diff --git a/test_rig.py b/test_rig.py index 0e001d1ad..3a22b75e3 100644 --- a/test_rig.py +++ b/test_rig.py @@ -56,7 +56,7 @@ def test_symbols(): def test_memory(): ctx = utils_load_as() - base = layers.physical.FileLayer(ctx, 'physical', filename = 'trig_data.bin') + base = layers.physical.FileLayer(ctx, config_path = "memtest", name = 'physical', filename = 'trig_data.bin') ctx.memory.add_layer(base) val = ctx.object('ntkrnlmp!TEST_POINTER', 'physical', 0) print(hex(val.point1.test1), val.point1.test2) @@ -64,16 +64,19 @@ def test_memory(): def test_kdbgfind(): ctx = utils_load_as() - base = layers.physical.FileLayer(ctx, 'physical', filename = '/run/media/mike/disk/memory/xp-laptop-2005-06-25.img') + base = layers.physical.FileLayer(ctx, config_path = "memtest", name = 'physical', + filename = '/run/media/mike/disk/memory/xp-laptop-2005-06-25.img') ctx.memory.add_layer(base) intel = layers.intel.Intel(ctx, 'kernel', 'physical', page_map_offset = 0x39000) ctx.memory.add_layer(intel) def intel32(ctx): - base = layers.physical.FileLayer(ctx, 'physical', filename = '/run/media/mike/disk/memory/xp-laptop-2005-06-25.img') + base = layers.physical.FileLayer(ctx, config_path = "memtest", name = 'physical', + filename = '/run/media/mike/disk/memory/xp-laptop-2005-06-25.img') ctx.memory.add_layer(base) - intel = layers.intel.Intel(ctx, 'kernel', 'physical', page_map_offset = 0x39000) + intel = layers.intel.Intel(ctx, config_path = "memtest", name = 'kernel', memory_layer = 'physical', + page_map_offset = 0x39000) x = [0x823c87c0, 0x81fdf020, 0x81f5a3b8, 0x81f8eb10, 0x820e0da0, 0x82199668, 0x81fa5aa0, 0x81fa8650, 0x81faba78, 0x81fa8240, 0x81f8dda0, 0x81f6e7e8, 0x81f9a670, 0x81f5f020, 0x8202bda0, 0x82113c48, 0x81f67500, 0x81f6ca90, 0x820dd588, 0x82025608, 0x81faf280, 0x821125d0, 0x82076558, 0x81f68518, 0x82059da0, 0x81f6db28, 0x82021a78, @@ -84,9 +87,11 @@ def intel32(ctx): def intelpae(ctx): - base = layers.physical.FileLayer(ctx, 'physical', filename = '/run/media/mike/disk/memory/private/jon-fres.dmp') + base = layers.physical.FileLayer(ctx, config_path = "memtest", name = 'physical', + filename = '/run/media/mike/disk/memory/private/jon-fres.dmp') ctx.memory.add_layer(base) - intel = layers.intel.IntelPAE(ctx, 'intel', 'physical', page_map_offset = 0x319000) + intel = layers.intel.IntelPAE(ctx, config_path = "memtest", name = 'intel', memory_layer = 'physical', + page_map_offset = 0x319000) x = [0x81bcc830, 0x81989940, 0x81915020, 0x8192ad18, 0x818fa7b8, 0x818f6da0, 0x818d1020, 0x818b2878, 0x8189f180, 0x8188db58, 0x81884a40, 0x818766b0, 0x8185a948, 0x8183ad70, 0x81826020, 0x818a64c8, 0x81818020, 0x81800020, 0x817ff460, 0x817eb020, 0x817e9020, 0x817a62a8, 0x817a4b28, 0x81865020, 0x817972c0] @@ -94,10 +99,11 @@ def intelpae(ctx): def intel32e(ctx): - base = layers.physical.FileLayer(ctx, 'data', + base = layers.physical.FileLayer(ctx, config_path = "memtest", name = 'data', filename = '/run/media/mike/disk/memory/private/ikelos-winxpsp2-x64.dmp') ctx.memory.add_layer(base) - intel = layers.intel.Intel32e(ctx, 'kernel', 'data', page_map_offset = 0x3c3000) + intel = layers.intel.Intel32e(ctx, config_path = "memtest", name = 'kernel', memory_layer = 'data', + page_map_offset = 0x3c3000) x = [0xfffffadffa517c20, 0xfffffadffa2c9510, 0xfffffadffb16a660, 0xfffffadff9d77c20, 0xfffffadffb0fe040, 0xfffffadffb0f2040, 0xfffffadffb0c2040, 0xfffffadffb0b7c20, 0xfffffadffb087c20, 0xfffffadffb06a760, 0xfffffadffb039c20, 0xfffffadffb02c040, 0xfffffadffafe9c20, 0xfffffadffafa7040, 0xfffffadffaf2e040, @@ -112,7 +118,7 @@ def test_translation(): ctx = contexts.Context(nativelst) intel, x = intel32(ctx) - base = layers.physical.BufferDataLayer(ctx, 'base', buffer = b" ") + base = layers.physical.BufferDataLayer(ctx, config_path = "memtest", name = 'base', buffer = b" ") print(base.is_valid(0), base.is_valid(0) == True) print(base.is_valid(1), base.is_valid(1) == False) @@ -127,9 +133,11 @@ def test_translation(): def test_plugin(): ctx = utils_load_as() - base = layers.physical.FileLayer(ctx, 'physical', filename = '/run/media/mike/disk/memory/xp-laptop-2005-06-25.img') + base = layers.physical.FileLayer(ctx, config_path = "memtest", name = 'physical', + filename = '/run/media/mike/disk/memory/xp-laptop-2005-06-25.img') ctx.memory.add_layer(base) - intel = layers.intel.Intel(ctx, 'kernel', 'physical', page_map_offset = 0x39000) + intel = layers.intel.Intel(ctx, config_path = "memtest", name = 'kernel', memory_layer = 'physical', + page_map_offset = 0x39000) ctx.memory.add_layer(intel) import volatility.plugins.windows.pslist as pslist