From 5b2332544756f231941feae0874fb8ab196013d3 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 22 Mar 2014 13:46:22 +0000 Subject: [PATCH] Change symbol_names to structure_names. --- test_rig.py | 12 +++--- volatility/framework/interfaces/objects.py | 16 +++---- volatility/framework/objects/__init__.py | 50 +++++++++++----------- volatility/framework/objects/templates.py | 8 ++-- volatility/framework/symbols/__init__.py | 12 +++--- volatility/framework/symbols/native.py | 26 +++++------ volatility/framework/symbols/vtypes.py | 26 +++++------ 7 files changed, 75 insertions(+), 75 deletions(-) diff --git a/test_rig.py b/test_rig.py index 0ef0b784f..62f869ac5 100644 --- a/test_rig.py +++ b/test_rig.py @@ -10,20 +10,20 @@ from volatility.framework import xp_sp2_x86_vtypes, layers from volatility.framework.symbols import vtypes, native def test_symbols(): - nativelst = native.x86NativeTable + native_list = native.x86NativeTable virtual_types = xp_sp2_x86_vtypes.ntkrnlmp_types - ntkrnlmp = vtypes.VTypeSymbolTable('ntkrnlmp', virtual_types, nativelst) + ntkrnlmp = vtypes.VTypeSymbolTable('ntkrnlmp', virtual_types, native_list) - ctx = framework.Context(nativelst) - # ctx.symbol_space.append(nativelst) + ctx = framework.Context(native_list) + # ctx.symbol_space.append(native_list) ctx = utils_load_as() - print("Symbols,", nativelst.structures) + print("Symbols,", native_list.structures) for i in list(ntkrnlmp.structures): symbol = ctx.symbol_space.get_structure('ntkrnlmp!' + i) - print(symbol.symbol_name, symbol, symbol.size) + print(symbol.structure_name, symbol, symbol.size) _objthing = symbol(ctx, layer_name = '', offset = 0) symbol = ctx.symbol_space.get_structure('ntkrnlmp!_EPROCESS') diff --git a/volatility/framework/interfaces/objects.py b/volatility/framework/interfaces/objects.py index 9145fa907..81ea2f41b 100644 --- a/volatility/framework/interfaces/objects.py +++ b/volatility/framework/interfaces/objects.py @@ -10,7 +10,7 @@ from volatility.framework.interfaces import context as context_module class ObjectInterface(validity.ValidityRoutines): """ A base object required to be the ancestor of every object used in volatility """ - def __init__(self, context, layer_name, offset, symbol_name, size, parent = None): + def __init__(self, context, layer_name, offset, structure_name, size, parent = None): # Since objects are likely to be instantiated often, # we're only checking that a context is a context # Everything else may be wrong, but that will get caught later on @@ -18,15 +18,15 @@ class ObjectInterface(validity.ValidityRoutines): self._parent = None if not parent else self.type_check(parent, ObjectInterface) self._offset = offset self._layer_name = layer_name - self._symbol_name = symbol_name + self._structure_name = structure_name self._size = size def write(self, value): """Writes the new value into the format at the offset the object currently resides at""" - def cast(self, new_symbol_name): + def cast(self, new_structure_name): """Returns a new object at the offset and from the layer that the current object inhabits""" - object_template = self._context.symbol_space.resolve(new_symbol_name) + object_template = self._context.symbol_space.resolve(new_structure_name) return object_template(context = self._context, layer_name = self._layer_name, offset = self._offset) class Template(object): @@ -34,15 +34,15 @@ class Template(object): This is effectively a class for currying object calls """ - def __init__(self, symbol_name = None, **kwargs): + def __init__(self, structure_name = None, **kwargs): """Stores the keyword arguments for later use""" self._kwargs = kwargs - self._symbol_name = symbol_name + self._structure_name = structure_name @property - def symbol_name(self): + def structure_name(self): """Returns the name of the particular symbol""" - return self._symbol_name + return self._structure_name @property def arguments(self): diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index 2e5f2a116..f6708b7bd 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -28,18 +28,18 @@ class Void(interfaces.objects.ObjectInterface): class PrimitiveObject(interfaces.objects.ObjectInterface): """PrimitiveObject is an interface for any objects that should simulate a Python primitive""" - def __init__(self, context, layer_name, offset, symbol_name, size = None, parent = None, struct_format = '> start_bit) & ((1 << end_bit) - 1) @@ -200,14 +200,14 @@ class Enumeration(interfaces.objects.ObjectInterface): class Array(interfaces.objects.ObjectInterface, collections.Sequence): """Object which can contain a fixed number of an object type""" - def __init__(self, context, layer_name, offset, symbol_name, size = None, parent = None, count = 0, target = None): + def __init__(self, context, layer_name, offset, structure_name, size = None, parent = None, count = 0, target = None): if not isinstance(target, templates.ObjectTemplate): raise TypeError("Array target must be an ObjectTemplate") interfaces.objects.ObjectInterface.__init__(self, context = context, layer_name = layer_name, offset = offset, - symbol_name = symbol_name, + structure_name = structure_name, size = size, parent = parent) self._count = count @@ -248,12 +248,12 @@ class Array(interfaces.objects.ObjectInterface, collections.Sequence): class Struct(interfaces.objects.ObjectInterface): """Object which can contain members that are other objects""" - def __init__(self, context, layer_name, offset, symbol_name, size = None, members = None, parent = None): + def __init__(self, context, layer_name, offset, structure_name, size = None, members = None, parent = None): interfaces.objects.ObjectInterface.__init__(self, context = context, layer_name = layer_name, offset = offset, - symbol_name = symbol_name, + structure_name = structure_name, size = size, parent = parent) self.check_members(members) @@ -284,7 +284,7 @@ class Struct(interfaces.objects.ObjectInterface): @classmethod def check_members(cls, members): # Members should be an iterable mapping of symbol names to tuples of (relative_offset, ObjectTemplate) - # An object template is a callable that when called with a context, offset, layer_name and symbol_name + # An object template is a callable that when called with a context, offset, layer_name and structure_name if not isinstance(members, collections.Iterable): raise TypeError("Struct members parameter must be iterable not " + type(members)) if not all([(isinstance(member, tuple) and len(member) == 2) for member in members.values()]): @@ -299,7 +299,7 @@ class Struct(interfaces.objects.ObjectInterface): member = member(context = self._context, layer_name = self._layer_name, offset = self._offset + relative_offset, parent = self) self._concrete_members[attr] = member return member - raise AttributeError("'" + self._symbol_name + "' Struct has no attribute '" + attr + "'") + raise AttributeError("'" + self._structure_name + "' Struct has no attribute '" + attr + "'") def write(self, value): raise TypeError("Structs cannot be written to directly, invidivual members must be written instead") diff --git a/volatility/framework/objects/templates.py b/volatility/framework/objects/templates.py index 61422f826..6dc1ee973 100644 --- a/volatility/framework/objects/templates.py +++ b/volatility/framework/objects/templates.py @@ -15,8 +15,8 @@ class ObjectTemplate(interfaces.objects.Template, validity.ValidityRoutines): * Members, etc etc. """ - def __init__(self, object_class = None, symbol_name = None, **kwargs): - interfaces.objects.Template.__init__(self, symbol_name = symbol_name, **kwargs) + def __init__(self, object_class = None, structure_name = None, **kwargs): + interfaces.objects.Template.__init__(self, structure_name = structure_name, **kwargs) self.object_class = self.class_check(object_class, interfaces.objects.ObjectInterface) @property @@ -47,7 +47,7 @@ class ObjectTemplate(interfaces.objects.Template, validity.ValidityRoutines): # We always use the template size (as calculated by the object class) # over the one passed in by an argument self._kwargs['size'] = self.size - self._kwargs['symbol_name'] = self.symbol_name + self._kwargs['structure_name'] = self.structure_name return self.object_class(context = context, layer_name = layer_name, offset = offset, parent = parent, **self._kwargs) class ReferenceTemplate(interfaces.objects.Template): @@ -56,5 +56,5 @@ class ReferenceTemplate(interfaces.objects.Template): It should not return any attributes """ def __call__(self, context, *args, **kwargs): - template = context.symbol_space.get_structure(self._symbol_name) + template = context.symbol_space.get_structure(self._structure_name) return template(context = context, *args, **kwargs) diff --git a/volatility/framework/symbols/__init__.py b/volatility/framework/symbols/__init__.py index 98aa426c4..7bbd06d9b 100644 --- a/volatility/framework/symbols/__init__.py +++ b/volatility/framework/symbols/__init__.py @@ -55,8 +55,8 @@ class SymbolSpace(collections.Mapping): symarr = symbol.split("!") if len(symarr) == 2: table_name = symarr[0] - symbol_name = symarr[1] - return self._dict[table_name].get_structure(symbol_name) + structure_name = symarr[1] + return self._dict[table_name].get_structure(structure_name) elif symbol in self.natives.structures: return self.natives.get_structure(symbol) raise exceptions.SymbolError("Malformed symbol name") @@ -82,13 +82,13 @@ class SymbolSpace(collections.Mapping): if isinstance(child, objects.templates.ReferenceTemplate): # If we haven't seen it before, subresolve it and also add it # to the "symbols that still need traversing" list - if child.symbol_name not in self._resolved: - traverse_list.append(child.symbol_name) - self._resolved[child.symbol_name] = self._weak_resolve(child.symbol_name) + if child.structure_name not in self._resolved: + traverse_list.append(child.structure_name) + self._resolved[child.structure_name] = self._weak_resolve(child.structure_name) # Stash the replacement replacements.add((traverser, child)) elif child.children: template_traverse_list.append(child) for (parent, child) in replacements: - parent.replace_child(child, self._resolved[child.symbol_name]) + parent.replace_child(child, self._resolved[child.structure_name]) return self._resolved[symbol] diff --git a/volatility/framework/symbols/native.py b/volatility/framework/symbols/native.py index 1db5e692d..50f7b0ced 100644 --- a/volatility/framework/symbols/native.py +++ b/volatility/framework/symbols/native.py @@ -28,26 +28,26 @@ class NativeTable(interfaces.symbols.NativeTableInterface): """Returns an iterator of the structure symbol names""" return self._structures - def get_structure(self, symbol_name): + def get_structure(self, structure_name): """Resolves a symbol name into an object template symbol_space is used to resolve any target symbols if they don't exist in this list """ additional = {} - if symbol_name == 'void': - return objects.templates.ObjectTemplate(objects.Void, symbol_name = symbol_name) - elif symbol_name == 'array': - return objects.templates.ObjectTemplate(objects.Array, symbol_name = symbol_name, count = 0, target = self.get_structure('void')) - elif symbol_name == 'Enumeration': - return objects.templates.ObjectTemplate(objects.Enumeration, symbol_name = symbol_name, target = self.get_structure('void'), choices = {}) - elif symbol_name == 'BitField': - return objects.templates.ObjectTemplate(objects.BitField, symbol_name = symbol_name, start_bit = 0, end_bit = 0) + if structure_name == 'void': + return objects.templates.ObjectTemplate(objects.Void, structure_name = structure_name) + elif structure_name == 'array': + return objects.templates.ObjectTemplate(objects.Array, structure_name = structure_name, count = 0, target = self.get_structure('void')) + elif structure_name == 'Enumeration': + return objects.templates.ObjectTemplate(objects.Enumeration, structure_name = structure_name, target = self.get_structure('void'), choices = {}) + elif structure_name == 'BitField': + return objects.templates.ObjectTemplate(objects.BitField, structure_name = structure_name, start_bit = 0, end_bit = 0) - _native_type, native_format = self._native_dictionary[symbol_name] - if symbol_name == 'pointer': + _native_type, native_format = self._native_dictionary[structure_name] + if structure_name == 'pointer': additional = {'target': self.get_structure('void')} - return objects.templates.ObjectTemplate(self.get_structure_class(symbol_name), #pylint: disable-msg=W0142 - symbol_name = symbol_name, + return objects.templates.ObjectTemplate(self.get_structure_class(structure_name), #pylint: disable-msg=W0142 + structure_name = structure_name, struct_format = native_format, **additional) diff --git a/volatility/framework/symbols/vtypes.py b/volatility/framework/symbols/vtypes.py index 836bab94e..3f620c511 100644 --- a/volatility/framework/symbols/vtypes.py +++ b/volatility/framework/symbols/vtypes.py @@ -58,23 +58,23 @@ class VTypeSymbolTable(interfaces.symbols.SymbolTableInterface): if not dictionary: raise exceptions.SymbolSpaceError("Invalid vtype dictionary: " + repr(dictionary)) - symbol_name = dictionary[0] + structure_name = dictionary[0] - if symbol_name in self.natives.structures: + if structure_name in self.natives.structures: # The symbol is a native type - native_template = self.natives.get_structure(symbol_name) + native_template = self.natives.get_structure(structure_name) # Add specific additional parameters, etc update = {} - if symbol_name == 'array': + if structure_name == 'array': update['count'] = dictionary[1], update['target'] = self._vtypedict_to_template(dictionary[2]) - elif symbol_name == 'pointer': + elif structure_name == 'pointer': update["target"] = self._vtypedict_to_template(dictionary[1]) - elif symbol_name == 'Enumeration': + elif structure_name == 'Enumeration': update = copy.deepcopy(dictionary[1]) update["target"] = self._vtypedict_to_template([update['target']]) - elif symbol_name == 'BitField': + elif structure_name == 'BitField': update = dictionary[1] update['target'] = self._vtypedict_to_template([update['native_type']]) native_template.update_arguments(**update) #pylint: disable-msg=W0142 @@ -84,22 +84,22 @@ class VTypeSymbolTable(interfaces.symbols.SymbolTableInterface): if len(dictionary) > 1: raise exceptions.SymbolSpaceError("Unknown vtype format: " + repr(dictionary)) - return objects.templates.ReferenceTemplate(symbol_name = self.name + "!" + symbol_name) + return objects.templates.ReferenceTemplate(structure_name = self.name + "!" + structure_name) @property def structures(self): """Returns an iterator of the symbol names""" return self._vtypedict.keys() - def get_structure(self, symbol_name): + def get_structure(self, structure_name): """Resolves an individual symbol""" - if symbol_name not in self._vtypedict: + if structure_name not in self._vtypedict: raise exceptions.SymbolError - size, curdict = self._vtypedict[symbol_name] + size, curdict = self._vtypedict[structure_name] members = {} for member_name in curdict: relative_offset, vtypedict = curdict[member_name] member = (relative_offset, self._vtypedict_to_template(vtypedict)) members[member_name] = member - object_class = self.get_structure_class(symbol_name) - return objects.templates.ObjectTemplate(object_class = object_class, symbol_name = symbol_name, size = size, members = members) + object_class = self.get_structure_class(structure_name) + return objects.templates.ObjectTemplate(object_class = object_class, structure_name = structure_name, size = size, members = members)