From 5507d49fa03b11f76309baf1d7cd8de54d5fb735 Mon Sep 17 00:00:00 2001
From: "Nick L. Petroni, Jr" <npetroni@volexity.com>
Date: Tue, 19 Feb 2019 20:43:02 -0500
Subject: [PATCH] automagic: add sub for FreeBSD symbols

This version simply creates a node, which must be populated directly
in a config right now.

Set freebsd.class and freebsd.isf_url keys.
---
 volatility/framework/automagic/__init__.py |  9 +++++-
 volatility/framework/automagic/freebsd.py  | 37 ++++++++++++++++++++++
 2 files changed, 45 insertions(+), 1 deletion(-)
 create mode 100644 volatility/framework/automagic/freebsd.py

diff --git a/volatility/framework/automagic/__init__.py b/volatility/framework/automagic/__init__.py
index f13726d06..78ef83022 100644
--- a/volatility/framework/automagic/__init__.py
+++ b/volatility/framework/automagic/__init__.py
@@ -27,6 +27,7 @@ linux_automagic = ['ConstructionMagic', 'LayerStacker', 'LinuxBannerCache', 'Lin
 
 mac_automagic = ['ConstructionMagic', 'LayerStacker', 'MacBannerCache', 'MacSymbolFinder']
 
+freebsd_automagic = ['ConstructionMagic', 'LayerStacker', 'FreeBSDSymbolFinder']
 
 def available(context: interfaces.context.ContextInterface) -> List[interfaces.automagic.AutomagicInterface]:
     """Returns an ordered list of all subclasses of
@@ -55,7 +56,12 @@ def choose_automagic(automagics, plugin):
     plugin_categories = plugin.__module__.split('.')
     lowest_index = len(plugin_categories)
 
-    automagic_categories = {'windows': windows_automagic, 'linux': linux_automagic, 'mac': mac_automagic}
+    automagic_categories = {
+        'windows': windows_automagic,
+        'linux': linux_automagic,
+        'mac': mac_automagic,
+        'freebsd': freebsd_automagic
+    }
 
     for os in automagic_categories:
         try:
@@ -75,6 +81,7 @@ def choose_automagic(automagics, plugin):
     for amagic in automagics:
         if amagic.__class__.__name__ in automagic_categories[plugin_category]:
             output += [amagic]
+
     return output
 
 
diff --git a/volatility/framework/automagic/freebsd.py b/volatility/framework/automagic/freebsd.py
new file mode 100644
index 000000000..791099736
--- /dev/null
+++ b/volatility/framework/automagic/freebsd.py
@@ -0,0 +1,37 @@
+# This file was contributed to the Volatility Framework Version 3.
+# Copyright (C) 2018 Volatility Foundation.
+#
+# THE LICENSED WORK IS PROVIDED UNDER THE TERMS OF THE Volatility Contributors
+# Public License V1.0("LICENSE") AS FIRST COMPLETED BY: Volatility Foundation,
+# Inc. ANY USE, PUBLIC DISPLAY, PUBLIC PERFORMANCE, REPRODUCTION OR DISTRIBUTION
+# OF, OR PREPARATION OF SUBSEQUENT WORKS, DERIVATIVE WORKS OR DERIVED WORKS BASED
+# ON, THE LICENSED WORK CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS LICENSE AND ITS
+# TERMS, WHETHER OR NOT SUCH RECIPIENT READS THE TERMS OF THE LICENSE. "LICENSED
+# WORK,” “RECIPIENT" AND “DISTRIBUTOR" ARE DEFINED IN THE LICENSE. A COPY OF THE
+# LICENSE IS LOCATED IN THE TEXT FILE ENTITLED "LICENSE.txt" ACCOMPANYING THE
+# CONTENTS OF THIS FILE. IF A COPY OF THE LICENSE DOES NOT ACCOMPANY THIS FILE, A
+# COPY OF THE LICENSE MAY ALSO BE OBTAINED AT THE FOLLOWING WEB SITE:
+# https://www.volatilityfoundation.org/license/vcpl_v1.0
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for the
+# specific language governing rights and limitations under the License.
+#
+
+from volatility.framework import interfaces, constants
+from volatility.symbols import freebsd
+
+class FreeBSDSymbolFinder(interfaces.automagic.AutomagicInterface):
+    """FreeBSD symbol loader"""
+
+    def __call__(self,
+                 context: interfaces.context.ContextInterface,
+                 config_path: str,
+                 requirement: interfaces.configuration.RequirementInterface,
+                 progress_callback: constants.ProgressCallback = None) -> None:
+
+        path_join = interfaces.configuration.path_join
+        context.config[path_join(config_path, requirement.name, "class")] = freebsd.FreeBSDKernelIntermedSymbols
+        context.config[path_join(config_path, requirement.name, "isf_url")] = ""
+        # Construct the appropriate symbol table
+        requirement.construct(context, config_path)