Merge branch 'release/v2.0.0' into develop

volatility/cli/__init__.py

@@ -436,7 +436,8 @@ class CommandLine:
                 if value is not None:
                     if isinstance(requirement, requirements.URIRequirement):
                         if isinstance(value, str):
-                            if not parse.urlparse(value).scheme:
+                            scheme = parse.urlparse(value).scheme
+                            if not scheme or len(scheme) <= 1:
                                 if not os.path.exists(value):
                                     raise FileNotFoundError(
                                         "Non-existant file {} passed to URIRequirement".format(value))

volatility/framework/automagic/windows.py

@@ -225,8 +225,7 @@ class PageMapScanner(interfaces.layers.ScannerInterface):
             for page_offset in range(0, len(data), 0x1000):
                 result = test(data, data_offset, page_offset)
                 if result is not None:
-                    if result[0] < self.chunk_size:
-                        yield (test, result[0])
+                    yield (test, result[0])
 
 
 class WintelHelper(interfaces.automagic.AutomagicInterface):

volatility/framework/layers/intel.py

@@ -247,6 +247,7 @@ class IntelPAE(Intel):
     _maxphyaddr = 40
     _maxvirtaddr = 32
     _structure = [('page directory pointer', 2, False), ('page directory', 9, True), ('page table', 9, True)]
+    _direct_metadata = collections.ChainMap({'pae', True}, Intel._direct_metadata)
 
 
 class Intel32e(Intel):

volatility/framework/plugins/layerwriter.py

@@ -82,8 +82,6 @@ class LayerWriter(plugins.PluginInterface):
             for name in self.context.layers:
                 yield 0, (name, )
         else:
-            import pdb
-            pdb.set_trace()
             # Choose the most recently added layer that isn't virtual
             if self.config['layers'] is None:
                 self.config['layers'] = []

volatility/framework/plugins/windows/info.py

@@ -5,7 +5,7 @@
 import time
 from typing import List, Tuple, Iterable
 
-from volatility.framework import constants, interfaces, layers
+from volatility.framework import constants, interfaces, layers, symbols
 from volatility.framework.configuration import requirements
 from volatility.framework.interfaces import plugins
 from volatility.framework.renderers import TreeGrid
@@ -158,6 +158,8 @@ class Info(plugins.PluginInterface):
         yield (0, ("Kernel Base", hex(self.config["primary.kernel_virtual_offset"])))
         yield (0, ("DTB", hex(self.config["primary.page_map_offset"])))
         yield (0, ("Symbols", self.config["nt_symbols.isf_url"]))
+        yield (0, ("Is64Bit", str(symbols.symbol_table_is_64bit(self.context, symbol_table))))
+        yield (0, ("IsPAE", str(self.context.layers[layer_name].metadata.get("pae", False))))
 
         for i, layer in self.get_depends(self.context, "primary"):
             yield (0, (layer.name, "{} {}".format(i, layer.__class__.__name__)))

volatility/framework/symbols/mac/extensions/__init__.py

@@ -270,7 +270,7 @@ class vm_map_entry(objects.StructType):
 
         if found:
             vpager = context.object(config_prefix + constants.BANG + "vnode_pager",
-                                    layer_name = vnode_object.vol.layer_name,
+                                    layer_name = vnode_object.vol.native_layer_name,
                                     offset = vnode_object.pager)
             ret = vpager.vnode_handle
         else:

volatility/framework/symbols/windows/extensions/__init__.py

@@ -6,9 +6,8 @@ import collections.abc
 import datetime
 import functools
 import logging
-import struct
 import math
-from typing import Iterable, Iterator, Optional, Union, Dict, Tuple, List
+from typing import Iterable, Iterator, Optional, Union, Tuple, List
 
 from volatility.framework import constants, exceptions, interfaces, objects, renderers, symbols
 from volatility.framework.layers import intel