WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 03:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Improve the linux DTB finding code.

Browse Source
This commit is contained in:
Mike Auty
2017-07-16 18:05:19 +01:00
parent d0b1177c31
commit b68932a7bc
1 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/automagic/linux.py
+21 -1
View File
@@ -90,4 +90,24 @@ class LintelStacker(interfaces.automagic.StackerLayerInterface):
swapper_pg_dir_text.index(b"=") + 1:swapper_pg_dir_text.index(b"\n")], 16)
swapper_pg_dirs.append(swapper_pg_dir)
best_swapper_pg_dir = list(reversed(sorted(set(swapper_pg_dirs), key = lambda x: swapper_pg_dirs.count(x))))[0]
if swapper_pg_dirs:
best_swapper_pg_dir = \
list(reversed(sorted(set(swapper_pg_dirs), key = lambda x: swapper_pg_dirs.count(x))))[0]
if best_swapper_pg_dir > 0xffffffff80000000:
shift = 0xffffffff80000000
layer_class = intel.Intel32e
else:
shift = 0xc0000000
layer_class = intel.Intel
dtb = best_swapper_pg_dir - shift
new_layer_name = context.memory.free_layer_name("IntelLayer")
config_path = interfaces.configuration.path_join("IntelHelper", new_layer_name)
context.config[interfaces.configuration.path_join(config_path, "memory_layer")] = layer_name
context.config[interfaces.configuration.path_join(config_path, "page_map_offset")] = dtb
layer = layer_class(context, config_path = config_path, name = new_layer_name)
if layer:
vollog.debug("DTB was found at: 0x{:0x}".format(dtb))
return layer