WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-30 05:24:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

linux: intel VMCoreInfo: Select the fastest scanner for each scenario

Browse Source
This commit is contained in:
Gustavo Moreira
2024-11-18 17:49:30 +11:00
parent f2a2f8aa67
commit d80ef55325
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/automagic/linux.py
+11 -3
View File
@@ -321,12 +321,20 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface):
if not valid_banners:
# There's no banner matching this VMCOREINFO, keep trying with the next one
continue
elif len(valid_banners) == 1:
# Usually, we narrow down the Linux banner list to a single element.
# Using BytesScanner here is slightly faster than MultiStringScanner.
scanner = scanners.BytesScanner(valid_banners[0])
else:
scanner = scanners.MultiStringScanner(valid_banners)
join = interfaces.configuration.path_join
mss = scanners.MultiStringScanner(valid_banners)
for _, banner in layer.scan(
context=context, scanner=mss, progress_callback=progress_callback
for match in layer.scan(
context=context, scanner=scanner, progress_callback=progress_callback
):
# Unfortunately, the scanners do not maintain a consistent interface
banner = match[1] if isinstance(match, Tuple) else valid_banners[0]
isf_path = linux_banners.get(banner, None)
if not isf_path:
vollog.warning(