From eb9b2dcb7905f7b08f1f4a95f9c30dc9b2121bd7 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 24 Aug 2016 01:32:06 +0100 Subject: [PATCH] Reduce the number of input variables need for the vol test CLI still to run. --- volatility/cli/__init__.py | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index 359e015e3..5c8849611 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -52,22 +52,17 @@ class CommandLine(object): # UI fills in the config: ctx = contexts.Context() - ctx.config["plugins.pslist.primary.class"] = "volatility.framework.layers.intel.IntelPAE" - ctx.config["plugins.pslist.primary.memory_layer.class"] = "volatility.framework.layers.physical.FileLayer" - ctx.config[ - "plugins.pslist.primary.memory_layer.filename"] = "/run/media/mike/disk/memory/xp-laptop-2005-07-04-1430.img" + ctx.config["ui.single_location"] = "file:///run/media/mike/disk/memory/xp-laptop-2005-07-04-1430.img" ctx.config["plugins.pslist.offset"] = 0x023c87c0 - ctx.config["plugins.pslist.primary.memory_layer.filename"] = "/run/media/mike/disk/memory/private/jon-fres.dmp" + ctx.config["ui.single_location"] = "file:///run/media/mike/disk/memory/private/jon-fres.dmp" ctx.config["plugins.pslist.offset"] = 0x01bcc830 ctx.config["plugins.pslist.ntkrnlmp.class"] = "volatility.framework.symbols.windows.WindowsKernelVTypeSymbols" ctx.config["plugins.pslist.ntkrnlmp.vtype_pymodule"] = "volatility.framework.symbols.windows.xp_sp2_x86_vtypes" ctx.config["plugins.pslist.ntkrnlmp.vtype_variable"] = "ntkrnlmp_types" - # ctx.config["plugins.pslist.primary.page_map_offset"] = 0x39000 - ### # BACK TO THE FRAMEWORK ###