volatility3.framework.automagic package¶
Automagic modules allow the framework to populate configuration elements that a user has not provided.
Automagic objects accept a context and a configurable, and will make appropriate changes to the context in an attempt to fulfill the requirements of the configurable object (or objects upon which that configurable may rely).
Several pre-existing modules include one to stack layers on top of each other (allowing automatic detection and loading of file format types) as well as a module to reconstruct layers based on their provided requirements.
-
available
(context)[source]¶ Returns an ordered list of all subclasses of
AutomagicInterface
.The order is based on the priority attributes of the subclasses, in order to ensure the automagics are listed in an appropriate order.
- Parameters
context (
ContextInterface
) – The context that will contain any automagic configuration values.- Return type
-
choose_automagic
(automagics, plugin)[source]¶ Chooses which automagics to run, maintaining the order they were handed in.
- Return type
-
run
(automagics, context, configurable, config_path, progress_callback=None)[source]¶ Runs through the list of automagics in order, allowing them to make changes to the context.
- Parameters
automagics (
List
[AutomagicInterface
]) – A list ofAutomagicInterface
objectscontext (
ContextInterface
) – The context (that inherits fromContextInterface
) for modificationconfigurable (
Union
[ConfigurableInterface
,Type
[ConfigurableInterface
]]) – An object that inherits fromConfigurableInterface
config_path (
str
) – The path within the context.config for options required by the configurableprogress_callback (
Optional
[Callable
[[float
,str
],None
]]) – A function that takes a percentage (and an optional description) that will be called periodically
This is where any automagic is allowed to run, and alter the context in order to satisfy/improve all requirements
Returns a list of traceback objects that occurred during the autorun procedure
Note
The order of the automagics list is important. An automagic that populates configurations may be necessary for an automagic that populates the context based on the configuration information.
- Return type
Submodules¶
- volatility3.framework.automagic.construct_layers module
- volatility3.framework.automagic.linux module
- volatility3.framework.automagic.mac module
- volatility3.framework.automagic.pdbscan module
- volatility3.framework.automagic.stacker module
- volatility3.framework.automagic.symbol_cache module
- volatility3.framework.automagic.symbol_finder module
- volatility3.framework.automagic.windows module