diff --git a/volatility/framework/interfaces/objects.py b/volatility/framework/interfaces/objects.py index 19d951d5d..5ce15fda1 100644 --- a/volatility/framework/interfaces/objects.py +++ b/volatility/framework/interfaces/objects.py @@ -52,12 +52,11 @@ class ObjectInformation(ReadOnlyInformation): class ObjectInterface(validity.ValidityRoutines, metaclass = ABCMeta): """ A base object required to be the ancestor of every object used in volatility """ - def __init__(self, context, object_info, template_info): + def __init__(self, context, structure_name, object_info, **kwargs): # Since objects are likely to be instantiated often, # we're only checking that context, offset and parent # Everything else may be wrong, but that will get caught later on self._type_check(context, context_module.ContextInterface) - self._type_check(template_info, ReadOnlyInformation) self._type_check(object_info, ObjectInformation) # Add an empty dictionary at the start to allow objects to add their own data to the volinfo object @@ -66,7 +65,7 @@ class ObjectInterface(validity.ValidityRoutines, metaclass = ABCMeta): # This allows objects to MASSIVELY MESS with their own internal representation!!! # Changes to offset, structure_name, etc should NEVER be done # - self._volinfo = collections.ChainMap({}, object_info, template_info) + self._volinfo = collections.ChainMap({}, object_info, {'structure_name': structure_name}, kwargs) self._context = context @property diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index dc1d47bfb..6b527a86e 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -39,32 +39,38 @@ class Void(interfaces.objects.ObjectInterface): class PrimitiveObject(interfaces.objects.ObjectInterface): """PrimitiveObject is an interface for any objects that should simulate a Python primitive""" - _struct_format = '> start_bit) & ((1 << end_bit) - 1)) - def __init__(self, context, object_info, template_info, target = None, start_bit = 0, end_bit = 0): - PrimitiveObject.__init__(self, context, object_info, template_info) + def __init__(self, context, structure_name, object_info, struct_format, target = None, start_bit = 0, end_bit = 0): + PrimitiveObject.__init__(self, context, structure_name, object_info, struct_format) self._volinfo['target'] = target self._volinfo['start_bit'] = start_bit self._volinfo['end_bit'] = end_bit @@ -208,12 +222,12 @@ class Enumeration(interfaces.objects.ObjectInterface): class Array(interfaces.objects.ObjectInterface, collections.Sequence): """Object which can contain a fixed number of an object type""" - def __init__(self, context, object_info, template_info, count = 0, target = None): + def __init__(self, context, structure_name, object_info, count = 0, target = None): self._type_check(target, templates.ObjectTemplate) interfaces.objects.ObjectInterface.__init__(self, context = context, - object_info = object_info, - template_info = template_info) + structure_name = structure_name, + object_info = object_info) self._volinfo['count'] = self._type_check(count, int) self._volinfo['target'] = target @@ -266,12 +280,14 @@ class Struct(interfaces.objects.ObjectInterface): Keep the number of methods in this class low or very specific, since each one could overload a valid member. """ - def __init__(self, context, object_info, template_info): + def __init__(self, context, structure_name, object_info, size, members): interfaces.objects.ObjectInterface.__init__(self, context = context, + structure_name = structure_name, object_info = object_info, - template_info = template_info) - self._check_members(template_info.members) + size = size, + members = members) + self._check_members(members) self._concrete_members = {} @classmethod diff --git a/volatility/framework/objects/templates.py b/volatility/framework/objects/templates.py index 19c172e86..58b21d86b 100644 --- a/volatility/framework/objects/templates.py +++ b/volatility/framework/objects/templates.py @@ -66,9 +66,10 @@ class ObjectTemplate(interfaces.objects.Template, validity.ValidityRoutines): """ # We always use the template size (as calculated by the object class) # over the one passed in by an argument + kwargs.update(self.volinfo) + del kwargs['object_class'] return self.volinfo.object_class(context = context, object_info = object_info, - template_info = self.volinfo, **kwargs) diff --git a/volatility/framework/symbols/windows/__init__.py b/volatility/framework/symbols/windows/__init__.py index 6e6ddf1da..8e5e63149 100644 --- a/volatility/framework/symbols/windows/__init__.py +++ b/volatility/framework/symbols/windows/__init__.py @@ -14,7 +14,7 @@ class _LIST_ENTRY(objects.Struct): """Returns an iterator of the entries in the list""" if layer is None: - layer = self._layer_name + layer = self.volinfo.layer_name relative_offset = self._context.symbolspace.relative_child_offset(structure, member)