Initial commit of pdb kernel scanning automagic code.

volatility/framework/automagic/__init__.py

@@ -1,7 +1,7 @@
 import sys
 
 from volatility.framework import class_subclasses, import_files, interfaces
-from volatility.framework.automagic import construct_layers, stacker, windows
+from volatility.framework.automagic import construct_layers, stacker, windows, pdbscan
 from volatility.framework.configuration import requirements
 
 

volatility/framework/automagic/pdbscan.py

@@ -61,7 +61,8 @@ def scan(ctx, layer_name):
         b"ntoskrnl.pdb",
     ]
 
-    for (GUID, age, pdb_name, signature_offset) in ctx.memory[layer_name].scan(ctx, PdbSigantureScanner(pdb_names)):
+    for (GUID, age, pdb_name, signature_offset) in ctx.memory[layer_name].scan(ctx, PdbSigantureScanner(pdb_names),
+                                                                               progress_callback = progress_callback):
         mz_offset = None
         sig_pfn = signature_offset // PAGE_SIZE
 
@@ -78,3 +79,31 @@ def scan(ctx, layer_name):
         results.append((GUID, age, pdb_name, signature_offset, mz_offset))
 
     return results
+
+
+def progress_callback(progress):
+    print("Progress: ", progress)
+
+
+class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
+    """Looks for all Intel address spaces and attempts to identify the PDB guid required for the space"""
+    priority = 30
+    thing = None
+
+    def __call__(self, context, config_path, requirement):
+        if not self.thing:
+            self.thing = True
+            print(context.config)
+        sub_config_path = interfaces.configuration.path_join(config_path, requirement.name)
+        print("SUBCONFIGPATH", sub_config_path)
+        if isinstance(requirement, interfaces.configuration.TranslationLayerRequirement):
+            # Check for symbols in this layer
+            layer_name = context.config.get(
+                interfaces.configuration.path_join(config_path, requirement.name), None)
+            print("FOUND ONE", layer_name)
+            if layer_name:
+                results = scan(context, layer_name)
+                print("RESULTS", results)
+        else:
+            for subreq in requirement.requirements.values():
+                self(context, sub_config_path, subreq)