From b90fd6bbb205305ce9a0d49059eb564ea0cc5957 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 24 Aug 2021 21:59:18 +0100 Subject: [PATCH] Automagic: Only traverse down intel layers --- volatility3/framework/automagic/symbol_finder.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/symbol_finder.py b/volatility3/framework/automagic/symbol_finder.py index 03d051c49..6f6332a8d 100644 --- a/volatility3/framework/automagic/symbol_finder.py +++ b/volatility3/framework/automagic/symbol_finder.py @@ -93,8 +93,10 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface): 'raw_unicode_escape'))] # type: Iterable[Any] else: # Swap to the physical layer for scanning + # Only traverse down a layer if it's an intel layer # TODO: Fix this so it works for layers other than just Intel - layer = context.layers[layer.config['memory_layer']] + if isinstance(layer, layers.intel.Intel): + layer = context.layers[layer.config['memory_layer']] banner_list = layer.scan(context = context, scanner = mss, progress_callback = progress_callback) for _, banner in banner_list: