From d80ef553255acf29ee16d884e864ec7c546a2be0 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 18 Nov 2024 17:49:30 +1100 Subject: [PATCH] linux: intel VMCoreInfo: Select the fastest scanner for each scenario --- volatility3/framework/automagic/linux.py | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 64365bd83..81f5f5661 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -321,12 +321,20 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): if not valid_banners: # There's no banner matching this VMCOREINFO, keep trying with the next one continue + elif len(valid_banners) == 1: + # Usually, we narrow down the Linux banner list to a single element. + # Using BytesScanner here is slightly faster than MultiStringScanner. + scanner = scanners.BytesScanner(valid_banners[0]) + else: + scanner = scanners.MultiStringScanner(valid_banners) join = interfaces.configuration.path_join - mss = scanners.MultiStringScanner(valid_banners) - for _, banner in layer.scan( - context=context, scanner=mss, progress_callback=progress_callback + for match in layer.scan( + context=context, scanner=scanner, progress_callback=progress_callback ): + # Unfortunately, the scanners do not maintain a consistent interface + banner = match[1] if isinstance(match, Tuple) else valid_banners[0] + isf_path = linux_banners.get(banner, None) if not isf_path: vollog.warning(