diff --git a/volatility/framework/interfaces/symbols.py b/volatility/framework/interfaces/symbols.py index f1c9f0e78..3c3ac49ae 100644 --- a/volatility/framework/interfaces/symbols.py +++ b/volatility/framework/interfaces/symbols.py @@ -5,22 +5,23 @@ import collections.abc from abc import abstractmethod from volatility.framework import constants, exceptions, validity -from volatility.framework.interfaces import configuration +from volatility.framework.interfaces import configuration, objects class Symbol(validity.ValidityRoutines): """Contains information about a named location in a program's memory""" - def __init__(self, name, address, type_name = None): + def __init__(self, name, address, type = None): self._name = self._check_type(name, str) if constants.BANG in self._name: raise ValueError("Symbol names cannot contain the symbol differentiator ({})".format(constants.BANG)) self._location = None self._address = self._check_type(address, int) - if type_name is None: - type_name = name - self._type_name = self._check_type(type_name, str) - # Scope and location can be added at a later date + self._type = None + if type is not None: + self._type = self._check_type(type, objects.Template) + + # Scope and location can be added at a later date @property def name(self): @@ -28,9 +29,9 @@ class Symbol(validity.ValidityRoutines): return self._name @property - def type_name(self): + def type(self): """Returns the name of the type that the symbol represents""" - return self._type_name + return self._type @property def address(self): diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 85f210a37..930f61f7c 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -309,3 +309,21 @@ class Version2Format(Version1Format): object_class = object_class, size = curdict['size'], members = members) + + +class Version2_1Format(Version2Format): + """Class for storing intermediate debugging data as objects and classes""" + current = 2 + revision = 0 + age = 1 + version = (current - age, age, revision) + + def get_symbol(self, name): + """Returns the location offset given by the symbol name""" + symbol = self._json_object['symbols'].get(name, None) + if not symbol: + raise KeyError("Unknown symbol: {}".format(name)) + symbol_type = None + if type in symbol: + symbol_type = self._interdict_to_template(symbol['type']) + return interfaces.symbols.Symbol(name = name, address = symbol['address'], type = symbol_type) diff --git a/volatility/schemas/schema-2.1.0.json b/volatility/schemas/schema-2.1.0.json new file mode 100644 index 000000000..969ad4288 --- /dev/null +++ b/volatility/schemas/schema-2.1.0.json @@ -0,0 +1,317 @@ +{ + "$schema": "http://json-schema.org/schema#", + "id": "http://volatilityfoundation.org/intermediate-format/schema", + "title": "Symbol Container", + "type": "object", + "definitions": { + "element_metadata": { + "type": "object", + "properties": { + "format": { + "type": "string", + "pattern": "^2.[0-9]+.[0-9]+$" + }, + "source": { + "type": "object", + "properties": { + "type": { + "type": "string" + } + } + }, + "producer": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "version": { + "type": "string" + }, + "datetime": { + "type": "string", + "format": "date-time" + } + } + } + }, + "required": [ + "format" + ], + "additionalProperties": false + }, + "element_enum": { + "properties": { + "size": { + "type": "integer" + }, + "base": { + "type": "string" + }, + "constants": { + "type": "object", + "additionalProperties": { + "type": "integer" + } + } + }, + "required": [ + "size", + "base", + "constants" + ], + "additionalProperties": false + }, + "element_symbol": { + "properties": { + "address": { + "type": "number" + }, + "linkage_name": { + "type": "string" + }, + "type": { + "$ref": "#/definitions/type_descriptor" + } + }, + "required": [ + "address" + ], + "additionalProperties": false + }, + "element_base_type": { + "properties": { + "size": { + "type": "integer" + } + }, + "required": [ + "size" + ], + "additionalProperties": false + }, + "element_user_type": { + "properties": { + "kind": { + "type": "string", + "pattern": "^(struct|union|class)$" + }, + "size": { + "type": "integer" + }, + "fields": { + "type": "object", + "additionalProperties": { + "$ref": "#/definitions/field" + } + } + }, + "required": [ + "kind", + "size", + "fields" + ], + "additionalProperties": false + }, + "field": { + "properties": { + "type": { + "$ref": "#/definitions/type_descriptor" + }, + "offset": { + "type": "integer" + } + }, + "required": [ + "type", + "offset" + ], + "additionalProperties": false + }, + "type_descriptor": { + "oneOf": [ + { + "$ref": "#/definitions/type_pointer" + }, + { + "$ref": "#/definitions/type_base" + }, + { + "$ref": "#/definitions/type_array" + }, + { + "$ref": "#/definitions/type_struct" + }, + { + "$ref": "#/definitions/type_enum" + }, + { + "$ref": "#/definitions/type_function" + }, + { + "$ref": "#/definitions/type_bitfield" + } + ] + }, + "type_pointer": { + "properties": { + "kind": { + "type": "string", + "pattern": "^pointer$" + }, + "subtype": { + "$ref": "#/definitions/type_descriptor" + } + }, + "required": [ + "kind", + "subtype" + ], + "additionalProperties": false + }, + "type_base": { + "properties": { + "kind": { + "type": "string", + "pattern": "^base$" + }, + "name": { + "type": "string" + } + }, + "required": [ + "kind", + "name" + ], + "additionalProperties": false + }, + "type_array": { + "properties": { + "kind": { + "type": "string", + "pattern": "^array$" + }, + "subtype": { + "$ref": "#/definitions/type_descriptor" + }, + "count": { + "type": "integer" + } + }, + "required": [ + "kind", + "subtype", + "count" + ], + "additionalProperties": false + }, + "type_struct": { + "properties": { + "kind": { + "type": "string", + "pattern": "^(struct|class|union)$" + }, + "name": { + "type": "string" + } + }, + "required": [ + "kind", + "name" + ], + "additionalProperties": false + }, + "type_enum": { + "properties": { + "kind": { + "type": "string", + "pattern": "^enum$" + }, + "name": { + "type": "string" + } + }, + "required": [ + "kind", + "name" + ], + "additionalProperties": false + }, + "type_function": { + "properties": { + "kind": { + "type": "string", + "pattern": "^function$" + } + }, + "required": [ + "kind" + ], + "additionalProperties": false + }, + "type_bitfield": { + "properties": { + "kind": { + "type": "string", + "pattern": "^bitfield$" + }, + "bit_position": { + "type": "integer" + }, + "bit_length": { + "type": "integer" + }, + "type": { + "oneOf": [ + { + "$ref": "#/definitions/type_base" + }, + { + "$ref": "#/definitions/type_enum" + } + ] + } + }, + "required": [ + "kind", + "bit_position", + "bit_length", + "type" + ], + "additionalProperties": false + } + }, + "properties": { + "metadata": { + "$ref": "#/definitions/element_metadata" + }, + "base_types": { + "additionalProperties": { + "$ref": "#/definitions/element_base_type" + } + }, + "user_types": { + "additionalProperties": { + "$ref": "#/definitions/element_user_type" + } + }, + "enums": { + "additionalProperties": { + "$ref": "#/definitions/element_enum" + } + }, + "symbols": { + "additionalProperties": { + "$ref": "#/definitions/element_symbol" + } + } + }, + "required": [ + "metadata", + "base_types", + "user_types", + "enums", + "symbols" + ], + "additionalProperties": false +}