From 44d8af70e035ec2ff7d1771f75290e6de728ea9c Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 1 May 2017 14:34:52 +0100 Subject: [PATCH] Ensure we don't run the DTB finder twice. --- volatility/framework/automagic/windows.py | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/volatility/framework/automagic/windows.py b/volatility/framework/automagic/windows.py index 07fc85a2a..9b7f56124 100644 --- a/volatility/framework/automagic/windows.py +++ b/volatility/framework/automagic/windows.py @@ -234,12 +234,16 @@ class WintelHelper(interfaces.automagic.AutomagicInterface): # Once an appropriate class has been chosen, attempt to determine the page_map_offset value if ("memory_layer" in requirement.requirements and not requirement.requirements["memory_layer"].unsatisfied(context, sub_config_path)): - physical_layer = requirement.requirements["memory_layer"].config_value(context, sub_config_path) - hits = context.memory[physical_layer].scan(context, PageMapScanner(useful), progress_callback) - for test, dtb in hits: - context.config[interfaces.configuration.path_join(sub_config_path, "page_map_offset")] = dtb - requirement.construct(context, config_path) - break + # Only bother getting the DTB if we don't already have one + if not context.config.get(interfaces.configuration.path_join(sub_config_path, "page_map_offset"), None): + physical_layer = requirement.requirements["memory_layer"].config_value(context, sub_config_path) + hits = context.memory[physical_layer].scan(context, PageMapScanner(useful), progress_callback) + for test, dtb in hits: + context.config[interfaces.configuration.path_join(sub_config_path, "page_map_offset")] = dtb + break + else: + return + requirement.construct(context, config_path) else: for subreq in requirement.requirements.values(): self(context, sub_config_path, subreq)