The length value inside the read method of the TranslationLayer base class
would potentially get overwritten by the inner loop which also defined a
length value.
As @npetroni quite rightly pointed out, the purpose of the CLI is to
make it easy for people to use on the commandline, so at the expense of
some dynamic ability, -f is returning for convenience purposes.
This reverts commit 4450766d50.
Leave a comment to ensure we get back to checking out why the hbin size
check fails to only prevent bad accesses (and effectively gives false
positives).
Given the single-location parameter is now a URIRequirement, and
can accept normal files (rather than a full URL), but is far more
accurate (it matches exactly what the automagic requests). If there's
much uproar we can revert this one commit.
We now use mapping to skip unmapped pages when scanning. This
should be slightly quicker and likely more accurate. We also now
don't chunk over the size requested by the scanner. We don't quite
handle overlaps correctly yet (we overlap, but don't prevent
duplicates if the pattern is entirely within the overlap segment).
At the moment these are no different than strings, but they allow us to
do things like add URI handlers to file names if no scheme is provided,
and eventually do file existence testing. This also allows the web URI
to allow uploads as a means of passing a file in.
The configuration will only store the filename, because otherwise
someone could add a huge file which would need to be carried around in
the config forever after. Handling file existence errors is up to the
UI after the volatility library returns a "file not found" type
exception.
This uses the exceptions to indicate how much can be skipped in the
virtual intel translation layer. This means large holes in the memory
can be skipped more quickly. It also eliminates the is_valid/mapping
loop.
Given that volshell's plugins are now separate and not stored in the
core plugins list, there is no need to protect against it (and there are
no other "interactive" plugins, which will likely be barred from being
in the core set).
I'm not entirely happy with this, it's an overly specific hard coded
change, but luckily it's only for this CLI, it has no impact on other
UIs, either text based on web based.
I really don't want people to become reliant on this, but also I don't
want to be that guy that stops people being able to do their work
quickly for reasons of correctness. May future volatility devs forgive
me...
Mike Auty