From 42579ca6192621f56688ac0bce2dbcd5da4b7500 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 5 Oct 2017 00:30:16 +0100 Subject: [PATCH] Allow subtypes for array_of_pointers to be strings. --- volatility/framework/objects/utility.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/volatility/framework/objects/utility.py b/volatility/framework/objects/utility.py index 0efab1f51..0e2317b22 100644 --- a/volatility/framework/objects/utility.py +++ b/volatility/framework/objects/utility.py @@ -1,4 +1,5 @@ from volatility.framework import objects +from volatility.framework.objects import templates def array_to_string(array, count = None, errors = 'replace'): @@ -21,7 +22,11 @@ def pointer_to_string(pointer, count, errors = 'replace'): return char.cast("string", max_length = count, errors = errors) -def array_of_pointers(array, count, subtype = None): +def array_of_pointers(array, count, subtype = None, context = None): """Takes an object, and recasts it as an array of pointers to subtype""" + if isinstance(subtype, str) and context is not None: + subtype = context.symbol_space.get_type(subtype) + if not isinstance(subtype, templates.ObjectTemplate) or subtype is None: + raise TypeError("Subtype must be a valid object template") subtype_pointer = objects.templates.ObjectTemplate(objects.Pointer, type_name = 'pointer', subtype = subtype) return array.cast("array", count = count, subtype = subtype_pointer)