mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-12 20:57:39 +02:00
Rework the array_of_pointers utility function.
It now makes use of the original array's symbol table to get the pointer template, such that the size of the pointer is correct according to the original table. Resolves "pointer.size" attribute errors (firing inside a property and thus throwing off unusual exceptions).
This commit is contained in:
@@ -1,7 +1,7 @@
|
||||
import datetime
|
||||
import typing
|
||||
|
||||
from volatility.framework import interfaces, objects, renderers
|
||||
from volatility.framework import interfaces, objects, renderers, constants
|
||||
|
||||
|
||||
def array_to_string(array: objects.Array,
|
||||
@@ -33,11 +33,13 @@ def array_of_pointers(array: interfaces.objects.ObjectInterface,
|
||||
subtype: typing.Optional[typing.Union[str, interfaces.objects.Template]] = None,
|
||||
context: interfaces.context.ContextInterface = None) -> interfaces.objects.ObjectInterface:
|
||||
"""Takes an object, and recasts it as an array of pointers to subtype"""
|
||||
symbol_table = array.vol.type_name.split(constants.BANG)[0]
|
||||
if isinstance(subtype, str) and context is not None:
|
||||
subtype = context.symbol_space.get_type(subtype)
|
||||
if not isinstance(subtype, interfaces.objects.Template) or subtype is None:
|
||||
raise TypeError("Subtype must be a valid template (or string name of an object template)")
|
||||
subtype_pointer = objects.templates.ObjectTemplate(objects.Pointer, type_name = 'pointer', subtype = subtype)
|
||||
subtype_pointer = context.symbol_space.get_type(symbol_table + constants.BANG + "pointer")
|
||||
subtype_pointer.update_vol(subtype = subtype)
|
||||
return array.cast("array", count = count, subtype = subtype_pointer)
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user