Do some tidying and renaming.

This commit is contained in:
Mike Auty
2018-12-13 15:56:24 +00:00
committed by ikelos
parent 7a462d5f85
commit 5135215c62
5 changed files with 20 additions and 16 deletions
+2 -2
View File
@@ -26,12 +26,12 @@ windows_automagic = ['ConstructionMagic',
linux_automagic = ['ConstructionMagic',
'LayerStacker',
'LinuxSymbolCache',
'LinuxBannerCache',
'LinuxSymbolFinder']
mac_automagic = ['ConstructionMagic',
'LayerStacker',
'MacSymbolCache',
'MacBannerCache',
'MacSymbolFinder']
+7 -3
View File
@@ -11,16 +11,20 @@ from volatility.framework.symbols import linux
vollog = logging.getLogger(__name__)
class LinuxSymbolCache(symbol_cache.SymbolCache):
class LinuxBannerCache(symbol_cache.SymbolBannerCache):
"""Caches the banners found in the Linux symbol files"""
os = "linux"
symbol_name = "linux_banner"
banner_path = constants.LINUX_BANNERS_PATH
class LinuxSymbolFinder(symbol_finder.SymbolFinder):
"""Linux symbol loader based on uname signature strings"""
banner_config_key = "linux_banner"
banner_cache = LinuxBannerCache
symbol_class = "volatility.framework.symbols.linux.LinuxKernelIntermedSymbols"
cache = LinuxSymbolCache
class LintelStacker(interfaces.automagic.StackerLayerInterface):
@@ -42,7 +46,7 @@ class LintelStacker(interfaces.automagic.StackerLayerInterface):
if isinstance(layer, intel.Intel):
return None
linux_banners = LinuxSymbolCache.load_banners()
linux_banners = LinuxBannerCache.load_banners()
mss = scanners.MultiStringScanner([x for x in linux_banners if x is not None])
for _, banner in layer.scan(context = context, scanner = mss, progress_callback = progress_callback):
dtb = None
+4 -3
View File
@@ -11,7 +11,8 @@ from volatility.framework.symbols import mac
vollog = logging.getLogger(__name__)
class MacSymbolCache(symbol_cache.SymbolCache):
class MacBannerCache(symbol_cache.SymbolBannerCache):
"""Caches the banners found in the Mac symbol files"""
os = "mac"
symbol_name = "version"
banner_path = constants.MAC_BANNERS_PATH
@@ -21,8 +22,8 @@ class MacSymbolFinder(symbol_finder.SymbolFinder):
"""Mac symbol loader based on uname signature strings"""
banner_config_key = 'mac_banner'
banner_cache = MacBannerCache
symbol_class = "volatility.framework.symbols.mac.MacKernelIntermedSymbols"
cache = MacSymbolCache
class MacintelStacker(interfaces.automagic.StackerLayerInterface):
@@ -44,7 +45,7 @@ class MacintelStacker(interfaces.automagic.StackerLayerInterface):
if isinstance(layer, intel.Intel):
return None
mac_banners = MacSymbolCache.load_banners()
mac_banners = MacBannerCache.load_banners()
mss = scanners.MultiStringScanner([x for x in mac_banners if x is not None])
for banner_offset, banner in layer.scan(context = context, scanner = mss,
@@ -14,17 +14,16 @@ vollog = logging.getLogger(__name__)
BannersType = typing.Dict[bytes, typing.List[str]]
class SymbolCache(interfaces.automagic.AutomagicInterface):
class SymbolBannerCache(interfaces.automagic.AutomagicInterface):
"""Runs through all symbols tables and caches their banners"""
# Since this is necessary for ConstructionMagic, we set a lower priority
# The user would run it eventually either way, but running it first means it can be used that run
priority = 0
# Default to Linux values, but no OS so we bomb out early when necessary
os = None
symbol_name = "linux_banner"
banner_path = constants.LINUX_BANNERS_PATH
symbol_name = "banner_name"
banner_path = None
@classmethod
def load_banners(cls) -> BannersType:
@@ -103,5 +102,5 @@ class SymbolCache(interfaces.automagic.AutomagicInterface):
except exceptions.SymbolError:
pass
# Rewrite the cached banners each run, since writing is faster than the cache validation portion
# Rewrite the cached banners each run, since writing is faster than the banner_cache validation portion
self.save_banners(banners)
@@ -14,8 +14,8 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface):
priority = 40
banner_config_key = "banner"
banner_cache = None
symbol_class = None
cache = None
def __init__(self,
context: interfaces.context.ContextInterface,
@@ -28,9 +28,9 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface):
def banners(self) -> symbol_cache.BannersType:
"""Creates a cached copy of the results, but only it's been requested"""
if not self._banners:
if not self.cache:
if not self.banner_cache:
raise RuntimeError("Cache has not been properly defined for {}".format(self.__class__.__name__))
self._banners = self.cache.load_banners()
self._banners = self.banner_cache.load_banners()
return self._banners
def __call__(self,