From 7f6378fd5def39d4e8326edfcc5142f558778fcc Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 12 Jul 2021 12:27:53 +0100 Subject: [PATCH] Automagic: Changing stacking order for linux/mac The linux/mac stackers are more accurate (based on banners) than the windows stacker (based on offsets). As such in cases where both would match, we should go for the more accurate match first (linux/mac) over windows. In most cases this will make no difference because of the exclusion lists, so only one stacker will run, but in cases such as volshell where all stackers are run, this may help with certain edge cases. --- volatility3/framework/automagic/linux.py | 2 +- volatility3/framework/automagic/mac.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 70b89dd2d..fb1f6fc75 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -14,7 +14,7 @@ vollog = logging.getLogger(__name__) class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): - stack_order = 45 + stack_order = 35 exclusion_list = ['mac', 'windows'] @classmethod diff --git a/volatility3/framework/automagic/mac.py b/volatility3/framework/automagic/mac.py index c8b42e500..1a039af8d 100644 --- a/volatility3/framework/automagic/mac.py +++ b/volatility3/framework/automagic/mac.py @@ -15,7 +15,7 @@ vollog = logging.getLogger(__name__) class MacIntelStacker(interfaces.automagic.StackerLayerInterface): - stack_order = 45 + stack_order = 35 exclusion_list = ['windows', 'linux'] @classmethod