Rework isf_filename to isf_url since we can load it from a remote location if required.

volatility/framework/automagic/linux.py

@@ -1,4 +1,5 @@
 import logging
+import pathlib
 
 from volatility.framework import interfaces, constants
 from volatility.framework.automagic import linux_symbol_cache
@@ -55,13 +56,13 @@ class LinuxSymbolFinder(interfaces.automagic.AutomagicInterface):
             vollog.debug("Identified banner: {}".format(repr(banner)))
             symbol_files = self._linux_banners[banner]
             if symbol_files:
-                isf_path = symbol_files[0]
+                isf_path = pathlib.Path(symbol_files[0]).as_uri()
                 vollog.debug("Using symbol library: {}".format(symbol_files[0]))
                 clazz = "volatility.framework.symbols.linux.LinuxKernelIntermedSymbols"
                 # Set the discovered options
                 path_join = interfaces.configuration.path_join
                 context.config[path_join(config_path, requirement.name, "class")] = clazz
-                context.config[path_join(config_path, requirement.name, "isf_filepath")] = isf_path
+                context.config[path_join(config_path, requirement.name, "isf_url")] = isf_path
                 # Construct the appropriate symbol table
                 requirement.construct(context, config_path)
                 break
@@ -97,7 +98,7 @@ class LintelStacker(interfaces.automagic.StackerLayerInterface):
                 isf_path = symbol_files[0]
                 table_name = context.symbol_space.free_table_name('LintelStacker')
                 table = linux.LinuxKernelIntermedSymbols(context, 'temporary.' + table_name, name = table_name,
-                                                         isf_filepath = isf_path)
+                                                         isf_url = isf_path)
                 context.symbol_space.append(table)
                 kaslr_shift, _ = LinuxUtilities.find_aslr(context, table_name, layer_name,
                                                           progress_callback = progress_callback)

volatility/framework/automagic/pdbscan.py

@@ -169,6 +169,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
         :param context: Context on which to operate
         :type context: ~volatility.framework.interfaces.context.ContextInterface
         """
+        join = interfaces.configuration.path_join
         for config_path, sub_config_path, requirement in self._symbol_requirements:
             # TODO: Potentially think about multiple symbol requirements in both the same and different levels of the requirement tree
             # TODO: Consider whether a single found kernel can fulfill multiple requirements
@@ -191,8 +192,8 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
                         vollog.debug("Using symbol library: {}".format(midfix))
                         clazz = "volatility.framework.symbols.windows.WindowsKernelIntermedSymbols"
                         # Set the discovered options
-                        context.config[interfaces.configuration.path_join(sub_config_path, "class")] = clazz
-                        context.config[interfaces.configuration.path_join(sub_config_path, "isf_filepath")] = isf_path
+                        context.config[join(sub_config_path, "class")] = clazz
+                        context.config[join(sub_config_path, "isf_url")] = isf_path
                         # Construct the appropriate symbol table
                         requirement.construct(context, config_path)
                         break
@@ -239,9 +240,9 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
             if virtual_layer_name and isinstance(context.memory[virtual_layer_name], layers.intel.Intel):
                 # TODO: Verify this is a windows image
                 vlayer = context.memory[virtual_layer_name]
-                physical_layer_name = context.config.get(
-                    interfaces.configuration.path_join(vlayer.config_path, 'memory_layer'), None)
-                kvo_path = interfaces.configuration.path_join(virtual_config_path, 'kernel_virtual_offset')
+                join = interfaces.configuration.path_join
+                physical_layer_name = context.config.get(join(vlayer.config_path, 'memory_layer'), None)
+                kvo_path = join(virtual_config_path, 'kernel_virtual_offset')
                 for kernel in kernels:
                     # It seems the kernel is loaded at a fixed mapping (presumably because the memory manager hasn't started yet)
                     if kernel['mz_offset'] is None:

volatility/framework/layers/registry.py

@@ -30,7 +30,7 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface):
 
         reg_path = "file://" + os_path.join(os_path.dirname(__file__), '..', 'symbols', 'windows', 'reg.json')
         table = intermed.IntermediateSymbolTable(context = context, config_path = config_path,
-                                                 name = self._reg_table_name, isf_filepath = reg_path)
+                                                 name = self._reg_table_name, isf_url = reg_path)
         context.symbol_space.append(table)
 
         self.hive = self.context.object(self._table_name + constants.BANG + "_CMHIVE", self._base_layer,

volatility/framework/symbols/intermed.py

@@ -48,7 +48,7 @@ def _construct_delegate_function(name, is_property = False):
 
 
 class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface):
-    def __init__(self, context, config_path, name, isf_filepath, native_types = None, validate = True):
+    def __init__(self, context, config_path, name, isf_url, native_types = None, validate = True):
         """Instantiates an SymbolTable based on an IntermediateSymbolFormat JSON file.  This is validated against the
         appropriate schema.  The validation can be disabled by passing validate = False, but this should almost never be
         done.
@@ -59,8 +59,8 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface):
         :type config_path:
         :param name:
         :type name:
-        :param isf_filepath:
-        :type isf_filepath:
+        :param isf_url:
+        :type isf_url:
         :param native_types:
         :type native_types:
         :param validate: Determines whether the ISF file will be validated against the appropriate schema
@@ -69,13 +69,13 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface):
         # Check there are no obvious errors
         # Open the file and test the version
         self._versions = dict([(x.version, x) for x in class_subclasses(ISFormatTable)])
-        fp = interfaces.layers.ResourceAccessor().open(isf_filepath)
+        fp = interfaces.layers.ResourceAccessor().open(isf_url)
         json_object = json.load(fp)
         fp.close()
 
         # Validation is expensive, but we cache to store the hashes of successfully validated json objects
         if validate and not schemas.validate(json_object):
-            raise exceptions.SymbolSpaceError("File does not pass version validation: {}".format(url.geturl()))
+            raise exceptions.SymbolSpaceError("File does not pass version validation: {}".format(isf_url))
 
         metadata = json_object.get('metadata', None)
 

volatility/framework/symbols/linux/__init__.py

@@ -1,6 +1,4 @@
-from volatility.framework import exceptions
 from volatility.framework.configuration import requirements
-from volatility.framework.interfaces import symbols
 from volatility.framework.symbols import intermed
 from volatility.framework.symbols.linux import extensions
 
@@ -8,8 +6,8 @@ from volatility.framework.symbols.linux import extensions
 class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable):
     provides = {"type": "interface"}
 
-    def __init__(self, context, config_path, name, isf_filepath):
-        super().__init__(context = context, config_path = config_path, name = name, isf_filepath = isf_filepath)
+    def __init__(self, context, config_path, name, isf_url):
+        super().__init__(context = context, config_path = config_path, name = name, isf_url = isf_url)
 
         # Set-up Linux specific types
         self.set_type_class('file', extensions.struct_file)
@@ -19,8 +17,7 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable):
         self.set_type_class('task_struct', extensions.task_struct)
         self.set_type_class('vm_area_struct', extensions.vm_area_struct)
 
-
     @classmethod
     def get_requirements(cls):
-        return [requirements.StringRequirement("isf_filepath",
+        return [requirements.StringRequirement("isf_url",
                                                description = "JSON file containing the symbols encoded in the Intermediate Symbol Format")]

volatility/framework/symbols/windows/__init__.py

@@ -7,8 +7,8 @@ from volatility.framework.symbols.windows.extensions import registry
 class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable):
     provides = {"type": "interface"}
 
-    def __init__(self, context, config_path, name, isf_filepath):
-        super().__init__(context = context, config_path = config_path, name = name, isf_filepath = isf_filepath)
+    def __init__(self, context, config_path, name, isf_url):
+        super().__init__(context = context, config_path = config_path, name = name, isf_url = isf_url)
 
         # Set-up windows specific types
         self.set_type_class('_ETHREAD', extensions._ETHREAD)
@@ -22,5 +22,5 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable):
 
     @classmethod
     def get_requirements(cls):
-        return [requirements.StringRequirement("isf_filepath",
+        return [requirements.StringRequirement("isf_url",
                                                description = "JSON file containing the symbols encoded in the Intermediate Symbol Format")]