From 4ac682fc42333b422f032a3bb8c3a6d77b4a9546 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sun, 18 Dec 2016 02:07:11 +0000
Subject: [PATCH] Rename Enumeration subtype to base_type, since it should
 always be a primitive.

---
 volatility/framework/objects/__init__.py | 18 ++++++++++++------
 volatility/framework/symbols/intermed.py |  2 +-
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py
index db88bb32b..1a5e3b3d8 100644
--- a/volatility/framework/objects/__init__.py
+++ b/volatility/framework/objects/__init__.py
@@ -240,13 +240,14 @@ class BitField(PrimitiveObject, int):
 class Enumeration(interfaces.objects.ObjectInterface, int):
     """Returns an object made up of choices"""
 
-    def __new__(cls, context, type_name, object_info, subtype = None, choices = None):
-        cls._check_type(subtype, templates.ObjectTemplate)
-        value = subtype(context = context,
-                        object_info = object_info)
+    def __new__(cls, context, type_name, object_info, base_type = None, choices = None):
+        # FIXME: Ideally this check will ensure only primitives can be used
+        cls._check_type(base_type, templates.ObjectTemplate)
+        value = base_type(context = context,
+                          object_info = object_info)
         return int.__new__(cls, value)
 
-    def __init__(self, context, type_name, object_info, subtype = None, choices = None):
+    def __init__(self, context, type_name, object_info, base_type = None, choices = None):
         super().__init__(context, type_name, object_info)
 
         for k, v in self._check_type(choices, dict).items():
@@ -254,7 +255,7 @@ class Enumeration(interfaces.objects.ObjectInterface, int):
             self._check_type(v, int)
         self._vol['choices'] = choices
 
-        self._vol['subtype'] = subtype
+        self._vol['base_type'] = base_type
 
     def lookup(self, value):
         """Looks up an individual value and returns the associated name"""
@@ -281,6 +282,11 @@ class Enumeration(interfaces.objects.ObjectInterface, int):
     def write(self, value):
         raise NotImplementedError("Writing to Enumerations is not yet implemented")
 
+    class VolTemplateProxy(interfaces.objects.ObjectInterface.VolTemplateProxy):
+        @classmethod
+        def size(cls, template):
+            return template._vol['base_type'].size
+
 
 class Array(interfaces.objects.ObjectInterface, collections.Sequence):
     """Object which can contain a fixed number of an object type"""
diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py
index db3fd9f70..4ea5dfec7 100644
--- a/volatility/framework/symbols/intermed.py
+++ b/volatility/framework/symbols/intermed.py
@@ -222,7 +222,7 @@ class Version1Format(ISFormatTable):
         if not lookup:
             raise exceptions.SymbolSpaceError("Unknown enumeration found: {}".format(name))
         result = {"choices": copy.deepcopy(lookup['constants']),
-                  "subtype": self.natives.get_type(lookup['base'])}
+                  "base_type": self.natives.get_type(lookup['base'])}
         return result
 
     def get_type(self, type_name):