diff --git a/volatility/framework/interfaces/symbols.py b/volatility/framework/interfaces/symbols.py index 593cefa88..87f9f305e 100644 --- a/volatility/framework/interfaces/symbols.py +++ b/volatility/framework/interfaces/symbols.py @@ -265,3 +265,11 @@ class NativeTableInterface(BaseSymbolTableInterface): @property def enumerations(self) -> typing.Iterable[str]: return [] + + +class MetadataInterface(object): + """Interface for accessing metadata stored within a symbol table""" + + def __init__(self, json_data: typing.Dict) -> None: + """Constructor that accepts json_data""" + self._json_data = json_data diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 0b5f17b21..7805d12f2 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -12,7 +12,7 @@ from abc import ABCMeta import volatility from volatility import schemas, symbols from volatility.framework import class_subclasses, constants, exceptions, interfaces, objects, layers -from volatility.framework.symbols import native +from volatility.framework.symbols import native, metadata vollog = logging.getLogger(__name__) @@ -119,6 +119,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): symbols = _construct_delegate_function('symbols', True) types = _construct_delegate_function('types', True) enumerations = _construct_delegate_function('enumerations', True) + metadata = _construct_delegate_function('metadata', True) get_type = _construct_delegate_function('get_type') get_symbol = _construct_delegate_function('get_symbol') get_enumeration = _construct_delegate_function('get_enumeration') @@ -252,6 +253,10 @@ class ISFormatTable(interfaces.symbols.SymbolTableInterface, metaclass = ABCMeta not 'enums' in self._json_object): raise exceptions.SymbolSpaceError("Malformed JSON file provided") + def metadata(self) -> typing.Optional[interfaces.symbols.MetadataInterface]: + """Returns a metadata object containing information about the symbol table""" + return None + class Version1Format(ISFormatTable): """Class for storing intermediate debugging data as objects and classes""" @@ -528,3 +533,11 @@ class Version6Format(Version5Format): age = 0 version = (current - age, age, revision) + @property + def metadata(self) -> typing.Optional[interfaces.symbols.MetadataInterface]: + """Returns a MetadataInterface object""" + if self._json_object.get('metadata', {}).get('windows'): + return metadata.WindowsMetadata(self._json_object['metadata']['windows']) + if self._json_object.get('metadata', {}).get('linux'): + return metadata.LinuxMetadata(self._json_object['metadata']['linux']) + return None diff --git a/volatility/framework/symbols/metadata.py b/volatility/framework/symbols/metadata.py new file mode 100644 index 000000000..0b2e0a9f2 --- /dev/null +++ b/volatility/framework/symbols/metadata.py @@ -0,0 +1,37 @@ +import typing + +from volatility.framework import interfaces + + +class WindowsMetadata(interfaces.symbols.MetadataInterface): + """Class to handle the metadata from a Windows symbol table""" + + @property + def pe_version(self) -> typing.Optional[typing.Tuple]: + build = self._json_data.get('pe', {}).get('build', None) + revision = self._json_data.get('pe', {}).get('revision', None) + minor = self._json_data.get('pe', {}).get('minor', None) + major = self._json_data.get('pe', {}).get('major', None) + if revision is None or minor is None or major is None: + return None + if build is None: + return (major, minor, revision) + return (major, minor, revision, build) + + @property + def pe_version_string(self) -> typing.Optional[str]: + if self.pe_version is None: + return None + return ".".join(self.pe_version) + + @property + def pdb_guid(self) -> typing.Optional[str]: + return self._json_data.get('pdb', {}).get('GUID', None) + + @property + def pdb_age(self) -> typing.Optional[int]: + return self._json_data.get('pdb', {}).get('age', None) + + +class LinuxMetadata(interfaces.symbols.MetadataInterface): + """Class to handle the etadata from a Linux symbol table""" diff --git a/volatility/schemas/schema-6.0.0.json b/volatility/schemas/schema-6.0.0.json index 63afc84d8..6902ff447 100644 --- a/volatility/schemas/schema-6.0.0.json +++ b/volatility/schemas/schema-6.0.0.json @@ -28,10 +28,10 @@ "minor": { "type": "integer" }, - "build": { + "revision": { "type": "integer" }, - "release": { + "build": { "type": "integer" } }, @@ -39,7 +39,7 @@ "required": [ "major", "minor", - "build" + "revision" ] }, "metadata_windows_pdb": {