From 33b2c9522de3d2860d51e65ecbabd155d4aa483e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 23 May 2018 22:26:52 +0100 Subject: [PATCH] Add in support for ISF.create to handle table_mappings. --- volatility/framework/symbols/intermed.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 78a726e99..5b8602944 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -164,7 +164,8 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): context: interfaces.context.ContextInterface, config_path: str, sub_path: str, - filename: str) -> str: + filename: str, + table_mapping: typing.Optional[typing.Dict[str, str]] = None) -> str: """Takes a context and loads an intermediate symbol table based on a filename. Returns the name of the added symbol table""" @@ -172,7 +173,11 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): if not urls: raise ValueError("No symbol files found at provided filename: {}", filename) table_name = context.symbol_space.free_table_name(filename) - table = cls(context = context, config_path = config_path, name = table_name, isf_url = urls[0]) + table = cls(context = context, + config_path = config_path, + name = table_name, + isf_url = urls[0], + table_mapping = table_mapping) context.symbol_space.append(table) return table_name