From dcf5b1f68cb433bb97769f87056aae642af528b9 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sat, 16 Nov 2019 12:49:43 +0000
Subject: [PATCH] Stackers: Update the stack orders to try quick header check
 layers first

---
 volatility/framework/automagic/linux.py   | 2 +-
 volatility/framework/automagic/mac.py     | 2 +-
 volatility/framework/automagic/windows.py | 1 +
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py
index f9efe1659..ade5964d2 100644
--- a/volatility/framework/automagic/linux.py
+++ b/volatility/framework/automagic/linux.py
@@ -31,7 +31,7 @@ class LinuxSymbolFinder(symbol_finder.SymbolFinder):
 
 
 class LintelStacker(interfaces.automagic.StackerLayerInterface):
-    stack_order = 12
+    stack_order = 45
 
     @classmethod
     def stack(cls,
diff --git a/volatility/framework/automagic/mac.py b/volatility/framework/automagic/mac.py
index c698a189d..9672c6bc6 100644
--- a/volatility/framework/automagic/mac.py
+++ b/volatility/framework/automagic/mac.py
@@ -31,7 +31,7 @@ class MacSymbolFinder(symbol_finder.SymbolFinder):
 
 
 class MacintelStacker(interfaces.automagic.StackerLayerInterface):
-    stack_order = 12
+    stack_order = 45
 
     @classmethod
     def stack(cls,
diff --git a/volatility/framework/automagic/windows.py b/volatility/framework/automagic/windows.py
index 7572d1c48..9d6733ead 100644
--- a/volatility/framework/automagic/windows.py
+++ b/volatility/framework/automagic/windows.py
@@ -287,6 +287,7 @@ class WintelHelper(interfaces.automagic.AutomagicInterface):
 
 
 class WintelStacker(interfaces.automagic.StackerLayerInterface):
+    stack_order = 40
 
     @classmethod
     def stack(cls,