From 433f47c45852b09269927d1b1bd11bc4e1b5a194 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 25 Dec 2016 18:34:14 +0000 Subject: [PATCH] Allow casting to inherit the symbol table of its parent. --- volatility/framework/interfaces/objects.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility/framework/interfaces/objects.py b/volatility/framework/interfaces/objects.py index 4095ce9ac..f6161d73f 100644 --- a/volatility/framework/interfaces/objects.py +++ b/volatility/framework/interfaces/objects.py @@ -8,7 +8,7 @@ import collections import collections.abc from abc import ABCMeta, abstractmethod -from volatility.framework import validity +from volatility.framework import constants, validity from volatility.framework.interfaces import context as context_module @@ -88,6 +88,9 @@ class ObjectInterface(validity.ValidityRoutines, metaclass = ABCMeta): def cast(self, new_type_name, **additional): """Returns a new object at the offset and from the layer that the current object inhabits""" # TODO: Carefully consider the implications of casting and how it should work + if constants.BANG not in new_type_name: + symbol_table = self.vol['type_name'].split(constants.BANG)[0] + new_type_name = symbol_table + constants.BANG + new_type_name object_template = self._context.symbol_space.get_type(new_type_name) object_template = object_template.clone() object_template.update_vol(**additional)