diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index c11f7bfd1..3197f2626 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -6,6 +6,7 @@ import volatility.framework import volatility.plugins from volatility.cli import argparse_adapter from volatility.framework import plugins, contexts +from volatility.framework.automagic import windows as windows_automagic from volatility.framework.configuration import depresolver from volatility.framework.configuration.depresolver import DependencyError from volatility.framework.renderers.text import TextRenderer @@ -49,6 +50,16 @@ class CommandLine(object): ctx.config["pslist.primary.page_map_offset"] = 0x39000 ctx.config["pslist.offset"] = 0x823c87c0 + config_path = plugin.__name__.lower() + + windows = True + if windows: + # Traverse the dependency tree and tag the config with the appropriate page_map_offset values where not already applied + wdf = windows_automagic.WindowsDtbFinder(volatility.framework.class_subclasses(windows_automagic.DtbTest)) + dldr.configurable_visitor(deptree, context = ctx, path = config_path, + visitor = windows_automagic.PageMapOffsetHelper()) + print(repr(deptree)) + # Walk down the tree attempting to fulfil each requirement (recursive) and backtrack when necessary # Translate the parsed args to a context configuration if dldr.validate_dependencies(deptree, context = ctx, path = config_path): diff --git a/volatility/framework/configuration/depresolver.py b/volatility/framework/configuration/depresolver.py index eb7df025f..91269dff3 100644 --- a/volatility/framework/configuration/depresolver.py +++ b/volatility/framework/configuration/depresolver.py @@ -46,6 +46,12 @@ class DependencyResolver(validity.ValidityRoutines): set2 = set(value2) return set1.intersection(set2) + def configurable_visitor(self, deptree, context, path = None, visitor = None): + """Visits each provider and attempts to apply suitable information to help """ + self._check_type(deptree, RequirementTreeList) + self._check_type(context, interfaces.context.ContextInterface) + self._check_type(visitor, interfaces.configuration.ConfigurableVisitorInterface) + def validate_dependencies(self, deptree, context, path = None): """Takes a dependency tree and attempts to resolve the tree by validating each branch and using the first that successfully validates