mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-09 11:17:38 +02:00
Do some tidying and renaming.
This commit is contained in:
@@ -26,12 +26,12 @@ windows_automagic = ['ConstructionMagic',
|
||||
|
||||
linux_automagic = ['ConstructionMagic',
|
||||
'LayerStacker',
|
||||
'LinuxSymbolCache',
|
||||
'LinuxBannerCache',
|
||||
'LinuxSymbolFinder']
|
||||
|
||||
mac_automagic = ['ConstructionMagic',
|
||||
'LayerStacker',
|
||||
'MacSymbolCache',
|
||||
'MacBannerCache',
|
||||
'MacSymbolFinder']
|
||||
|
||||
|
||||
|
||||
@@ -11,16 +11,20 @@ from volatility.framework.symbols import linux
|
||||
vollog = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class LinuxSymbolCache(symbol_cache.SymbolCache):
|
||||
class LinuxBannerCache(symbol_cache.SymbolBannerCache):
|
||||
"""Caches the banners found in the Linux symbol files"""
|
||||
|
||||
os = "linux"
|
||||
symbol_name = "linux_banner"
|
||||
banner_path = constants.LINUX_BANNERS_PATH
|
||||
|
||||
|
||||
class LinuxSymbolFinder(symbol_finder.SymbolFinder):
|
||||
"""Linux symbol loader based on uname signature strings"""
|
||||
|
||||
banner_config_key = "linux_banner"
|
||||
banner_cache = LinuxBannerCache
|
||||
symbol_class = "volatility.framework.symbols.linux.LinuxKernelIntermedSymbols"
|
||||
cache = LinuxSymbolCache
|
||||
|
||||
|
||||
class LintelStacker(interfaces.automagic.StackerLayerInterface):
|
||||
@@ -42,7 +46,7 @@ class LintelStacker(interfaces.automagic.StackerLayerInterface):
|
||||
if isinstance(layer, intel.Intel):
|
||||
return None
|
||||
|
||||
linux_banners = LinuxSymbolCache.load_banners()
|
||||
linux_banners = LinuxBannerCache.load_banners()
|
||||
mss = scanners.MultiStringScanner([x for x in linux_banners if x is not None])
|
||||
for _, banner in layer.scan(context = context, scanner = mss, progress_callback = progress_callback):
|
||||
dtb = None
|
||||
|
||||
@@ -11,7 +11,8 @@ from volatility.framework.symbols import mac
|
||||
vollog = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class MacSymbolCache(symbol_cache.SymbolCache):
|
||||
class MacBannerCache(symbol_cache.SymbolBannerCache):
|
||||
"""Caches the banners found in the Mac symbol files"""
|
||||
os = "mac"
|
||||
symbol_name = "version"
|
||||
banner_path = constants.MAC_BANNERS_PATH
|
||||
@@ -21,8 +22,8 @@ class MacSymbolFinder(symbol_finder.SymbolFinder):
|
||||
"""Mac symbol loader based on uname signature strings"""
|
||||
|
||||
banner_config_key = 'mac_banner'
|
||||
banner_cache = MacBannerCache
|
||||
symbol_class = "volatility.framework.symbols.mac.MacKernelIntermedSymbols"
|
||||
cache = MacSymbolCache
|
||||
|
||||
|
||||
class MacintelStacker(interfaces.automagic.StackerLayerInterface):
|
||||
@@ -44,7 +45,7 @@ class MacintelStacker(interfaces.automagic.StackerLayerInterface):
|
||||
if isinstance(layer, intel.Intel):
|
||||
return None
|
||||
|
||||
mac_banners = MacSymbolCache.load_banners()
|
||||
mac_banners = MacBannerCache.load_banners()
|
||||
mss = scanners.MultiStringScanner([x for x in mac_banners if x is not None])
|
||||
|
||||
for banner_offset, banner in layer.scan(context = context, scanner = mss,
|
||||
|
||||
@@ -14,17 +14,16 @@ vollog = logging.getLogger(__name__)
|
||||
BannersType = typing.Dict[bytes, typing.List[str]]
|
||||
|
||||
|
||||
class SymbolCache(interfaces.automagic.AutomagicInterface):
|
||||
class SymbolBannerCache(interfaces.automagic.AutomagicInterface):
|
||||
"""Runs through all symbols tables and caches their banners"""
|
||||
|
||||
# Since this is necessary for ConstructionMagic, we set a lower priority
|
||||
# The user would run it eventually either way, but running it first means it can be used that run
|
||||
priority = 0
|
||||
|
||||
# Default to Linux values, but no OS so we bomb out early when necessary
|
||||
os = None
|
||||
symbol_name = "linux_banner"
|
||||
banner_path = constants.LINUX_BANNERS_PATH
|
||||
symbol_name = "banner_name"
|
||||
banner_path = None
|
||||
|
||||
@classmethod
|
||||
def load_banners(cls) -> BannersType:
|
||||
@@ -103,5 +102,5 @@ class SymbolCache(interfaces.automagic.AutomagicInterface):
|
||||
except exceptions.SymbolError:
|
||||
pass
|
||||
|
||||
# Rewrite the cached banners each run, since writing is faster than the cache validation portion
|
||||
# Rewrite the cached banners each run, since writing is faster than the banner_cache validation portion
|
||||
self.save_banners(banners)
|
||||
|
||||
@@ -14,8 +14,8 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface):
|
||||
priority = 40
|
||||
|
||||
banner_config_key = "banner"
|
||||
banner_cache = None
|
||||
symbol_class = None
|
||||
cache = None
|
||||
|
||||
def __init__(self,
|
||||
context: interfaces.context.ContextInterface,
|
||||
@@ -28,9 +28,9 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface):
|
||||
def banners(self) -> symbol_cache.BannersType:
|
||||
"""Creates a cached copy of the results, but only it's been requested"""
|
||||
if not self._banners:
|
||||
if not self.cache:
|
||||
if not self.banner_cache:
|
||||
raise RuntimeError("Cache has not been properly defined for {}".format(self.__class__.__name__))
|
||||
self._banners = self.cache.load_banners()
|
||||
self._banners = self.banner_cache.load_banners()
|
||||
return self._banners
|
||||
|
||||
def __call__(self,
|
||||
|
||||
Reference in New Issue
Block a user