diff --git a/volatility/framework/interfaces/symbols.py b/volatility/framework/interfaces/symbols.py index 7c1d93751..321993b2e 100644 --- a/volatility/framework/interfaces/symbols.py +++ b/volatility/framework/interfaces/symbols.py @@ -88,14 +88,22 @@ class SymbolSpaceInterface(collections.abc.Mapping): class BaseSymbolTableInterface(validity.ValidityRoutines): - """The base interface, inherited by both NativeTables and SymbolTables""" + """The base interface, inherited by both NativeTables and SymbolTables - def __init__(self, name, native_types = None): - self._check_type(native_types, NativeTableInterface) + native_types is a NativeTableInterface used for native types for the particular loaded symbol table + table_mapping allows tables referenced by symbols to be remapped to a different table name if necessary + + Note: table_mapping is a rarely used feature (since symbol tables are typically self-contained) + """ + + def __init__(self, name, native_types = None, table_mapping = None): if name: self._check_type(name, str) self.name = name or None - self._native_types = native_types + if table_mapping is None: + table_mapping = {} + self.table_mapping = self._check_type(table_mapping, dict) + self._native_types = self._check_type(native_types, NativeTableInterface) # ## Required Symbol functions diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 1c649d42a..1e1aece41 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -273,6 +273,10 @@ class Version1Format(ISFormatTable): reference_name = dictionary['name'] if constants.BANG not in reference_name: reference_name = self.name + constants.BANG + reference_name + else: + reference_parts = reference_name.split(constants.BANG) + reference_name = (self.table_mapping.get(reference_parts[0], reference_parts[0]) + + constants.BANG + constants.BANG.join(reference_parts[1:])) return objects.templates.ReferenceTemplate(type_name = reference_name)