volatilityfoundation / volatilityfoundation/volatility3
Improve automagic classes selection
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 4.4k
- Forks
- 705
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 3
Description
In the context of working with OS-agnostic plugins recently, I found that the automagic selection isn't working optimally.
For example, we can use the banners plugin, that is intended for Linux and Mac memory dumps which has only one requirement:
requirements.TranslationLayerRequirement(
name="primary", description="Memory layer to scan"
)
In the current implementation of choose_automagic(), automagic classes are selected by identifying the OS from the plugin path (e.g., volatility3.plugins.linux.pslist is recognized as a Linux plugin). The function then filters classes based on the exclusion_list, resulting in a more refined selection of automagic classes.
Unfortunately, for OS-agnostic plugins, this function will return all automagics, see here. This means that for the banners plugin, it will end up executing all these:
construct_layers.ConstructionMagic
symbol_cache.SymbolCacheMagic
stacker.LayerStacker
windows.WinSwapLayers
pdbscan.KernelPDBScanner
symbol_finder.SymbolFinder
linux.LinuxSymbolFinder
mac.MacSymbolFinder
module.KernelModule
As a result, the framework will attempt to detect the DTB, ASLR shifts, locate banners and match them with the ISFs,etc. for all OSes, despite these not being required for this plugin. The only automagic required in this case is the stacker.LayerStacker class.
I think it would be a good idea to redesign this code for a more precise selection of the automagics needed for each plugin, such as using the plugin requirements. This may require a more detailed requirement list, but it's something we should investigate further.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading choose_automagic() in volatility3/framework/automagic/init.py and the requirements on volatility3/plugins/banners.py. Trace how OS-agnostic plugins currently select automagics, then investigate how plugin requirements could drive a more precise selection. Done means banners no longer runs unrelated OS-specific automagics and the selection remains correct for OS-specific plugins.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- devtools
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100