From 49e778724b95487be6372294045ef52b07a7dcb4 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 10 Aug 2020 22:36:20 +0100 Subject: [PATCH] Documentation: Add in section about TreeGrid column types --- doc/source/using-as-a-library.rst | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/doc/source/using-as-a-library.rst b/doc/source/using-as-a-library.rst index 78f8c0ce9..d89a39852 100644 --- a/doc/source/using-as-a-library.rst +++ b/doc/source/using-as-a-library.rst @@ -205,6 +205,15 @@ once it is fully populated. In either case, a visitor method will be required. should accept a :py:class:`~volatility.framework.interfaces.renderers.TreeNode` and an `accumulator`. It will return an updated accumulator. +When provided a :py:class:`~volatility.framework.interfaces.renderers.TreeNode`, it can be accessed as a dictionary +based on the column names that the treegrid contains. It should be noted that each column can contain only the +type specified in the `column.type` field (which can be a simple type like string, integer, float, bytes or +a more complex type, like a DateTime, a Disassembly or a descendent of +:py:class:`~volatility.framework.interfaces.renderers.BaseAbsentValue`). The various fields may also be wrapped in +`format_hints` designed to tell the user interface how to render the data. These hints can be things like Bin, Hex or +HexBytes, so that fields like offsets are displayed in hex form or so that bytes are displayed in their hex form rather +than their raw form. + A simple text renderer (that returns output immediately) would appear as follows. This doesn't use the accumulator, but instead uses print to directly produce the output. This is not recommended: