""" Created on 6 Apr 2016 @author: npetroni@volexity.com """ import struct from volatility.framework import exceptions, interfaces from volatility.framework.layers import segmented class LimeFormatException(exceptions.LayerException): """Thrown when an error occurs with the underlying Lime file format""" class LimeLayer(segmented.SegmentedLayer): """A Lime format TranslationLayer. Lime is generally used to store physical memory images where there are large holes in the physical address space""" provides = {"type": "physical"} priority = 21 MAGIC = 0x4c694d45 VERSION = 1 # Magic[4], Version[4], Start[8], End[8], Reserved[8] # XXX move this to a custom SymbolSpace? _header_struct = struct.Struct('