volatility3.framework.automagic package

Automagic modules allow the framework to populate configuration elements that a user has not provided.

Automagic objects accept a context and a configurable, and will make appropriate changes to the context in an attempt to fulfill the requirements of the configurable object (or objects upon which that configurable may rely).

Several pre-existing modules include one to stack layers on top of each other (allowing automatic detection and loading of file format types) as well as a module to reconstruct layers based on their provided requirements.

available(context)[source]

Returns an ordered list of all subclasses of AutomagicInterface.

The order is based on the priority attributes of the subclasses, in order to ensure the automagics are listed in an appropriate order.

Parameters:

context (ContextInterface) – The context that will contain any automagic configuration values.

Return type:

List[AutomagicInterface]

choose_automagic(automagics, plugin)[source]

Chooses which automagics to run, maintaining the order they were handed in.

Return type:

List[Type[AutomagicInterface]]

run(automagics, context, configurable, config_path, progress_callback=None)[source]

Runs through the list of automagics in order, allowing them to make changes to the context.

Parameters:
Return type:

List[TracebackException]

This is where any automagic is allowed to run, and alter the context in order to satisfy/improve all requirements

Returns a list of traceback objects that occurred during the autorun procedure

Note

The order of the automagics list is important. An automagic that populates configurations may be necessary for an automagic that populates the context based on the configuration information.

Submodules