diff --git a/volatility/framework/interfaces/objects.py b/volatility/framework/interfaces/objects.py index 6df4e2ae7..5d79fab70 100644 --- a/volatility/framework/interfaces/objects.py +++ b/volatility/framework/interfaces/objects.py @@ -73,6 +73,7 @@ class ObjectInformation(ReadOnlyMapping): member_name: If the object was accessed as a member of a parent object, this was the name used to access it parent: If the object was accessed as a member of a parent object, this is the parent object native_layer_name: If this object references other objects (such as a pointer), what layer those objects live in + size: The size that the whole structure consumes in bytes """ super().__init__({ 'layer_name': layer_name, diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index b13bc3039..169120072 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -678,14 +678,13 @@ class AggregateType(interfaces.objects.ObjectInterface): relative_offset, template = self.vol.members[attr] if isinstance(template, templates.ReferenceTemplate): template = self._context.symbol_space.get_type(template.vol.type_name) - member = template(context = self._context, - object_info = interfaces.objects.ObjectInformation( - layer_name = self.vol.layer_name, - offset = mask & (self.vol.offset + relative_offset), - member_name = attr, - parent = self, - native_layer_name = self.vol.native_layer_name, - size = template.size)) + object_info = interfaces.objects.ObjectInformation(layer_name = self.vol.layer_name, + offset = mask & (self.vol.offset + relative_offset), + member_name = attr, + parent = self, + native_layer_name = self.vol.native_layer_name, + size = template.size) + member = template(context = self._context, object_info = object_info) self._concrete_members[attr] = member return member # We duplicate this code to avoid polluting the methodspace