From 4cccbc2f696977ce8c0d77cb96a362e299855269 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 2 Jul 2020 17:53:12 +0100 Subject: [PATCH] Automagic: Fix os_chooser method Two issues found: * the plugin hierarchy always start volatility.plugins, so we need to go to index 2. * the layers weren't loaded at the time the stacker list was generated so all other stackers failed. --- volatility/framework/automagic/stacker.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility/framework/automagic/stacker.py b/volatility/framework/automagic/stacker.py index 3bd7ce95a..3ccbe18ca 100644 --- a/volatility/framework/automagic/stacker.py +++ b/volatility/framework/automagic/stacker.py @@ -247,7 +247,10 @@ class LayerStacker(interfaces.automagic.AutomagicInterface): def choose_os_stackers(plugin): """Identifies the stackers that should be run, based on the plugin (and thus os) provided""" - plugin_first_level = plugin.__module__.split('.')[0] + plugin_first_level = plugin.__module__.split('.')[2] + + # Ensure all stackers are loaded + framework.import_files(sys.modules['volatility.framework.layers']) result = [] for stacker in sorted(framework.class_subclasses(interfaces.automagic.StackerLayerInterface),