mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-17 20:35:40 +02:00
45 lines
2.4 KiB
Python
45 lines
2.4 KiB
Python
from volatility.framework import interfaces, layers, configuration
|
|
|
|
__author__ = 'mike'
|
|
|
|
|
|
class IntelContextModifier(interfaces.context.ContextModifierInterface):
|
|
@classmethod
|
|
def requirements(cls):
|
|
return [configuration.ChoiceRequirement(name = "architecture",
|
|
choices = ["auto", "pae", "32", "64"],
|
|
description = "Determines the memory image",
|
|
default = "auto"),
|
|
configuration.IntRequirement(name = "page_map_offset",
|
|
description = "Offset to the directory table base"),
|
|
configuration.StringRequirement(name = 'layer_name',
|
|
description = 'Name of the layer to be added to the memory space',
|
|
default = 'intel'),
|
|
configuration.TranslationLayerRequirement(name = 'physical_layer',
|
|
description = 'Physical Address Space',
|
|
os_type = 'windows',
|
|
architectures = None,
|
|
layer_type = 'physical'),
|
|
configuration.TranslationLayerRequirement(name = 'swap_layer',
|
|
description = "Layer name for the swap layer",
|
|
optional = True)]
|
|
|
|
def modify_context(self, context):
|
|
# TODO: Attempt to determine whether the image is 32, PAE or x64 (although the context must already know whether it is x64)
|
|
config = self.config_get(context)
|
|
|
|
if config.get('architecture') == 'pae':
|
|
layer = layers.intel.IntelPAE
|
|
elif config.get('architecture') == '32':
|
|
layer = layers.intel.Intel
|
|
elif config.get('architecture') == '64':
|
|
layer = layers.intel.Intel32e
|
|
else:
|
|
# TODO: Add automagic here
|
|
layer = layers.intel.IntelPAE
|
|
|
|
intel = layer(context, config.get_value('layer_name'),
|
|
config.get_value('physical_layer').name,
|
|
page_map_offset = config.get_value('page_map_offset'))
|
|
context.add_layer(intel)
|