From 5d15f810e10e50bd2f9a5600db5b1b5db4d4e1b2 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sun, 11 Dec 2016 13:58:17 +0000
Subject: [PATCH] Tidy up the config namespace around automagic a little.

---
 volatility/cli/__init__.py                | 16 ++++------------
 volatility/framework/automagic/pdbscan.py |  4 +++-
 volatility/framework/automagic/stacker.py |  9 ++++++---
 3 files changed, 13 insertions(+), 16 deletions(-)

diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py
index 0d3c47427..938afa870 100644
--- a/volatility/cli/__init__.py
+++ b/volatility/cli/__init__.py
@@ -65,19 +65,11 @@ class CommandLine(object):
         # UI fills in the config:
         ctx = contexts.Context()
 
-        if not args.file:
-            ctx.config["ui.single_location"] = "file:///home/memory/xp-laptop-2005-07-04-1430.img"
-            ctx.config["ui.single_location"] = "file:///home/memory/private/jon-fres.dmp"
+        if not args.file or not os.path.exists(args.file):
+            raise RuntimeError("Please provide a valid filename")
         else:
-            ctx.config["ui.single_location"] = "file://" + os.path.abspath(args.file)
-
-        # ctx.config[
-        #    "plugins.pslist.ntkrnlmp.class"] = "volatility.framework.symbols.windows.WindowsKernelIntermedSymbols"
-        # ctx.config[
-        #    "plugins.pslist.ntkrnlmp.idd_filepath"] = "file:///home/mike/workspace/volatility3/aux/ntoskrnl.pdb.json"
-
-        # ctx.config["ui.single_location"] = "file:///run/media/mike/disk/memory/private/win10-x64-2016-05-28.lime"
-        # ctx.config["plugins.pslist.offset"] = 0xfe001608573c0
+            ctx.config["automagic.general.single_location"] = "file://" + os.path.abspath(args.file)
+        ctx.config["automagic.general.single_page_map_offset"] = 0x1ab000
 
         ###
         # BACK TO THE FRAMEWORK
diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py
index 9aebf4d48..e546778ae 100644
--- a/volatility/framework/automagic/pdbscan.py
+++ b/volatility/framework/automagic/pdbscan.py
@@ -230,8 +230,10 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
                             except exceptions.PagedInvalidAddressException:
                                 # We don't care if we're mapping an address to 0, it's not what we're looking for
                                 pass
+            if not valid_kernels:
+                vollog.warning("No suitable kernel found for layer: {}".format(virtual_layer_name))
         if not valid_kernels:
-            vollog.warning("No suitable kernel found for layer: {}".format(virtual_layer_name))
+            vollog.warning("No suitable kernels found during pdbscan")
         return valid_kernels
 
     def __call__(self, context, config_path, requirement):
diff --git a/volatility/framework/automagic/stacker.py b/volatility/framework/automagic/stacker.py
index c293d8b7b..73007202b 100644
--- a/volatility/framework/automagic/stacker.py
+++ b/volatility/framework/automagic/stacker.py
@@ -9,13 +9,15 @@ class LayerStacker(interfaces.automagic.AutomagicInterface):
     """Class that attempts to build up """
     # Most important automagic, must happen first!
     priority = 0
+    page_map_offset = None
+    location = None
 
     def __call__(self, context, config_path, requirement):
         """Runs the automagic over the configurable"""
         # Bow out quickly if the UI hasn't provided a single_location
-        if "ui.single_location" not in context.config:
+        if "automagic.general.single_location" not in context.config:
             return
-        location = context.config["ui.single_location"]
+        location = context.config["automagic.general.single_location"]
         self._check_type(location, str)
         self._check_type(requirement, interfaces.configuration.RequirementInterface)
         self.location = parse.urlparse(location)
@@ -27,7 +29,8 @@ class LayerStacker(interfaces.automagic.AutomagicInterface):
 
         new_context = context.clone()
         current_layer_name = context.memory.free_layer_name("FileLayer")
-        current_config_path = interfaces.configuration.path_join("automagic_general", current_layer_name)
+        current_config_path = interfaces.configuration.path_join("automagic", "layer_stacker", "stack",
+                                                                 current_layer_name)
         # This must be specific to get us started, setup the config and run
         new_context.config[interfaces.configuration.path_join(current_config_path, "filename")] = self.local_store
         new_context.add_layer(physical.FileLayer(new_context, current_config_path, current_layer_name))