Replace layer name requirements with more descriptive translationlayerrequirements.

This commit is contained in:
Mike Auty
2015-10-11 18:02:27 +01:00
parent 64168e793c
commit 97ff228e76
4 changed files with 14 additions and 12 deletions
+5 -4
View File
@@ -28,7 +28,7 @@ class CommandLine(object):
# TODO: Choose a plugin
plugin = volatility.plugins.windows.pslist.PsList
context, req_mapping = self.handle_plugin_requirements(plugin)
context, req_mapping = self.collect_plugin_requirements(plugin)
parser = argparse.ArgumentParser(prog = 'volatility',
description = "An open-source memory forensics framework")
argparse_adapter.adapt_config(context.config, parser)
@@ -39,7 +39,7 @@ class CommandLine(object):
# Generate the layers from the arguments
for req in req_mapping:
factory = req_mapping[req]
factory
req.value = factory(context)
# Construct the plugin
runner = plugin(context)
@@ -57,8 +57,8 @@ class CommandLine(object):
contexts.windows.WindowsContextModifier])
return factory
def handle_plugin_requirements(self, plugin):
"""Populates the input values for the plugin"""
def collect_plugin_requirements(self, plugin):
"""Generates the requirements necessary for the plugin"""
reqs = plugin.requirements()
req_mapping = {}
context = contexts.Context()
@@ -77,5 +77,6 @@ class CommandLine(object):
return context, req_mapping
def main():
CommandLine().run()
+1 -1
View File
@@ -11,7 +11,7 @@ def StoreItemFactory(config_item):
super(StoreItemAction, self).__init__(option_strings, dest, **kwargs)
def __call__(self, parser, namespace, values, option_string = None):
config_item.value = values[0]
config_item.value = values
return StoreItemAction
@@ -51,7 +51,6 @@ class LayerFactory(validity.ValidityRoutines, list):
Returns a new context with all appropriate modifications (symbols, layers, etc)
"""
for index in range(len(self)):
print("TODO: update top level req based on modifier reqs being updated")
modifier = self[index](interfaces.configuration.namespace_join([self.name, self[index].__name__ + str(index)]))
modifier(context = context)
return context
+8 -6
View File
@@ -11,14 +11,16 @@ class IntelContextModifier(interfaces.context.ContextModifierInterface):
description = "Determines the memory image",
default = "auto"),
configuration.IntRequirement(name = "page_map_offset",
description = "Offset to the directory table base"),
description = "Offset to the directory table base"),
configuration.StringRequirement(name = 'layer_name',
description = 'Name of the layer to be added to the memory space',
default = 'intel'),
configuration.StringRequirement(name = 'physical_layer',
description = "Layer name for the physical layer",
default = 'physical'),
configuration.StringRequirement(name = 'swap_layer',
configuration.TranslationLayerRequirement(name = 'physical_layer',
description = 'Physical Address Space',
os_type = 'windows',
architectures = None,
layer_type = 'physical'),
configuration.TranslationLayerRequirement(name = 'swap_layer',
description = "Layer name for the swap layer",
optional = True)]
@@ -38,6 +40,6 @@ class IntelContextModifier(interfaces.context.ContextModifierInterface):
layer = layers.intel.IntelPAE
intel = layer(context, config.get_value('layer_name'),
config.get_value('physical_layer'),
config.get_value('physical_layer').name,
page_map_offset = config.get_value('page_map_offset'))
context.add_layer(intel)