From e80392aa12339864d619b0c06548a1f3b9d9e97e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 11 Dec 2017 00:39:51 +0000 Subject: [PATCH] Ensure we don't run through signatures when we've found one that gives a layer. --- volatility/framework/automagic/linux.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index 92189173b..f75705466 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -151,8 +151,9 @@ class LintelStacker(interfaces.automagic.StackerLayerInterface): layer = layer_class(context, config_path = config_path, name = new_layer_name) - if layer: - vollog.debug("DTB was found at: 0x{:0x}".format(dtb)) + if layer: + vollog.debug("DTB was found at: 0x{:0x}".format(dtb)) + break return layer