mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-26 16:12:23 +02:00
Change object_type parameter for object_from_symbol.
This commit is contained in:
@@ -204,17 +204,17 @@ class Module(interfaces.context.ModuleInterface):
|
||||
**kwargs)
|
||||
|
||||
def object_from_symbol(self,
|
||||
object_type: str,
|
||||
symbol_name: str,
|
||||
native_layer_name: Optional[str] = None,
|
||||
absolute: bool = False,
|
||||
**kwargs) -> 'interfaces.objects.ObjectInterface':
|
||||
if constants.BANG not in object_type:
|
||||
object_type = self.symbol_table_name + constants.BANG + object_type
|
||||
if constants.BANG not in symbol_name:
|
||||
symbol_name = self.symbol_table_name + constants.BANG + symbol_name
|
||||
else:
|
||||
raise ValueError("Cannot reference another module when constructing an object")
|
||||
|
||||
# Only set the offset if type is Symbol and we were given a name, not a template
|
||||
symbol_val = self._context.symbol_space.get_symbol(object_type)
|
||||
symbol_val = self._context.symbol_space.get_symbol(symbol_name)
|
||||
offset = symbol_val.address
|
||||
|
||||
if not absolute:
|
||||
|
||||
@@ -156,7 +156,7 @@ class ModuleInterface(metaclass = ABCMeta):
|
||||
|
||||
@abstractmethod
|
||||
def object_from_symbol(self,
|
||||
object_type: str,
|
||||
symbol_name: str,
|
||||
native_layer_name: Optional[str] = None,
|
||||
absolute: bool = False,
|
||||
**kwargs) -> 'interfaces.objects.ObjectInterface':
|
||||
|
||||
@@ -50,7 +50,7 @@ class Lsmod(plugins.PluginInterface):
|
||||
|
||||
vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0)
|
||||
|
||||
modules = vmlinux.object_from_symbol(object_type = "modules").cast("list_head")
|
||||
modules = vmlinux.object_from_symbol(symbol_name = "modules").cast("list_head")
|
||||
|
||||
table_name = modules.vol.type_name.split(constants.BANG)[0]
|
||||
|
||||
|
||||
@@ -77,7 +77,7 @@ class PsList(interfaces_plugins.PluginInterface):
|
||||
|
||||
vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0)
|
||||
|
||||
init_task = vmlinux.object_from_symbol(object_type = "init_task")
|
||||
init_task = vmlinux.object_from_symbol(symbol_name = "init_task")
|
||||
|
||||
for task in init_task.tasks:
|
||||
if not filter_func(task):
|
||||
|
||||
@@ -27,8 +27,8 @@ class Check_syscall(plugins.PluginInterface):
|
||||
|
||||
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
|
||||
|
||||
nsysent = kernel.object_from_symbol(object_type = "nsysent")
|
||||
table = kernel.object_from_symbol(object_type = "sysent")
|
||||
nsysent = kernel.object_from_symbol(symbol_name = "nsysent")
|
||||
table = kernel.object_from_symbol(symbol_name = "sysent")
|
||||
|
||||
# smear help
|
||||
num_ents = min(nsysent, table.count)
|
||||
|
||||
@@ -110,7 +110,7 @@ class Check_sysctl(plugins.PluginInterface):
|
||||
|
||||
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
|
||||
|
||||
sysctl_list = kernel.object_from_symbol(object_type = "sysctl__children")
|
||||
sysctl_list = kernel.object_from_symbol(symbol_name = "sysctl__children")
|
||||
|
||||
for sysctl, name, val in self._process_sysctl_list(kernel, sysctl_list):
|
||||
check_addr = sysctl.oid_handler
|
||||
|
||||
@@ -27,7 +27,7 @@ class Check_trap_table(plugins.PluginInterface):
|
||||
|
||||
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
|
||||
|
||||
table = kernel.object_from_symbol(object_type = "mach_trap_table")
|
||||
table = kernel.object_from_symbol(symbol_name = "mach_trap_table")
|
||||
|
||||
for i, ent in enumerate(table):
|
||||
try:
|
||||
|
||||
@@ -47,7 +47,7 @@ class Lsmod(plugins.PluginInterface):
|
||||
|
||||
kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
|
||||
|
||||
kmod_ptr = kernel.object_from_symbol(object_type = "kmod")
|
||||
kmod_ptr = kernel.object_from_symbol(symbol_name = "kmod")
|
||||
|
||||
# TODO - use smear-proof list walking API after dev release
|
||||
kmod = kmod_ptr.dereference().cast("kmod_info")
|
||||
|
||||
@@ -80,7 +80,7 @@ class PsList(interfaces_plugins.PluginInterface):
|
||||
|
||||
kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
|
||||
|
||||
proc = kernel.object_from_symbol(object_type = "allproc").lh_first
|
||||
proc = kernel.object_from_symbol(symbol_name = "allproc").lh_first
|
||||
|
||||
seen = {}
|
||||
while proc is not None and proc.vol.offset != 0:
|
||||
|
||||
@@ -49,7 +49,7 @@ class Check_syscall(plugins.PluginInterface):
|
||||
|
||||
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
|
||||
|
||||
policy_list = kernel.object_from_symbol(object_type = "_mac_policy_list").cast("mac_policy_list")
|
||||
policy_list = kernel.object_from_symbol(symbol_name = "_mac_policy_list").cast("mac_policy_list")
|
||||
|
||||
entries = kernel.object(
|
||||
object_type = "array",
|
||||
|
||||
Reference in New Issue
Block a user