mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-17 20:35:40 +02:00
Code Review: Parameter renaming
Makes it explicit that these are symbol table names, not actual symbol tables.
This commit is contained in:
@@ -366,8 +366,8 @@ class PoolScanner(plugins.PluginInterface):
|
||||
cls,
|
||||
context: interfaces.context.ContextInterface,
|
||||
kernel_layer_name: str,
|
||||
kernel_symbol_table: str,
|
||||
object_symbol_table: str,
|
||||
kernel_symbol_table_name: str,
|
||||
object_symbol_table_name: str,
|
||||
constraints: List[PoolConstraint],
|
||||
) -> Generator[
|
||||
Tuple[
|
||||
@@ -396,18 +396,18 @@ class PoolScanner(plugins.PluginInterface):
|
||||
type_map = handles.Handles.get_type_map(
|
||||
context=context,
|
||||
layer_name=kernel_layer_name,
|
||||
symbol_table=kernel_symbol_table,
|
||||
symbol_table=kernel_symbol_table_name,
|
||||
)
|
||||
|
||||
cookie = handles.Handles.find_cookie(
|
||||
context=context,
|
||||
layer_name=kernel_layer_name,
|
||||
symbol_table=kernel_symbol_table,
|
||||
symbol_table=kernel_symbol_table_name,
|
||||
)
|
||||
|
||||
is_windows_10 = versions.is_windows_10(context, kernel_symbol_table)
|
||||
is_windows_10 = versions.is_windows_10(context, kernel_symbol_table_name)
|
||||
is_windows_8_or_later = versions.is_windows_8_or_later(
|
||||
context, kernel_symbol_table
|
||||
context, kernel_symbol_table_name
|
||||
)
|
||||
|
||||
# start off with the primary virtual layer
|
||||
@@ -417,14 +417,18 @@ class PoolScanner(plugins.PluginInterface):
|
||||
if not is_windows_10:
|
||||
scan_layer = context.layers[scan_layer].config["memory_layer"]
|
||||
|
||||
if symbols.symbol_table_is_64bit(context, kernel_symbol_table):
|
||||
if symbols.symbol_table_is_64bit(context, kernel_symbol_table_name):
|
||||
alignment = 0x10
|
||||
else:
|
||||
alignment = 8
|
||||
|
||||
# scan in the main kernel layer for the object(s)
|
||||
for constraint, header in cls.pool_scan(
|
||||
context, scan_layer, object_symbol_table, constraints, alignment=alignment
|
||||
context,
|
||||
scan_layer,
|
||||
object_symbol_table_name,
|
||||
constraints,
|
||||
alignment=alignment,
|
||||
):
|
||||
|
||||
# construct the object in its own layer, using its own types
|
||||
@@ -432,7 +436,7 @@ class PoolScanner(plugins.PluginInterface):
|
||||
constraint=constraint,
|
||||
use_top_down=is_windows_8_or_later,
|
||||
native_layer_name=kernel_layer_name,
|
||||
kernel_symbol_table=kernel_symbol_table,
|
||||
kernel_symbol_table=kernel_symbol_table_name,
|
||||
)
|
||||
|
||||
for mem_object in mem_objects:
|
||||
|
||||
Reference in New Issue
Block a user