mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-26 16:12:23 +02:00
27 lines
1.2 KiB
Python
27 lines
1.2 KiB
Python
from volatility.framework import interfaces
|
|
from volatility.framework.layers import scanners, intel
|
|
|
|
|
|
class LintelStacker(interfaces.automagic.StackerLayerInterface):
|
|
# This signature makes an assumption that Linux is using a Symmetric Multi-Processor
|
|
linux_signature = b"SYMBOL\(swapper_pg_dir\)=.*"
|
|
stack_order = 40
|
|
|
|
@classmethod
|
|
def stack(cls, context, layer_name, progress_callback = None):
|
|
"""Attempts to identify linux within this layer"""
|
|
layer = context.memory[layer_name]
|
|
|
|
# Bail out if we're not a physical layer
|
|
if isinstance(layer, intel.Intel):
|
|
return None
|
|
|
|
swapper_pg_dirs = []
|
|
for offset in layer.scan(scanner = scanners.RegExScanner(cls.linux_signature), context = context):
|
|
swapper_pg_dir_text = context.memory[layer_name].read(offset, len(cls.linux_signature) + 20)
|
|
swapper_pg_dir = int(swapper_pg_dir_text[
|
|
swapper_pg_dir_text.index(b"=") + 1:swapper_pg_dir_text.index(b"\n")], 16)
|
|
swapper_pg_dirs.append(swapper_pg_dir)
|
|
|
|
best_swapper_pg_dir = list(reversed(sorted(set(swapper_pg_dirs), key = lambda x: swapper_pg_dirs.count(x))))[0]
|