WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-30 11:49:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ensure we don't run the DTB finder twice.

Browse Source
This commit is contained in:
Mike Auty
2017-05-01 14:34:52 +01:00
parent e182e44815
commit 44d8af70e0
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/automagic/windows.py
+10 -6
View File
@@ -234,12 +234,16 @@ class WintelHelper(interfaces.automagic.AutomagicInterface):
# Once an appropriate class has been chosen, attempt to determine the page_map_offset value
if ("memory_layer" in requirement.requirements and
not requirement.requirements["memory_layer"].unsatisfied(context, sub_config_path)):
physical_layer = requirement.requirements["memory_layer"].config_value(context, sub_config_path)
hits = context.memory[physical_layer].scan(context, PageMapScanner(useful), progress_callback)
for test, dtb in hits:
context.config[interfaces.configuration.path_join(sub_config_path, "page_map_offset")] = dtb
requirement.construct(context, config_path)
break
# Only bother getting the DTB if we don't already have one
if not context.config.get(interfaces.configuration.path_join(sub_config_path, "page_map_offset"), None):
physical_layer = requirement.requirements["memory_layer"].config_value(context, sub_config_path)
hits = context.memory[physical_layer].scan(context, PageMapScanner(useful), progress_callback)
for test, dtb in hits:
context.config[interfaces.configuration.path_join(sub_config_path, "page_map_offset")] = dtb
break
else:
return
requirement.construct(context, config_path)
else:
for subreq in requirement.requirements.values():
self(context, sub_config_path, subreq)