From 0ecf68af0f6cf76ff86d7f84f2d31fa335d41cdc Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Mon, 27 Nov 2017 14:39:46 +0000
Subject: [PATCH] Support table remapping for referenced symbol names.

---
 volatility/framework/interfaces/symbols.py | 16 ++++++++++++----
 volatility/framework/symbols/intermed.py   |  4 ++++
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/volatility/framework/interfaces/symbols.py b/volatility/framework/interfaces/symbols.py
index 7c1d93751..321993b2e 100644
--- a/volatility/framework/interfaces/symbols.py
+++ b/volatility/framework/interfaces/symbols.py
@@ -88,14 +88,22 @@ class SymbolSpaceInterface(collections.abc.Mapping):
 
 
 class BaseSymbolTableInterface(validity.ValidityRoutines):
-    """The base interface, inherited by both NativeTables and SymbolTables"""
+    """The base interface, inherited by both NativeTables and SymbolTables
 
-    def __init__(self, name, native_types = None):
-        self._check_type(native_types, NativeTableInterface)
+    native_types is a NativeTableInterface used for native types for the particular loaded symbol table
+    table_mapping allows tables referenced by symbols to be remapped to a different table name if necessary
+
+    Note: table_mapping is a rarely used feature (since symbol tables are typically self-contained)
+    """
+
+    def __init__(self, name, native_types = None, table_mapping = None):
         if name:
             self._check_type(name, str)
         self.name = name or None
-        self._native_types = native_types
+        if table_mapping is None:
+            table_mapping = {}
+        self.table_mapping = self._check_type(table_mapping, dict)
+        self._native_types = self._check_type(native_types, NativeTableInterface)
 
     # ## Required Symbol functions
 
diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py
index 1c649d42a..1e1aece41 100644
--- a/volatility/framework/symbols/intermed.py
+++ b/volatility/framework/symbols/intermed.py
@@ -273,6 +273,10 @@ class Version1Format(ISFormatTable):
         reference_name = dictionary['name']
         if constants.BANG not in reference_name:
             reference_name = self.name + constants.BANG + reference_name
+        else:
+            reference_parts = reference_name.split(constants.BANG)
+            reference_name = (self.table_mapping.get(reference_parts[0], reference_parts[0]) +
+                              constants.BANG + constants.BANG.join(reference_parts[1:]))
 
         return objects.templates.ReferenceTemplate(type_name = reference_name)