Remove VolatilityMagic for HiveListOffset and HiveListPoolSize, since these can be calculated from the profiles directly.

volatility/plugins/overlays/windows/vista_sp0_x86.py

@@ -44,8 +44,6 @@ vistasp0x86overlays = copy.deepcopy(win2k3_sp2_x86.win2k3sp2x86overlays)
 vistasp0x86overlays['VOLATILITY_MAGIC'][1]['DTBSignature'][1] = ['VolatilityMagic', dict(value = "\x03\x00\x20\x00")]
 vistasp0x86overlays['VOLATILITY_MAGIC'][1]['KPCR'][1] = ['VolatilityKPCR', dict(configname = 'KPCR')]
 vistasp0x86overlays['VOLATILITY_MAGIC'][1]['KDBGHeader'][1] = ['VolatilityMagic', dict(value = '\x00\x00\x00\x00\x00\x00\x00\x00KDBG\x28\x03')]
-vistasp0x86overlays['VOLATILITY_MAGIC'][1]['HiveListOffset'][1] = ['VolatilityMagic', dict(value = 0x308)]
-vistasp0x86overlays['VOLATILITY_MAGIC'][1]['HiveListPoolSize'][1] = ['VolatilityMagic', dict(value = 0x5d8)]
 
 vista_sp0_x86_vtypes.nt_types.update(crash_vtypes.crash_vtypes)
 vista_sp0_x86_vtypes.nt_types.update(hibernate_vtypes.hibernate_vtypes)

volatility/plugins/overlays/windows/vista_sp2_x86.py

@@ -41,8 +41,6 @@ import volatility.debug as debug #pylint: disable-msg=W0611
 
 vistasp2x86overlays = copy.deepcopy(vista_sp1_x86.vistasp1x86overlays)
 
-vistasp2x86overlays['VOLATILITY_MAGIC'][1]['HiveListPoolSize'][1] = ['VolatilityMagic', dict(value = 0x5e8)]
-
 vista_sp2_x86_vtypes.nt_types.update(crash_vtypes.crash_vtypes)
 vista_sp2_x86_vtypes.nt_types.update(hibernate_vtypes.hibernate_vtypes)
 vista_sp2_x86_vtypes.nt_types.update(kdbg_vtypes.kdbg_vtypes)

volatility/plugins/overlays/windows/win2k3_sp0_x86.py

@@ -46,8 +46,6 @@ win2k3sp0x86overlays['_EPROCESS'][1]['VadRoot'][1] = ['_MM_AVL_TABLE']
 win2k3sp0x86overlays['VOLATILITY_MAGIC'][1]['DTBSignature'][1] = ['VolatilityMagic', dict(value = "\x03\x00\x1B\x00")]
 win2k3sp0x86overlays['VOLATILITY_MAGIC'][1]['KPCR'][1] = ['VolatilityKPCR', dict(value = 0xffdff000, configname = 'KPCR')]
 win2k3sp0x86overlays['VOLATILITY_MAGIC'][1]['KDBGHeader'][1] = ['VolatilityMagic', dict(value = '\x00\x00\x00\x00\x00\x00\x00\x00KDBG\x18\x03')]
-win2k3sp0x86overlays['VOLATILITY_MAGIC'][1]['HiveListOffset'][1] = ['VolatilityMagic', dict(value = 0x2e4)]
-win2k3sp0x86overlays['VOLATILITY_MAGIC'][1]['HiveListPoolSize'][1] = ['VolatilityMagic', dict(value = 0x578)]
 
 win2k3_sp0_x86_vtypes.nt_types.update(crash_vtypes.crash_vtypes)
 win2k3_sp0_x86_vtypes.nt_types.update(hibernate_vtypes.hibernate_vtypes)

volatility/plugins/overlays/windows/win2k3_sp1_x86.py

@@ -41,7 +41,6 @@ import volatility.debug as debug #pylint: disable-msg=W0611
 win2k3sp1x86overlays = copy.deepcopy(win2k3_sp0_x86.win2k3sp0x86overlays)
 
 win2k3sp1x86overlays['VOLATILITY_MAGIC'][1]['DTBSignature'][1] = ['VolatilityMagic', dict(value = "\x03\x00\x1e\x00")]
-win2k3sp1x86overlays['VOLATILITY_MAGIC'][1]['HiveListPoolSize'][1] = ['VolatilityMagic', dict(value = 0x588)]
 win2k3sp1x86overlays['_ETHREAD'][1]['CreateTime'][1] = ['WinTimeStamp', {}]
 
 win2k3_sp1_x86_vtypes.nt_types.update(crash_vtypes.crash_vtypes)

volatility/plugins/overlays/windows/win7_sp0_x86.py

@@ -42,8 +42,6 @@ win7sp0x86overlays = copy.deepcopy(vista_sp0_x86.vistasp0x86overlays)
 win7sp0x86overlays['VOLATILITY_MAGIC'][1]['DTBSignature'][1] = ['VolatilityMagic', dict(value = "\x03\x00\x26\x00")]
 win7sp0x86overlays['VOLATILITY_MAGIC'][1]['KPCR'][1] = ['VolatilityKPCR', dict(configname = 'KPCR')]
 win7sp0x86overlays['VOLATILITY_MAGIC'][1]['KDBGHeader'][1] = ['VolatilityMagic', dict(value = '\x00\x00\x00\x00\x00\x00\x00\x00KDBG\x40\x03')]
-win7sp0x86overlays['VOLATILITY_MAGIC'][1]['HiveListOffset'][1] = ['VolatilityMagic', dict(value = 0x30c)]
-win7sp0x86overlays['VOLATILITY_MAGIC'][1]['HiveListPoolSize'][1] = ['VolatilityMagic', dict(value = 0x638)]
 
 # Add a new member to the VOLATILIY_MAGIC type
 win7sp0x86overlays['VOLATILITY_MAGIC'][1]['ObjectPreamble'] = [ 0x0, ['VolatilityMagic', dict(value = '_OBJECT_HEADER_CREATOR_INFO')]]

volatility/plugins/overlays/windows/windows.py

@@ -655,7 +655,6 @@ class _MMSECTION_FLAGS(_MMVAD_FLAGS):
 AbstractWindowsX86.object_classes['_MMSECTION_FLAGS'] = _MMSECTION_FLAGS
 
 
-
 ### DEPRECATED FEATURES ###
 #
 # These are due from removal after version 2.2,

volatility/plugins/overlays/windows/xp_sp2_x86.py

@@ -56,8 +56,6 @@ xpsp2overlays = {
     'KUSER_SHARED_DATA' : [ 0x0, ['VolatilityMagic', dict(value = 0xFFDF0000)]],
     'KDBG' : [ 0x0, ['VolatilityKDBG', dict(configname = "KDBG")]],
     'KDBGHeader' : [ 0x0, ['VolatilityMagic', dict(value = '\x00\x00\x00\x00\x00\x00\x00\x00KDBG\x90\x02')]],
-    'HiveListOffset' : [ 0x0, ['VolatilityMagic', dict(value = 0x224)]],
-    'HiveListPoolSize': [ 0x0, ['VolatilityMagic', dict(value = 0x4a8)]],
     'IA32ValidAS': [ 0x0, ['VolatilityIA32ValidAS']],
     # Pool allocations are aligned to this many bytes.
     'PoolAlignment': [0x0, ['VolatilityMagic', dict(value = 8)]],

volatility/plugins/registry/hivelist.py

@@ -76,10 +76,9 @@ class HiveList(hs.HiveScan):
         ## the first hive in virtual address space. hmm I wish we
         ## could go from physical to virtual memory easier.
         for offset in hives:
-            hive = obj.Object("_CMHIVE", int(offset), flat)
-            o = obj.VolMagic(flat).HiveListOffset
+            hive = obj.Object("_CMHIVE", int(offset), flat, native_vm = addr_space)
             if hive.HiveList.Flink.v():
-                start_hive_offset = hive.HiveList.Flink.v() - o.v()
+                start_hive_offset = hive.HiveList.Flink.v() - addr_space.profile.get_obj_offset('_CMHIVE', 'HiveList')
 
                 ## Now instantiate the first hive in virtual address space as normal
                 start_hive = obj.Object("_CMHIVE", start_hive_offset, addr_space)

volatility/plugins/registry/hivescan.py

@@ -80,9 +80,7 @@ class HiveScan(commands.command):
     def calculate(self):
         ## Just grab the AS and scan it using our scanner
         pspace = utils.load_as(self._config, astype = 'physical')
-        o = obj.VolMagic(pspace).HiveListPoolSize
-
-        poolsize = o.v()
+        poolsize = pspace.profile.get_obj_size('_CMHIVE')
 
         return PoolScanHiveFast2(poolsize).scan(pspace)