# Path: haystack/mappings/vol.py
# class VolatilityProcessMapper(interfaces.IMemoryLoader):
# 
#     def __init__(self, imgname, profile, pid):
#         self.pid = pid
#         self.imgname = imgname
#         # FIXME for some reason volatility is able to autodetect.
#         # but not with this piece of code.
#         self.profile = profile
#         #self.profile = None
#         self._memory_handler = None
#         self._unload_volatility()
#         self._init_volatility()
# 
#     def _unload_volatility(self):
#         '''we cannot have volatility already loaded.
#         we need to remove it'''
#         for mod in sys.modules.keys():
#             if 'volatility' in mod:
#                 del sys.modules[mod]
# 
#     def _init_volatility(self):
#         #import sys
#         # for mod in sys.modules.keys():
#         #    if 'parse' in mod:
#         #        del sys.modules[mod]
#         #        print "deleted",mod
#         #import sys
#         # if len(sys.argv) > 3:
#         #    #sys.args=[sys.args[3]]
#         #    sys.argv=[sys.argv[0],'-f',sys.argv[3]]
#         # print 'after modif',sys.argv
#         import volatility.conf as conf
#         import volatility.registry as registry
#         registry.PluginImporter()
#         config = conf.ConfObject()
#         import volatility.commands as commands
#         import volatility.addrspace as addrspace
#         import volatility.utils as volutils
#         registry.register_global_options(config, commands.Command)
#         registry.register_global_options(config, addrspace.BaseAddressSpace)
#         # Dying because it cannot parse argv options
#         # apparently, it was not required to parse options. hey.
#         # config.parse_options()
#         #addr_space = volutils.load_as(config,astype = 'any')
#         #print config.PROFILE
#         #import code
#         #code.interact(local=locals())
#         config.PROFILE = self.profile
#         #_target_platform.LOCATION = "file:///media/memory/private/image.dmp"
#         config.LOCATION = "file://%s" % self.imgname
#         config.PID = str(self.pid)
# 
#         self.config = config
# 
#         import volatility.plugins.vadinfo as vadinfo
# 
#         command = vadinfo.VADWalk(config)
#         command.render_text = partial(my_render_text, self, command)
#         command.execute()
#         # works now.
#         #for x in self._memory_handler.get_mappings():
#         #    print x
#         #import code
#         #code.interact(local=locals())
# 
#     def make_memory_handler(self):
#         return self._memory_handler


import logging
import unittest
            import volatility
from haystack.mappings.vol import VolatilityProcessMapper
from test.testfiles import zeus_1668_vmtoolsd_exe
from test.testfiles import zeus_856_svchost_exe
        from haystack.allocators.win32 import winxp_32
log = logging.getLogger('test_vol')

#@unittest.skip('not ready')
class TestMapper(unittest.TestCase):
    """
    load zeus.vmem from https://code.google.com/p/volatility/wiki/MemorySamples
    The malware analysis cookbook
    """

    def setUp(self):
        try:
        except ImportError as e:
            self.skipTest('Volatility not installed')
        pass

    def tearDown(self):
        pass

    def test_number_of_mappings(self):
        """ check the number of mappings on 3 processes """
        #check vad numbers with
        #vol.py -f /home/jal/outputs/vol/zeus.vmem -p 856 vadwalk |wc -l
        #5 headers lines to be removed from count
        #
        #analysis here:
        #https://malwarereversing.wordpress.com/2011/09/23/zeus-analysis-in-volatility-2-0/

        f = '/home/jal/outputs/vol/zeus.vmem'
        pid = 856
        # PID 856 has 176 _memory_handler

# Path: haystack/mappings/vol.py
# class VolatilityProcessMapper(interfaces.IMemoryLoader):
# 
#     def __init__(self, imgname, profile, pid):
#         self.pid = pid
#         self.imgname = imgname
#         # FIXME for some reason volatility is able to autodetect.
#         # but not with this piece of code.
#         self.profile = profile
#         #self.profile = None
#         self._memory_handler = None
#         self._unload_volatility()
#         self._init_volatility()
# 
#     def _unload_volatility(self):
#         '''we cannot have volatility already loaded.
#         we need to remove it'''
#         for mod in sys.modules.keys():
#             if 'volatility' in mod:
#                 del sys.modules[mod]
# 
#     def _init_volatility(self):
#         #import sys
#         # for mod in sys.modules.keys():
#         #    if 'parse' in mod:
#         #        del sys.modules[mod]
#         #        print "deleted",mod
#         #import sys
#         # if len(sys.argv) > 3:
#         #    #sys.args=[sys.args[3]]
#         #    sys.argv=[sys.argv[0],'-f',sys.argv[3]]
#         # print 'after modif',sys.argv
#         import volatility.conf as conf
#         import volatility.registry as registry
#         registry.PluginImporter()
#         config = conf.ConfObject()
#         import volatility.commands as commands
#         import volatility.addrspace as addrspace
#         import volatility.utils as volutils
#         registry.register_global_options(config, commands.Command)
#         registry.register_global_options(config, addrspace.BaseAddressSpace)
#         # Dying because it cannot parse argv options
#         # apparently, it was not required to parse options. hey.
#         # config.parse_options()
#         #addr_space = volutils.load_as(config,astype = 'any')
#         #print config.PROFILE
#         #import code
#         #code.interact(local=locals())
#         config.PROFILE = self.profile
#         #_target_platform.LOCATION = "file:///media/memory/private/image.dmp"
#         config.LOCATION = "file://%s" % self.imgname
#         config.PID = str(self.pid)
# 
#         self.config = config
# 
#         import volatility.plugins.vadinfo as vadinfo
# 
#         command = vadinfo.VADWalk(config)
#         command.render_text = partial(my_render_text, self, command)
#         command.execute()
#         # works now.
#         #for x in self._memory_handler.get_mappings():
#         #    print x
#         #import code
#         #code.interact(local=locals())
# 
#     def make_memory_handler(self):
#         return self._memory_handler


# Path: test/haystack/mappings/test_vol.py
import logging
import unittest
            import volatility
from haystack.mappings.vol import VolatilityProcessMapper
from test.testfiles import zeus_1668_vmtoolsd_exe
from test.testfiles import zeus_856_svchost_exe
        from haystack.allocators.win32 import winxp_32

log = logging.getLogger('test_vol')

#@unittest.skip('not ready')
class TestMapper(unittest.TestCase):
    """
    load zeus.vmem from https://code.google.com/p/volatility/wiki/MemorySamples
    The malware analysis cookbook
    """

    def setUp(self):
        try:
        except ImportError as e:
            self.skipTest('Volatility not installed')
        pass

    def tearDown(self):
        pass

    def test_number_of_mappings(self):
        """ check the number of mappings on 3 processes """
        #check vad numbers with
        #vol.py -f /home/jal/outputs/vol/zeus.vmem -p 856 vadwalk |wc -l
        #5 headers lines to be removed from count
        #
        #analysis here:
        #https://malwarereversing.wordpress.com/2011/09/23/zeus-analysis-in-volatility-2-0/

        f = '/home/jal/outputs/vol/zeus.vmem'
        pid = 856
        # PID 856 has 176 _memory_handler

        mapper = VolatilityProcessMapper(f, "WinXPSP2x86", pid)