-1')))
                     banners[banner].remove(path)
                 # This is probably excessive, but it's here if we need it
-                # if url.scheme == 'jar':
-                #     zip_file, zip_path = url.path.split("!")
-                #     zip_file = urllib.parse.urlparse(zip_file).path
-                #     if ((not os.path.exists(zip_file)) or (zip_path not in zipfile.ZipFile(zip_file).namelist())):
-                #         vollog.log(constants.LOGLEVEL_VV,
-                #                    "Removing cached path {} for banner {}: file does not exist".format(path, banner))
-                #         banners[banner].remove(path)
+                if url.scheme == 'jar':
+                    zip_file, zip_path = url.path.split("!")
+                    zip_file = urllib.parse.urlparse(zip_file).path
+                    if ((not os.path.exists(zip_file)) or (zip_path not in zipfile.ZipFile(zip_file).namelist())):
+                        vollog.log(constants.LOGLEVEL_VV,
+                                   "Removing cached path {} for banner {}: file does not exist".format(path, banner))
+                        banners[banner].remove(path)
 
             if not banners[banner]:
                 remove_banners.append(banner)
@@ -100,7 +101,7 @@ class SymbolBannerCache(interfaces.automagic.AutomagicInterface):
         self.save_banners(banners)
 
         if progress_callback is not None:
-            progress_callback(100, "Built {} caches".format(self.os))
+            progress_callback(100, f"Built {self.os} caches")
 
     @classmethod
     def read_new_banners(cls, context: interfaces.context.ContextInterface, config_path: str, new_urls: List[str],
@@ -114,10 +115,10 @@ class SymbolBannerCache(interfaces.automagic.AutomagicInterface):
 
         total = len(new_urls)
         if total > 0:
-            vollog.info(f"Building {self.os} caches...")
+            vollog.info(f"Building {operating_system} caches...")
         for current in range(total):
             if progress_callback is not None:
-                progress_callback(current * 100 / total, f"Building {self.os} caches")
+                progress_callback(current * 100 / total, f"Building {operating_system} caches")
             isf_url = new_urls[current]
 
             isf = None
diff --git a/volatility3/framework/automagic/symbol_finder.py b/volatility3/framework/automagic/symbol_finder.py
index 03d051c49..f3a597a3c 100644
--- a/volatility3/framework/automagic/symbol_finder.py
+++ b/volatility3/framework/automagic/symbol_finder.py
@@ -94,7 +94,8 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface):
         else:
             # Swap to the physical layer for scanning
             # TODO: Fix this so it works for layers other than just Intel
-            layer = context.layers[layer.config['memory_layer']]
+            if isinstance(layer, layers.intel.Intel):
+                layer = context.layers[layer.config['memory_layer']]
             banner_list = layer.scan(context = context, scanner = mss, progress_callback = progress_callback)
 
         for _, banner in banner_list: