mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-23 22:52:23 +02:00
22 lines
873 B
Python
22 lines
873 B
Python
from volatility.framework import interfaces
|
|
from volatility.framework.layers import scanners, intel
|
|
|
|
|
|
class LintelStacker(interfaces.automagic.StackerLayerInterface):
|
|
# This signature makes an assumption that Linux is using a Symmetric Multi-Processor
|
|
linux_signature = b"Linux [^ ]* [0-9]\.[0-9]+\.[0-9]+[^ ]* #[0-9]+ SMP"
|
|
|
|
@classmethod
|
|
def stack(cls, context, layer_name, progress_callback = None):
|
|
"""Attempts to identify linux within this layer"""
|
|
layer = context.memory[layer_name]
|
|
|
|
# Bail out if we're not a physical layer
|
|
if isinstance(layer, intel.Intel):
|
|
return None
|
|
|
|
for offset in layer.scan(scanner = scanners.RegExScanner(cls.linux_signature), context = context):
|
|
# print("Offset: ", hex(offset))
|
|
# print(context.memory[layer_name].read(offset, 100))
|
|
break
|