diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index 7c906731a..4ac1ba0c8 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -28,7 +28,7 @@ class CommandLine(object): # TODO: Choose a plugin plugin = volatility.plugins.windows.pslist.PsList - context, req_mapping = self.handle_plugin_requirements(plugin) + context, req_mapping = self.collect_plugin_requirements(plugin) parser = argparse.ArgumentParser(prog = 'volatility', description = "An open-source memory forensics framework") argparse_adapter.adapt_config(context.config, parser) @@ -39,7 +39,7 @@ class CommandLine(object): # Generate the layers from the arguments for req in req_mapping: factory = req_mapping[req] - factory + req.value = factory(context) # Construct the plugin runner = plugin(context) @@ -57,8 +57,8 @@ class CommandLine(object): contexts.windows.WindowsContextModifier]) return factory - def handle_plugin_requirements(self, plugin): - """Populates the input values for the plugin""" + def collect_plugin_requirements(self, plugin): + """Generates the requirements necessary for the plugin""" reqs = plugin.requirements() req_mapping = {} context = contexts.Context() @@ -77,5 +77,6 @@ class CommandLine(object): return context, req_mapping + def main(): CommandLine().run() diff --git a/volatility/cli/argparse_adapter.py b/volatility/cli/argparse_adapter.py index 4b5085c7e..decad2b3b 100644 --- a/volatility/cli/argparse_adapter.py +++ b/volatility/cli/argparse_adapter.py @@ -11,7 +11,7 @@ def StoreItemFactory(config_item): super(StoreItemAction, self).__init__(option_strings, dest, **kwargs) def __call__(self, parser, namespace, values, option_string = None): - config_item.value = values[0] + config_item.value = values return StoreItemAction diff --git a/volatility/framework/contexts/__init__.py b/volatility/framework/contexts/__init__.py index d90660667..477666f4f 100644 --- a/volatility/framework/contexts/__init__.py +++ b/volatility/framework/contexts/__init__.py @@ -51,7 +51,6 @@ class LayerFactory(validity.ValidityRoutines, list): Returns a new context with all appropriate modifications (symbols, layers, etc) """ for index in range(len(self)): - print("TODO: update top level req based on modifier reqs being updated") modifier = self[index](interfaces.configuration.namespace_join([self.name, self[index].__name__ + str(index)])) modifier(context = context) return context diff --git a/volatility/framework/contexts/intel.py b/volatility/framework/contexts/intel.py index d0a8cc7ca..e46be7914 100644 --- a/volatility/framework/contexts/intel.py +++ b/volatility/framework/contexts/intel.py @@ -11,14 +11,16 @@ class IntelContextModifier(interfaces.context.ContextModifierInterface): description = "Determines the memory image", default = "auto"), configuration.IntRequirement(name = "page_map_offset", - description = "Offset to the directory table base"), + description = "Offset to the directory table base"), configuration.StringRequirement(name = 'layer_name', description = 'Name of the layer to be added to the memory space', default = 'intel'), - configuration.StringRequirement(name = 'physical_layer', - description = "Layer name for the physical layer", - default = 'physical'), - configuration.StringRequirement(name = 'swap_layer', + configuration.TranslationLayerRequirement(name = 'physical_layer', + description = 'Physical Address Space', + os_type = 'windows', + architectures = None, + layer_type = 'physical'), + configuration.TranslationLayerRequirement(name = 'swap_layer', description = "Layer name for the swap layer", optional = True)] @@ -38,6 +40,6 @@ class IntelContextModifier(interfaces.context.ContextModifierInterface): layer = layers.intel.IntelPAE intel = layer(context, config.get_value('layer_name'), - config.get_value('physical_layer'), + config.get_value('physical_layer').name, page_map_offset = config.get_value('page_map_offset')) context.add_layer(intel)