Draft up a system to tag the configuration tree with useful information based on the context so far.

This commit is contained in:
Mike Auty
2016-02-20 21:36:12 +00:00
parent 1e8c55bfdd
commit 71b540f6db
2 changed files with 17 additions and 0 deletions
+11
View File
@@ -6,6 +6,7 @@ import volatility.framework
import volatility.plugins
from volatility.cli import argparse_adapter
from volatility.framework import plugins, contexts
from volatility.framework.automagic import windows as windows_automagic
from volatility.framework.configuration import depresolver
from volatility.framework.configuration.depresolver import DependencyError
from volatility.framework.renderers.text import TextRenderer
@@ -49,6 +50,16 @@ class CommandLine(object):
ctx.config["pslist.primary.page_map_offset"] = 0x39000
ctx.config["pslist.offset"] = 0x823c87c0
config_path = plugin.__name__.lower()
windows = True
if windows:
# Traverse the dependency tree and tag the config with the appropriate page_map_offset values where not already applied
wdf = windows_automagic.WindowsDtbFinder(volatility.framework.class_subclasses(windows_automagic.DtbTest))
dldr.configurable_visitor(deptree, context = ctx, path = config_path,
visitor = windows_automagic.PageMapOffsetHelper())
print(repr(deptree))
# Walk down the tree attempting to fulfil each requirement (recursive) and backtrack when necessary
# Translate the parsed args to a context configuration
if dldr.validate_dependencies(deptree, context = ctx, path = config_path):
@@ -46,6 +46,12 @@ class DependencyResolver(validity.ValidityRoutines):
set2 = set(value2)
return set1.intersection(set2)
def configurable_visitor(self, deptree, context, path = None, visitor = None):
"""Visits each provider and attempts to apply suitable information to help """
self._check_type(deptree, RequirementTreeList)
self._check_type(context, interfaces.context.ContextInterface)
self._check_type(visitor, interfaces.configuration.ConfigurableVisitorInterface)
def validate_dependencies(self, deptree, context, path = None):
"""Takes a dependency tree and attempts to resolve the tree by validating each branch and using the first that successfully validates