From 904a5b18a3ce18ea99b5e0a782e8d7187c58752f Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 1 Jun 2017 01:00:49 +0100 Subject: [PATCH] Try to bomb out of the NlpDtbFinder if the space already has a dtb. --- volatility/framework/automagic/nlpdtbfinder.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility/framework/automagic/nlpdtbfinder.py b/volatility/framework/automagic/nlpdtbfinder.py index ba77d224f..10bf8855f 100644 --- a/volatility/framework/automagic/nlpdtbfinder.py +++ b/volatility/framework/automagic/nlpdtbfinder.py @@ -2,7 +2,7 @@ import logging import math import struct -from volatility.framework import interfaces, exceptions +from volatility.framework import exceptions, interfaces from volatility.framework.configuration import requirements from volatility.framework.layers import intel @@ -134,7 +134,8 @@ class NlpDtbfinder(interfaces.automagic.AutomagicInterface): def __call__(self, context, config_path, requirement, progress_callback = None): results = {} sub_config_path = interfaces.configuration.path_join(config_path, requirement.name) - if (isinstance(requirement, requirements.TranslationLayerRequirement) and + if (not interfaces.configuration.path_join(sub_config_path, "page_map_offset") in context.config and + isinstance(requirement, requirements.TranslationLayerRequirement) and requirement.requirements.get("class", None)): class_req = requirement.requirements["class"] for layer_class in validity_tests: