Add in first shot at an 'efficient' virtual memory scanner. Uses page misses to calculate skipping distances.

volatility/framework/layers/intel.py

@@ -148,6 +148,32 @@ class Intel(interfaces.layers.TranslationLayerInterface):
                 requirements.IntRequirement(name = 'page_map_offset',
                                             optional = False)]
 
+    def scan(self, context, scanner, progress_callback = None, min_address = None, max_address = None):
+        min_address, max_address, scanner, total_size = self._pre_scan(context, min_address, max_address,
+                                                                       progress_callback, scanner)
+        current = min_address
+        range_start = None
+        while current <= max_address:
+            progress_callback((current - min_address) / total_size)
+            try:
+                if range_start is None:
+                    range_start = current
+                address, page_size = self._translate(current)
+                if not context.memory[self._base_layer].is_valid(address):
+                    if current - range_start > 0:
+                        chunk = self.read(range_start, current - range_start)
+                        for result in scanner(chunk, range_start):
+                            yield result
+                    range_start = None
+                current += page_size
+            except exceptions.PagedInvalidAddressException as e:
+                if current - range_start > 0:
+                    chunk = self.read(range_start, current - range_start)
+                    for result in scanner(chunk, range_start):
+                        yield result
+                range_start = None
+                current += (1 << e.invalid_bits)
+
 
 class IntelPAE(Intel):
     """Class for handling Physical Address Extensions for Intel architectures"""