From 2f28dfa6c9a1fa3b8758f5d02dfa5758a29f8838 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Thu, 19 Jul 2018 09:51:51 +0100
Subject: [PATCH] Support finding symbols by ranges.

---
 volatility/framework/contexts/__init__.py  | 16 ++++++++++------
 volatility/framework/interfaces/symbols.py | 12 +++++++++---
 2 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/volatility/framework/contexts/__init__.py b/volatility/framework/contexts/__init__.py
index 9481b29aa..0aa1668c4 100644
--- a/volatility/framework/contexts/__init__.py
+++ b/volatility/framework/contexts/__init__.py
@@ -162,11 +162,13 @@ class Module(interfaces.context.Module):
     has_type = get_module_wrapper('has_type')
     has_enum = get_module_wrapper('has_enum')
 
-    def get_symbols_by_absolute_location(self, offset: int) -> typing.Iterable[str]:
+    def get_symbols_by_absolute_location(self, offset: int, size: typing.Optional[int] = 0) -> typing.Iterable[str]:
         """Returns the symbols within this module that live at the specified absolute offset provided"""
+        if size < 0:
+            raise ValueError("Size must be strictly non-negative")
         if offset > self._offset + self.size:
             return []
-        return self._context.symbol_space.get_symbols_by_location(offset = offset - self._offset,
+        return self._context.symbol_space.get_symbols_by_location(offset = offset - self._offset, size = size,
                                                                   table_name = self.symbol_table_name)
 
 
@@ -205,9 +207,11 @@ class ModuleCollection(validity.ValidityRoutines):
             result[module.name] = modlist
         return result
 
-    def get_module_symbols_by_absolute_location(self, offset: int) -> typing.Iterable[
-        typing.Tuple[str, typing.List[str]]]:
+    def get_module_symbols_by_absolute_location(self, offset: int, size: typing.Optional[int] = 0) -> \
+            typing.Iterable[typing.Tuple[str, typing.List[str]]]:
         """Returns a tuple of (module_name, list_of_symbol_names) for each module, where symbols live at the absolute offset in memory provided"""
+        if size < 0:
+            raise ValueError("Size must be strictly non-negative")
         for module in self._modules:
-            if module.offset <= offset <= module.offset + module.size:
-                yield (module.name, module.get_symbols_by_absolute_location(offset))
+            if (offset <= module.offset + module.size) and (offset + size >= module.offset):
+                yield (module.name, module.get_symbols_by_absolute_location(offset, size))
diff --git a/volatility/framework/interfaces/symbols.py b/volatility/framework/interfaces/symbols.py
index b316aa37f..693f1093c 100644
--- a/volatility/framework/interfaces/symbols.py
+++ b/volatility/framework/interfaces/symbols.py
@@ -167,11 +167,14 @@ class BaseSymbolTableInterface(validity.ValidityRoutines):
                     symbol.type_name == type_name or (symbol.type_name.endswith(constants.BANG + type_name))):
                 yield symbol.name
 
-    def get_symbols_by_location(self, offset: int) -> typing.Iterable[str]:
+    def get_symbols_by_location(self, offset: int, size: typing.Optional[int] = 0) -> typing.Iterable[str]:
         """Returns the name of all symbols in this table that live at a particular offset"""
+        if size < 0:
+            raise ValueError("Size must be strictly non-negative")
         sort_symbols = sorted([(self.get_symbol(sn).address, sn) for sn in self.symbols])
         result = bisect.bisect_left(sort_symbols, (offset, ""))
-        while result < len(sort_symbols) and sort_symbols[result][0] == offset:
+        while result < len(sort_symbols) and \
+                (sort_symbols[result][0] >= offset and sort_symbols[result][0] <= offset + size):
             yield sort_symbols[result][1]
             result += 1
 
@@ -187,7 +190,10 @@ class SymbolSpaceInterface(collections.abc.Mapping):
         """Returns all symbols based on the type of the symbol"""
 
     @abstractmethod
-    def get_symbols_by_location(self, offset: int, table_name: typing.Optional[str] = None) -> typing.Iterable[str]:
+    def get_symbols_by_location(self,
+                                offset: int,
+                                size: typing.Optional[int] = 0,
+                                table_name: typing.Optional[str] = None) -> typing.Iterable[str]:
         """Returns all symbols that exist at a specific relative address"""
 
     @abstractmethod