From 5d75d617b3d227b6fceaa8f1e3b174ebf73168ee Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 31 Aug 2019 22:01:01 +0100 Subject: [PATCH] Add in better support for sorting BaseAbsentValues. --- volatility/framework/interfaces/renderers.py | 2 +- volatility/framework/renderers/__init__.py | 9 ++++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/volatility/framework/interfaces/renderers.py b/volatility/framework/interfaces/renderers.py index 4c1c32eb7..b3ae84c17 100644 --- a/volatility/framework/interfaces/renderers.py +++ b/volatility/framework/interfaces/renderers.py @@ -98,9 +98,9 @@ class Disassembly(object): # contain the types that the validator will accept (which would not include the base) _Type = TypeVar("_Type", bound = Type) -ColumnsType = List[Tuple[str, Type]] BaseTypes = Union[Type[int], Type[str], Type[float], Type[bytes], Type[datetime.datetime], Type[BaseAbsentValue], Type[Disassembly]] +ColumnsType = List[Tuple[str, BaseTypes]] VisitorSignature = Callable[[TreeNode, _Type], _Type] diff --git a/volatility/framework/renderers/__init__.py b/volatility/framework/renderers/__init__.py index d6b955fc5..f4c6acb81 100644 --- a/volatility/framework/renderers/__init__.py +++ b/volatility/framework/renderers/__init__.py @@ -9,6 +9,7 @@ import datetime from typing import Any, Callable, Iterable, List, Optional, Tuple, TypeVar, Union from volatility.framework import interfaces +from volatility.framework.interfaces import renderers class UnreadableValue(interfaces.renderers.BaseAbsentValue): @@ -331,6 +332,12 @@ class ColumnSortKey(interfaces.renderers.ColumnSortKey): if isinstance(value, interfaces.renderers.BaseAbsentValue): if self._type == datetime.datetime: value = datetime.datetime.min - elif self._type == int: + elif self._type in [int, float]: value = -1 + elif self._type == bool: + value = False + elif self._type in [str, renderers.Disassembly]: + value = "-" + elif self._type == bytes: + value = b"" return value