From 5db6ade2ea98547f1b193879de230e550941c91d Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 14 Aug 2019 10:01:53 +0100 Subject: [PATCH] Change object_type parameter for object_from_symbol. --- volatility/framework/contexts/__init__.py | 8 ++++---- volatility/framework/interfaces/context.py | 2 +- volatility/framework/plugins/linux/lsmod.py | 2 +- volatility/framework/plugins/linux/pslist.py | 2 +- volatility/framework/plugins/mac/check_syscall.py | 4 ++-- volatility/framework/plugins/mac/check_sysctl.py | 2 +- volatility/framework/plugins/mac/check_trap_table.py | 2 +- volatility/framework/plugins/mac/lsmod.py | 2 +- volatility/framework/plugins/mac/pslist.py | 2 +- volatility/framework/plugins/mac/trustedbsd.py | 2 +- 10 files changed, 14 insertions(+), 14 deletions(-) diff --git a/volatility/framework/contexts/__init__.py b/volatility/framework/contexts/__init__.py index ecd9977ac..102cf4f9a 100644 --- a/volatility/framework/contexts/__init__.py +++ b/volatility/framework/contexts/__init__.py @@ -204,17 +204,17 @@ class Module(interfaces.context.ModuleInterface): **kwargs) def object_from_symbol(self, - object_type: str, + symbol_name: str, native_layer_name: Optional[str] = None, absolute: bool = False, **kwargs) -> 'interfaces.objects.ObjectInterface': - if constants.BANG not in object_type: - object_type = self.symbol_table_name + constants.BANG + object_type + if constants.BANG not in symbol_name: + symbol_name = self.symbol_table_name + constants.BANG + symbol_name else: raise ValueError("Cannot reference another module when constructing an object") # Only set the offset if type is Symbol and we were given a name, not a template - symbol_val = self._context.symbol_space.get_symbol(object_type) + symbol_val = self._context.symbol_space.get_symbol(symbol_name) offset = symbol_val.address if not absolute: diff --git a/volatility/framework/interfaces/context.py b/volatility/framework/interfaces/context.py index 2cf93ed39..eedac07a6 100644 --- a/volatility/framework/interfaces/context.py +++ b/volatility/framework/interfaces/context.py @@ -156,7 +156,7 @@ class ModuleInterface(metaclass = ABCMeta): @abstractmethod def object_from_symbol(self, - object_type: str, + symbol_name: str, native_layer_name: Optional[str] = None, absolute: bool = False, **kwargs) -> 'interfaces.objects.ObjectInterface': diff --git a/volatility/framework/plugins/linux/lsmod.py b/volatility/framework/plugins/linux/lsmod.py index 96501c106..730e344fc 100644 --- a/volatility/framework/plugins/linux/lsmod.py +++ b/volatility/framework/plugins/linux/lsmod.py @@ -50,7 +50,7 @@ class Lsmod(plugins.PluginInterface): vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0) - modules = vmlinux.object_from_symbol(object_type = "modules").cast("list_head") + modules = vmlinux.object_from_symbol(symbol_name = "modules").cast("list_head") table_name = modules.vol.type_name.split(constants.BANG)[0] diff --git a/volatility/framework/plugins/linux/pslist.py b/volatility/framework/plugins/linux/pslist.py index fd28e5b7e..b3c749e56 100644 --- a/volatility/framework/plugins/linux/pslist.py +++ b/volatility/framework/plugins/linux/pslist.py @@ -77,7 +77,7 @@ class PsList(interfaces_plugins.PluginInterface): vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0) - init_task = vmlinux.object_from_symbol(object_type = "init_task") + init_task = vmlinux.object_from_symbol(symbol_name = "init_task") for task in init_task.tasks: if not filter_func(task): diff --git a/volatility/framework/plugins/mac/check_syscall.py b/volatility/framework/plugins/mac/check_syscall.py index 815bbcace..3a6077b8f 100644 --- a/volatility/framework/plugins/mac/check_syscall.py +++ b/volatility/framework/plugins/mac/check_syscall.py @@ -27,8 +27,8 @@ class Check_syscall(plugins.PluginInterface): kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) - nsysent = kernel.object_from_symbol(object_type = "nsysent") - table = kernel.object_from_symbol(object_type = "sysent") + nsysent = kernel.object_from_symbol(symbol_name = "nsysent") + table = kernel.object_from_symbol(symbol_name = "sysent") # smear help num_ents = min(nsysent, table.count) diff --git a/volatility/framework/plugins/mac/check_sysctl.py b/volatility/framework/plugins/mac/check_sysctl.py index f66527dc3..396466525 100644 --- a/volatility/framework/plugins/mac/check_sysctl.py +++ b/volatility/framework/plugins/mac/check_sysctl.py @@ -110,7 +110,7 @@ class Check_sysctl(plugins.PluginInterface): kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) - sysctl_list = kernel.object_from_symbol(object_type = "sysctl__children") + sysctl_list = kernel.object_from_symbol(symbol_name = "sysctl__children") for sysctl, name, val in self._process_sysctl_list(kernel, sysctl_list): check_addr = sysctl.oid_handler diff --git a/volatility/framework/plugins/mac/check_trap_table.py b/volatility/framework/plugins/mac/check_trap_table.py index 6b391bb1b..99114de48 100644 --- a/volatility/framework/plugins/mac/check_trap_table.py +++ b/volatility/framework/plugins/mac/check_trap_table.py @@ -27,7 +27,7 @@ class Check_trap_table(plugins.PluginInterface): kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) - table = kernel.object_from_symbol(object_type = "mach_trap_table") + table = kernel.object_from_symbol(symbol_name = "mach_trap_table") for i, ent in enumerate(table): try: diff --git a/volatility/framework/plugins/mac/lsmod.py b/volatility/framework/plugins/mac/lsmod.py index 66f7dca78..d6024b979 100644 --- a/volatility/framework/plugins/mac/lsmod.py +++ b/volatility/framework/plugins/mac/lsmod.py @@ -47,7 +47,7 @@ class Lsmod(plugins.PluginInterface): kernel = contexts.Module(context, darwin_symbols, layer_name, 0) - kmod_ptr = kernel.object_from_symbol(object_type = "kmod") + kmod_ptr = kernel.object_from_symbol(symbol_name = "kmod") # TODO - use smear-proof list walking API after dev release kmod = kmod_ptr.dereference().cast("kmod_info") diff --git a/volatility/framework/plugins/mac/pslist.py b/volatility/framework/plugins/mac/pslist.py index f36f1f3b9..d1d39f088 100644 --- a/volatility/framework/plugins/mac/pslist.py +++ b/volatility/framework/plugins/mac/pslist.py @@ -80,7 +80,7 @@ class PsList(interfaces_plugins.PluginInterface): kernel = contexts.Module(context, darwin_symbols, layer_name, 0) - proc = kernel.object_from_symbol(object_type = "allproc").lh_first + proc = kernel.object_from_symbol(symbol_name = "allproc").lh_first seen = {} while proc is not None and proc.vol.offset != 0: diff --git a/volatility/framework/plugins/mac/trustedbsd.py b/volatility/framework/plugins/mac/trustedbsd.py index dc69df303..de32dc161 100644 --- a/volatility/framework/plugins/mac/trustedbsd.py +++ b/volatility/framework/plugins/mac/trustedbsd.py @@ -49,7 +49,7 @@ class Check_syscall(plugins.PluginInterface): kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) - policy_list = kernel.object_from_symbol(object_type = "_mac_policy_list").cast("mac_policy_list") + policy_list = kernel.object_from_symbol(symbol_name = "_mac_policy_list").cast("mac_policy_list") entries = kernel.object( object_type = "array",