Hello, this is very useful to optimize some scans, like in case of sandboxing, imagine:
1 round it scans only all processes that was captured by sandbox aka pid_list
2. round it scans all the rest processes ignoring pid_list from round 1
if you have a better idea how to improve/implement this, let me know, we use our custom function, but i think it might be useful for the rest
1) Remove empty newlines before the license
2) Remove unused imports
3) Add support for 32-bit Bitmap crash dumps
4) Move _SUMMARY_DUMP to crash_common.json and fix the swapped Pages and BitmapSize offsets
5) Fix other errors in crash64.json (swapped SystemTime vs SystemUpTime, PsActiveProcessHead should be unsigned long long, several incorrect offsets for other members
6) Switched to new volatility3 namespace
7) Reverted required_framework_version to (1, 0, 0)
8) Fixed crashinfo plugin from unpacking the wrong number of values from layer.mapping(). Actually, the plugin no longer displays runs - it shows metadata instead.
9) Address Ikelos' comments in PR #452
Since all the checks for symbol_shift use essentially "if not
config['symbol_shift']" is doesn't matter whether 0 or None is
returned. I'd like to test this on an ASLR image, but I think it should
be fine and I'd feel much happier about everything if we could give it a
numeric default.
The symbol_shift isn't quite as nice as it could be, because we use None
to demark an unset state, which is different than a value of 0 (because
unset will trip linux to try to identify, whereas 0 will not).
Every where we use the value, we get it from the dictionary and use 0 if
it's not found (essentially forcing a default), but ideally, the default
would be set. As such, it's safe to set optional to true (and thus not
require it for configuration files), but it's not ideal that the linux
symbol finder can't determine whether to run or not without knowing
whether the value's been intentionally set...
This should already have been versioned because it had a classmethod.
Since it wasn't, we can start at (1, 0, 0) but it should only need
framrwork version (1, 0, 0) as well.
