From 287baeb03a0565ef2ca288f48110244a7018907b Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 26 Oct 2016 01:49:52 +0100 Subject: [PATCH] Add in rudimentary symbol support to the intermediate format. --- volatility/framework/symbols/intermed.py | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 2eeee4414..c2eb41c37 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -20,6 +20,9 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): self._json = json.load(fp) self._validate_json() self._overrides = {} + self._symbol_cache = None + + # TODO: Check the format and make use of the other metadata def _validate_json(self): if (not 'user_types' in self._json or @@ -29,6 +32,22 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): not 'enums' in self._json): raise exceptions.SymbolSpaceError("Malformed JSON file provided") + def get_symbol(self, name): + """Returns the location offset given by the symbol name""" + symbol = self._json['symbols'].get(name, None) + if not symbol: + raise KeyError("Unknown symbol: {0}".format(name)) + return interfaces.symbols.Symbol(name = name, address = symbol['address']) + + @property + def symbols(self): + if not self._symbol_cache: + self._symbol_cache = [interfaces.symbols.Symbol(name = x, address = self._json['symbols'][x]['address']) for + x in self._json['symbols']] + return self._symbol_cache + + # TODO: Add the ability to add/remove/change symbols after creation, note that this should invalidate the cache + def get_type_class(self, name): return self._overrides.get(name, objects.Struct)