Add in first draft of Linux identification stacker.

volatility/framework/automagic/linux.py

@@ -0,0 +1,21 @@
+from volatility.framework import interfaces
+from volatility.framework.layers import scanners, intel
+
+
+class LintelStacker(interfaces.automagic.StackerLayerInterface):
+    # This signature makes an assumption that Linux is using a Symmetric Multi-Processor
+    linux_signature = b"Linux [^ ]* [0-9]\.[0-9]+\.[0-9]+[^ ]* #[0-9]+ SMP"
+
+    @classmethod
+    def stack(cls, context, layer_name, progress_callback = None):
+        """Attempts to identify linux within this layer"""
+        layer = context.memory[layer_name]
+
+        # Bail out if we're not a physical layer
+        if isinstance(layer, intel.Intel):
+            return None
+
+        for offset in layer.scan(scanner = scanners.RegExScanner(cls.linux_signature), context = context):
+            # print("Offset: ", hex(offset))
+            # print(context.memory[layer_name].read(offset, 100))
+            break