From 16bed2aa94b99827e8bc2e4a33eaeb08d1dcfaf0 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 22 May 2016 16:02:30 +0100 Subject: [PATCH] Allow specifying a table_name for get_symbols_by_location. --- volatility/framework/symbols/__init__.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/volatility/framework/symbols/__init__.py b/volatility/framework/symbols/__init__.py index 2b4c6f0f3..962f4a96d 100644 --- a/volatility/framework/symbols/__init__.py +++ b/volatility/framework/symbols/__init__.py @@ -39,9 +39,15 @@ class SymbolSpace(collections.abc.Mapping): for symbol_name in self._dict[table].get_symbols_by_type(type_name): yield table + constants.BANG + symbol_name - def get_symbols_by_location(self, offset): + def get_symbols_by_location(self, offset, table_name = None): """Returns all symbols that exist at a specific relative offset""" - for table in self._dict.values(): + table_list = self._dict.values() + if table_name is not None: + if table_name in self._dict: + table_list = [self._dict[table_name]] + else: + table_list = [] + for table in table_list: for symbol_name in self._dict[table].get_symbols_by_location(offset = offset): yield table + constants.BANG + symbol_name