WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 03:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

automagic: add sub for FreeBSD symbols

Browse Source 
This version simply creates a node, which must be populated directly
in a config right now.

Set freebsd.class and freebsd.isf_url keys.
This commit is contained in:
Nick L. Petroni, Jr
2020-02-12 14:47:56 -05:00
parent a03bee1668
commit 5507d49fa0
2 changed files with 45 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/automagic/__init__.py
+8 -1
View File
@@ -27,6 +27,7 @@ linux_automagic = ['ConstructionMagic', 'LayerStacker', 'LinuxBannerCache', 'Lin
mac_automagic = ['ConstructionMagic', 'LayerStacker', 'MacBannerCache', 'MacSymbolFinder']
freebsd_automagic = ['ConstructionMagic', 'LayerStacker', 'FreeBSDSymbolFinder']
def available(context: interfaces.context.ContextInterface) -> List[interfaces.automagic.AutomagicInterface]:
"""Returns an ordered list of all subclasses of
@@ -55,7 +56,12 @@ def choose_automagic(automagics, plugin):
plugin_categories = plugin.__module__.split('.')
lowest_index = len(plugin_categories)
automagic_categories = {'windows': windows_automagic, 'linux': linux_automagic, 'mac': mac_automagic}
automagic_categories = {
'windows': windows_automagic,
'linux': linux_automagic,
'mac': mac_automagic,
'freebsd': freebsd_automagic
}
for os in automagic_categories:
try:
@@ -75,6 +81,7 @@ def choose_automagic(automagics, plugin):
for amagic in automagics:
if amagic.__class__.__name__ in automagic_categories[plugin_category]:
output += [amagic]
return output
volatility/framework/automagic/freebsd.py
+37
View File
@@ -0,0 +1,37 @@
# This file was contributed to the Volatility Framework Version 3.
# Copyright (C) 2018 Volatility Foundation.
#
# THE LICENSED WORK IS PROVIDED UNDER THE TERMS OF THE Volatility Contributors
# Public License V1.0("LICENSE") AS FIRST COMPLETED BY: Volatility Foundation,
# Inc. ANY USE, PUBLIC DISPLAY, PUBLIC PERFORMANCE, REPRODUCTION OR DISTRIBUTION
# OF, OR PREPARATION OF SUBSEQUENT WORKS, DERIVATIVE WORKS OR DERIVED WORKS BASED
# ON, THE LICENSED WORK CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS LICENSE AND ITS
# TERMS, WHETHER OR NOT SUCH RECIPIENT READS THE TERMS OF THE LICENSE. "LICENSED
# WORK,” “RECIPIENT" AND “DISTRIBUTOR" ARE DEFINED IN THE LICENSE. A COPY OF THE
# LICENSE IS LOCATED IN THE TEXT FILE ENTITLED "LICENSE.txt" ACCOMPANYING THE
# CONTENTS OF THIS FILE. IF A COPY OF THE LICENSE DOES NOT ACCOMPANY THIS FILE, A
# COPY OF THE LICENSE MAY ALSO BE OBTAINED AT THE FOLLOWING WEB SITE:
# https://www.volatilityfoundation.org/license/vcpl_v1.0
#
# Software distributed under the License is distributed on an "AS IS" basis,
# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for the
# specific language governing rights and limitations under the License.
#
from volatility.framework import interfaces, constants
from volatility.symbols import freebsd
class FreeBSDSymbolFinder(interfaces.automagic.AutomagicInterface):
"""FreeBSD symbol loader"""
def __call__(self,
context: interfaces.context.ContextInterface,
config_path: str,
requirement: interfaces.configuration.RequirementInterface,
progress_callback: constants.ProgressCallback = None) -> None:
path_join = interfaces.configuration.path_join
context.config[path_join(config_path, requirement.name, "class")] = freebsd.FreeBSDKernelIntermedSymbols
context.config[path_join(config_path, requirement.name, "isf_url")] = ""
# Construct the appropriate symbol table
requirement.construct(context, config_path)