diff --git a/volatility/framework/layers/physical.py b/volatility/framework/layers/physical.py index d77250270..f0b36059f 100644 --- a/volatility/framework/layers/physical.py +++ b/volatility/framework/layers/physical.py @@ -70,6 +70,11 @@ class FileLayer(interfaces.layers.DataLayerInterface): self._file_ = None self._size = os.path.getsize(self._filename) + @property + def filename(self): + """Returns the filename on which this Layer abstracts""" + return self._filename + @property def _file(self): """Property to prevent the initializer storing an unserializable open file (for context cloning)""" diff --git a/volatility/framework/layers/vmware.py b/volatility/framework/layers/vmware.py index 6583725cd..542547228 100644 --- a/volatility/framework/layers/vmware.py +++ b/volatility/framework/layers/vmware.py @@ -1,6 +1,5 @@ import os import struct -from urllib import parse from volatility.framework import interfaces from volatility.framework.configuration import requirements @@ -107,12 +106,10 @@ class VmwareStacker(interfaces.automagic.StackerLayerInterface): """Attempt to stack this based on the starting information""" if not isinstance(context.memory[layer_name], physical.FileLayer): return - if not context.config.get("automagic.general.single_location", None): - return - location = parse.urlparse(context.config["automagic.general.single_location"]) - if location.path.endswith(".vmem"): - vmss = location.path[:-5] + ".vmss" - vmsn = location.path[:-5] + ".vmsn" + location = context.memory[layer_name].filename + if location.endswith(".vmem"): + vmss = location[:-5] + ".vmss" + vmsn = location[:-5] + ".vmsn" current_layer_name = context.memory.free_layer_name("VmwareMetaLayer") current_config_path = interfaces.configuration.path_join("automagic", "layer_stacker", "stack", current_layer_name)