From f88ce5519995889b6596ad7baf401b0a1e4a0082 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 2 Dec 2020 09:51:34 +0000 Subject: [PATCH] Automagic: Improve debugging output for linux/mac --- volatility/framework/automagic/linux.py | 1 + volatility/framework/automagic/mac.py | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index 6f7781b44..3590f18b5 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -84,6 +84,7 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): if layer and dtb: vollog.debug("DTB was found at: 0x{:0x}".format(dtb)) return layer + vollog.debug("No suitable linux banner could be matched") return None @classmethod diff --git a/volatility/framework/automagic/mac.py b/volatility/framework/automagic/mac.py index 5705bdd91..e88de792f 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility/framework/automagic/mac.py @@ -44,6 +44,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface): for banner_offset, banner in layer.scan(context = context, scanner = mss, progress_callback = progress_callback): dtb = None + vollog.debug("Identified banner: {}".format(repr(banner))) symbol_files = mac_banners.get(banner, None) if symbol_files: @@ -102,9 +103,9 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface): metadata = {'kaslr_value': kaslr_shift}) if new_layer and dtb: - vollog.debug("Identified banner: {}".format(repr(banner))) vollog.debug("DTB was found at: 0x{:0x}".format(dtb)) return new_layer + vollog.debug("No suitable mac banner could be matched") return None @classmethod