volatilityfoundation / volatilityfoundation/volatility3

Improve automagic classes selection

Open
#1,333 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
4.4k
Forks
705
Avg merge
1d 10h
Merged PRs (30d)
3

Description

In the context of working with OS-agnostic plugins recently, I found that the automagic selection isn't working optimally.
For example, we can use the banners plugin, that is intended for Linux and Mac memory dumps which has only one requirement:

            requirements.TranslationLayerRequirement(
                name="primary", description="Memory layer to scan"
            )

In the current implementation of choose_automagic(), automagic classes are selected by identifying the OS from the plugin path (e.g., volatility3.plugins.linux.pslist is recognized as a Linux plugin). The function then filters classes based on the exclusion_list, resulting in a more refined selection of automagic classes.

Unfortunately, for OS-agnostic plugins, this function will return all automagics, see here. This means that for the banners plugin, it will end up executing all these:

construct_layers.ConstructionMagic
symbol_cache.SymbolCacheMagic
stacker.LayerStacker 
windows.WinSwapLayers
pdbscan.KernelPDBScanner
symbol_finder.SymbolFinder
linux.LinuxSymbolFinder
mac.MacSymbolFinder
module.KernelModule

As a result, the framework will attempt to detect the DTB, ASLR shifts, locate banners and match them with the ISFs,etc. for all OSes, despite these not being required for this plugin. The only automagic required in this case is the stacker.LayerStacker class.

I think it would be a good idea to redesign this code for a more precise selection of the automagics needed for each plugin, such as using the plugin requirements. This may require a more detailed requirement list, but it's something we should investigate further.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading choose_automagic() in volatility3/framework/automagic/init.py and the requirements on volatility3/plugins/banners.py. Trace how OS-agnostic plugins currently select automagics, then investigate how plugin requirements could drive a more precise selection. Done means banners no longer runs unrelated OS-specific automagics and the selection remains correct for OS-specific plugins.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
devtools
Issue type
Refactor
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.