diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py new file mode 100644 index 000000000..92e99c1a9 --- /dev/null +++ b/volatility/framework/automagic/linux.py @@ -0,0 +1,21 @@ +from volatility.framework import interfaces +from volatility.framework.layers import scanners, intel + + +class LintelStacker(interfaces.automagic.StackerLayerInterface): + # This signature makes an assumption that Linux is using a Symmetric Multi-Processor + linux_signature = b"Linux [^ ]* [0-9]\.[0-9]+\.[0-9]+[^ ]* #[0-9]+ SMP" + + @classmethod + def stack(cls, context, layer_name, progress_callback = None): + """Attempts to identify linux within this layer""" + layer = context.memory[layer_name] + + # Bail out if we're not a physical layer + if isinstance(layer, intel.Intel): + return None + + for offset in layer.scan(scanner = scanners.RegExScanner(cls.linux_signature), context = context): + # print("Offset: ", hex(offset)) + # print(context.memory[layer_name].read(offset, 100)) + break