From d9369001d439240f573a967342d6d73c61eefaf2 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 13 Dec 2018 21:23:59 +0000 Subject: [PATCH] Ensure we can cache the linux/mac banners. --- volatility/framework/automagic/linux.py | 2 +- volatility/framework/automagic/mac.py | 4 ++-- volatility/framework/layers/intel.py | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index 432f238b2..5e564cb82 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -22,7 +22,7 @@ class LinuxBannerCache(symbol_cache.SymbolBannerCache): class LinuxSymbolFinder(symbol_finder.SymbolFinder): """Linux symbol loader based on uname signature strings""" - banner_config_key = "linux_banner" + banner_config_key = "kernel_banner" banner_cache = LinuxBannerCache symbol_class = "volatility.framework.symbols.linux.LinuxKernelIntermedSymbols" diff --git a/volatility/framework/automagic/mac.py b/volatility/framework/automagic/mac.py index 0b7f98be9..a7d4ba683 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility/framework/automagic/mac.py @@ -21,7 +21,7 @@ class MacBannerCache(symbol_cache.SymbolBannerCache): class MacSymbolFinder(symbol_finder.SymbolFinder): """Mac symbol loader based on uname signature strings""" - banner_config_key = 'mac_banner' + banner_config_key = 'kernel_banner' banner_cache = MacBannerCache symbol_class = "volatility.framework.symbols.mac.MacKernelIntermedSymbols" @@ -159,7 +159,7 @@ class MacUtilities(object): version_minor_json_address = context.symbol_space.get_symbol(version_minor_symbol).address version_minor_phys_offset = MacUtilities.virtual_to_physical_address(version_minor_json_address) - if compare_banner_offset == 0 or compare_banner == "": + if not compare_banner_offset or not compare_banner: offset_generator = cls._scan_generator(context, layer_name, progress_callback) else: offset_generator = [(compare_banner_offset, compare_banner)] diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py index 4b991e0fc..9a6c576a1 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility/framework/layers/intel.py @@ -220,7 +220,7 @@ class Intel(interfaces.layers.TranslationLayerInterface): optional = False), requirements.IntRequirement(name = 'kernel_virtual_offset', optional = True), - requirements.StringRequirement(name = 'linux_banner', + requirements.StringRequirement(name = 'kernel_banner', optional = True)]