Add in an initial implementation of the metadata system (extremely liable to change).

volatility/framework/interfaces/symbols.py

@@ -265,3 +265,11 @@ class NativeTableInterface(BaseSymbolTableInterface):
     @property
     def enumerations(self) -> typing.Iterable[str]:
         return []
+
+
+class MetadataInterface(object):
+    """Interface for accessing metadata stored within a symbol table"""
+
+    def __init__(self, json_data: typing.Dict) -> None:
+        """Constructor that accepts json_data"""
+        self._json_data = json_data

volatility/framework/symbols/intermed.py

@@ -12,7 +12,7 @@ from abc import ABCMeta
 import volatility
 from volatility import schemas, symbols
 from volatility.framework import class_subclasses, constants, exceptions, interfaces, objects, layers
-from volatility.framework.symbols import native
+from volatility.framework.symbols import native, metadata
 
 vollog = logging.getLogger(__name__)
 
@@ -119,6 +119,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface):
     symbols = _construct_delegate_function('symbols', True)
     types = _construct_delegate_function('types', True)
     enumerations = _construct_delegate_function('enumerations', True)
+    metadata = _construct_delegate_function('metadata', True)
     get_type = _construct_delegate_function('get_type')
     get_symbol = _construct_delegate_function('get_symbol')
     get_enumeration = _construct_delegate_function('get_enumeration')
@@ -252,6 +253,10 @@ class ISFormatTable(interfaces.symbols.SymbolTableInterface, metaclass = ABCMeta
                 not 'enums' in self._json_object):
             raise exceptions.SymbolSpaceError("Malformed JSON file provided")
 
+    def metadata(self) -> typing.Optional[interfaces.symbols.MetadataInterface]:
+        """Returns a metadata object containing information about the symbol table"""
+        return None
+
 
 class Version1Format(ISFormatTable):
     """Class for storing intermediate debugging data as objects and classes"""
@@ -528,3 +533,11 @@ class Version6Format(Version5Format):
     age = 0
     version = (current - age, age, revision)
 
+    @property
+    def metadata(self) -> typing.Optional[interfaces.symbols.MetadataInterface]:
+        """Returns a MetadataInterface object"""
+        if self._json_object.get('metadata', {}).get('windows'):
+            return metadata.WindowsMetadata(self._json_object['metadata']['windows'])
+        if self._json_object.get('metadata', {}).get('linux'):
+            return metadata.LinuxMetadata(self._json_object['metadata']['linux'])
+        return None

volatility/framework/symbols/metadata.py

@@ -0,0 +1,37 @@
+import typing
+
+from volatility.framework import interfaces
+
+
+class WindowsMetadata(interfaces.symbols.MetadataInterface):
+    """Class to handle the metadata from a Windows symbol table"""
+
+    @property
+    def pe_version(self) -> typing.Optional[typing.Tuple]:
+        build = self._json_data.get('pe', {}).get('build', None)
+        revision = self._json_data.get('pe', {}).get('revision', None)
+        minor = self._json_data.get('pe', {}).get('minor', None)
+        major = self._json_data.get('pe', {}).get('major', None)
+        if revision is None or minor is None or major is None:
+            return None
+        if build is None:
+            return (major, minor, revision)
+        return (major, minor, revision, build)
+
+    @property
+    def pe_version_string(self) -> typing.Optional[str]:
+        if self.pe_version is None:
+            return None
+        return ".".join(self.pe_version)
+
+    @property
+    def pdb_guid(self) -> typing.Optional[str]:
+        return self._json_data.get('pdb', {}).get('GUID', None)
+
+    @property
+    def pdb_age(self) -> typing.Optional[int]:
+        return self._json_data.get('pdb', {}).get('age', None)
+
+
+class LinuxMetadata(interfaces.symbols.MetadataInterface):
+    """Class to handle the etadata from a Linux symbol table"""

volatility/schemas/schema-6.0.0.json

@@ -28,10 +28,10 @@
         "minor": {
           "type": "integer"
         },
-        "build": {
+        "revision": {
           "type": "integer"
         },
-        "release": {
+        "build": {
           "type": "integer"
         }
       },
@@ -39,7 +39,7 @@
       "required": [
         "major",
         "minor",
-        "build"
+        "revision"
       ]
     },
     "metadata_windows_pdb": {