diff --git a/volatility/framework/automagic/__init__.py b/volatility/framework/automagic/__init__.py index 22ba74445..5f78e8c2b 100644 --- a/volatility/framework/automagic/__init__.py +++ b/volatility/framework/automagic/__init__.py @@ -26,12 +26,12 @@ windows_automagic = ['ConstructionMagic', linux_automagic = ['ConstructionMagic', 'LayerStacker', - 'LinuxSymbolCache', + 'LinuxBannerCache', 'LinuxSymbolFinder'] mac_automagic = ['ConstructionMagic', 'LayerStacker', - 'MacSymbolCache', + 'MacBannerCache', 'MacSymbolFinder'] diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index 7030df9d2..90cc87525 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -11,16 +11,20 @@ from volatility.framework.symbols import linux vollog = logging.getLogger(__name__) -class LinuxSymbolCache(symbol_cache.SymbolCache): +class LinuxBannerCache(symbol_cache.SymbolBannerCache): + """Caches the banners found in the Linux symbol files""" + os = "linux" symbol_name = "linux_banner" banner_path = constants.LINUX_BANNERS_PATH class LinuxSymbolFinder(symbol_finder.SymbolFinder): + """Linux symbol loader based on uname signature strings""" + banner_config_key = "linux_banner" + banner_cache = LinuxBannerCache symbol_class = "volatility.framework.symbols.linux.LinuxKernelIntermedSymbols" - cache = LinuxSymbolCache class LintelStacker(interfaces.automagic.StackerLayerInterface): @@ -42,7 +46,7 @@ class LintelStacker(interfaces.automagic.StackerLayerInterface): if isinstance(layer, intel.Intel): return None - linux_banners = LinuxSymbolCache.load_banners() + linux_banners = LinuxBannerCache.load_banners() mss = scanners.MultiStringScanner([x for x in linux_banners if x is not None]) for _, banner in layer.scan(context = context, scanner = mss, progress_callback = progress_callback): dtb = None diff --git a/volatility/framework/automagic/mac.py b/volatility/framework/automagic/mac.py index 60c4c4861..def713986 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility/framework/automagic/mac.py @@ -11,7 +11,8 @@ from volatility.framework.symbols import mac vollog = logging.getLogger(__name__) -class MacSymbolCache(symbol_cache.SymbolCache): +class MacBannerCache(symbol_cache.SymbolBannerCache): + """Caches the banners found in the Mac symbol files""" os = "mac" symbol_name = "version" banner_path = constants.MAC_BANNERS_PATH @@ -21,8 +22,8 @@ class MacSymbolFinder(symbol_finder.SymbolFinder): """Mac symbol loader based on uname signature strings""" banner_config_key = 'mac_banner' + banner_cache = MacBannerCache symbol_class = "volatility.framework.symbols.mac.MacKernelIntermedSymbols" - cache = MacSymbolCache class MacintelStacker(interfaces.automagic.StackerLayerInterface): @@ -44,7 +45,7 @@ class MacintelStacker(interfaces.automagic.StackerLayerInterface): if isinstance(layer, intel.Intel): return None - mac_banners = MacSymbolCache.load_banners() + mac_banners = MacBannerCache.load_banners() mss = scanners.MultiStringScanner([x for x in mac_banners if x is not None]) for banner_offset, banner in layer.scan(context = context, scanner = mss, diff --git a/volatility/framework/automagic/symbol_cache.py b/volatility/framework/automagic/symbol_cache.py index d50494fbb..f12767123 100644 --- a/volatility/framework/automagic/symbol_cache.py +++ b/volatility/framework/automagic/symbol_cache.py @@ -14,17 +14,16 @@ vollog = logging.getLogger(__name__) BannersType = typing.Dict[bytes, typing.List[str]] -class SymbolCache(interfaces.automagic.AutomagicInterface): +class SymbolBannerCache(interfaces.automagic.AutomagicInterface): """Runs through all symbols tables and caches their banners""" # Since this is necessary for ConstructionMagic, we set a lower priority # The user would run it eventually either way, but running it first means it can be used that run priority = 0 - # Default to Linux values, but no OS so we bomb out early when necessary os = None - symbol_name = "linux_banner" - banner_path = constants.LINUX_BANNERS_PATH + symbol_name = "banner_name" + banner_path = None @classmethod def load_banners(cls) -> BannersType: @@ -103,5 +102,5 @@ class SymbolCache(interfaces.automagic.AutomagicInterface): except exceptions.SymbolError: pass - # Rewrite the cached banners each run, since writing is faster than the cache validation portion + # Rewrite the cached banners each run, since writing is faster than the banner_cache validation portion self.save_banners(banners) diff --git a/volatility/framework/automagic/symbol_finder.py b/volatility/framework/automagic/symbol_finder.py index f9d927f84..b7bf71a6b 100644 --- a/volatility/framework/automagic/symbol_finder.py +++ b/volatility/framework/automagic/symbol_finder.py @@ -14,8 +14,8 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface): priority = 40 banner_config_key = "banner" + banner_cache = None symbol_class = None - cache = None def __init__(self, context: interfaces.context.ContextInterface, @@ -28,9 +28,9 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface): def banners(self) -> symbol_cache.BannersType: """Creates a cached copy of the results, but only it's been requested""" if not self._banners: - if not self.cache: + if not self.banner_cache: raise RuntimeError("Cache has not been properly defined for {}".format(self.__class__.__name__)) - self._banners = self.cache.load_banners() + self._banners = self.banner_cache.load_banners() return self._banners def __call__(self,