Skip to content

Commit c48ad90

Browse files
committed
Extensions: Add cache decorators as appropriate
I noticed that many plugins were creating duplicate per-process translation layers - for instance, `windows.envars.Envars` was ending up with > 30 process layers per process due to repeated calls to `get_peb()`, which calls `add_process_space()` internally. This adds `@functools.lru_cache` to the `get_peb()` and `get_peb32()` methods on the `EPROCESS` extension, since these should only need to be created once. Also adds `@functools.lru_cache` to `add_process_space` to enable reusing the same process address space, provided the same arguments are passed to the `add_process_space()` method.
1 parent e00f096 commit c48ad90

File tree

3 files changed

+7
-1
lines changed

3 files changed

+7
-1
lines changed

volatility3/framework/symbols/linux/extensions/__init__.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -471,6 +471,7 @@ def is_valid(self) -> bool:
471471

472472
return True
473473

474+
@functools.lru_cache
474475
def add_process_layer(
475476
self, config_prefix: Optional[str] = None, preferred_name: Optional[str] = None
476477
) -> Optional[str]:

volatility3/framework/symbols/mac/extensions/__init__.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
33
#
44
import contextlib
5+
import functools
56
import logging
67
from typing import Generator, Iterable, Optional, Set, Tuple
78

@@ -17,6 +18,7 @@ class proc(generic.GenericIntelProcess):
1718
def get_task(self):
1819
return self.task.dereference().cast("task")
1920

21+
@functools.lru_cache
2022
def add_process_layer(
2123
self, config_prefix: Optional[str] = None, preferred_name: Optional[str] = None
2224
) -> Optional[str]:

volatility3/framework/symbols/windows/extensions/__init__.py

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -732,9 +732,10 @@ def is_valid(self) -> bool:
732732

733733
return True
734734

735+
@functools.lru_cache
735736
def add_process_layer(
736737
self, config_prefix: Optional[str] = None, preferred_name: Optional[str] = None
737-
):
738+
) -> str:
738739
"""Constructs a new layer based on the process's DirectoryTableBase."""
739740

740741
parent_layer = self._context.layers[self.vol.layer_name]
@@ -761,6 +762,7 @@ def add_process_layer(
761762
self._context, dtb, config_prefix, preferred_name
762763
)
763764

765+
@functools.lru_cache
764766
def get_peb(self) -> interfaces.objects.ObjectInterface:
765767
"""Constructs a PEB object"""
766768
if constants.BANG not in self.vol.type_name:
@@ -786,6 +788,7 @@ def get_peb(self) -> interfaces.objects.ObjectInterface:
786788
)
787789
return peb
788790

791+
@functools.lru_cache
789792
def get_peb32(self) -> Optional[interfaces.objects.ObjectInterface]:
790793
"""Constructs a PEB32 object"""
791794
if constants.BANG not in self.vol.type_name:

0 commit comments

Comments
 (0)