diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 1f05d342f..db3fd9f70 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -243,3 +243,46 @@ class Version1Format(ISFormatTable): object_class = object_class, size = curdict['length'], members = members) + + +class Version2Format(Version1Format): + """Class for storing intermediate debugging data as objects and classes""" + current = 2 + revision = 0 + age = 0 + version = (current - age, age, revision) + + def _get_natives(self): + """Determines the appropriate native_types to use from the JSON data""" + classes = {"x64": native.x64NativeTable, "x86": native.x86NativeTable} + for nc in classes: + native_class = classes[nc] + for base_type in self._json_object['base_types']: + try: + if self._json_object['base_types'][base_type]['size'] != native_class.get_type(base_type).size: + break + except TypeError: + # TODO: determine whether we should give voids a size - We don't give voids a length, whereas microsoft seemingly do + pass + else: + vollog.debug("Choosing appropriate natives for symbol library: {}".format(nc)) + return native_class.natives + + def get_type(self, type_name): + """Resolves an individual symbol""" + if constants.BANG in type_name: + raise exceptions.SymbolError("Symbol for a different table requested: {}".format(type_name)) + if type_name not in self._json_object['user_types']: + # Fall back to the natives table + return self.natives.get_type(type_name) + curdict = self._json_object['user_types'][type_name] + members = {} + for member_name in curdict['fields']: + interdict = curdict['fields'][member_name] + member = (interdict['offset'], self._interdict_to_template(interdict['type'])) + members[member_name] = member + object_class = self.get_type_class(type_name) + return objects.templates.ObjectTemplate(type_name = self.name + constants.BANG + type_name, + object_class = object_class, + size = curdict['size'], + members = members) diff --git a/volatility/schemas/schema-0.1.0.json b/volatility/schemas/schema-0.1.0.json index 99cb45ccc..18be22441 100644 --- a/volatility/schemas/schema-0.1.0.json +++ b/volatility/schemas/schema-0.1.0.json @@ -9,7 +9,7 @@ "properties": { "format": { "type": "string", - "pattern": "^[0-9]+.[0-9]+.[0-9]+$" + "pattern": "^0.[0-9]+.[0-9]+$" }, "source": { "type": "object", diff --git a/volatility/schemas/schema-2.0.0.json b/volatility/schemas/schema-2.0.0.json new file mode 100644 index 000000000..3b1c57c47 --- /dev/null +++ b/volatility/schemas/schema-2.0.0.json @@ -0,0 +1,265 @@ +{ + "$schema": "http://json-schema.org/schema#", + "id": "http://volatilityfoundation.org/intermediate-format/schema", + "title": "Symbol Container", + "type": "object", + "definitions": { + "element_metadata": { + "type": "object", + "properties": { + "format": { + "type": "string", + "pattern": "^2.[0-9]+.[0-9]+$" + }, + "source": { + "type": "object", + "properties": { + "type": { + "type": "string" + } + } + }, + "producer": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "version": { + "type": "string" + }, + "datetime": { + "type": "string", + "format": "date-time" + } + } + } + }, + "required": [ + "format" + ], + "additionalProperties": false + }, + "element_enum": { + "properties": { + "size": { + "type": "integer" + }, + "base": { + "type": "string" + }, + "constants": { + "type": "object", + "additionalProperties": { + "type": "integer" + } + } + }, + "additionalProperties": false + }, + "element_symbol": { + "properties": { + "address": { + "type": "number" + }, + "linkage_name": { + "type": "string" + } + }, + "requiredProperties": [ + "address" + ], + "additionalProperties": false + }, + "element_base_type": { + "properties": { + "size": { + "type": "integer" + } + }, + "additionalProperties": false + }, + "element_user_type": { + "properties": { + "kind": { + "type": "string", + "pattern": "^(struct|union|class)$" + }, + "size": { + "type": "integer" + }, + "fields": { + "type": "object", + "additionalProperties": { + "$ref": "#/definitions/field" + } + } + }, + "requiredProperties": [ + "kind", + "size", + "fields" + ], + "additionalProperties": false + }, + "field": { + "properties": { + "type": { + "$ref": "#/definitions/type_descriptor" + }, + "offset": { + "type": "integer" + } + }, + "additionalProperties": false + }, + "type_descriptor": { + "oneOf": [ + { + "$ref": "#/definitions/type_pointer" + }, + { + "$ref": "#/definitions/type_base" + }, + { + "$ref": "#/definitions/type_array" + }, + { + "$ref": "#/definitions/type_struct" + }, + { + "$ref": "#/definitions/type_enum" + }, + { + "$ref": "#/definitions/type_function" + }, + { + "$ref": "#/definitions/type_bitfield" + } + ] + }, + "type_pointer": { + "properties": { + "kind": { + "type": "string", + "pattern": "^pointer$" + }, + "subtype": { + "$ref": "#/definitions/type_descriptor" + } + }, + "additionalProperties": false + }, + "type_base": { + "properties": { + "kind": { + "type": "string", + "pattern": "^base$" + }, + "name": { + "type": "string" + } + }, + "additionalProperties": false + }, + "type_array": { + "properties": { + "kind": { + "type": "string", + "pattern": "^array$" + }, + "subtype": { + "$ref": "#/definitions/type_descriptor" + }, + "count": { + "type": "integer" + } + }, + "additionalProperties": false + }, + "type_struct": { + "properties": { + "kind": { + "type": "string", + "pattern": "^(struct|class|union)$" + }, + "name": { + "type": "string" + } + }, + "additionalProperties": false + }, + "type_enum": { + "properties": { + "kind": { + "type": "string", + "pattern": "^enum$" + }, + "name": { + "type": "string" + } + }, + "additionalProperties": false + }, + "type_function": { + "properties": { + "kind": { + "type": "string", + "pattern": "^function$" + } + }, + "additionalProperties": false + }, + "type_bitfield": { + "properties": { + "kind": { + "type": "string", + "pattern": "^bitfield$" + }, + "bit_position": { + "type": "integer" + }, + "bit_length": { + "type": "integer" + }, + "type": { + "$ref": "#/definitions/type_base" + } + }, + "additionalProperties": false + } + }, + "properties": { + "metadata": { + "$ref": "#/definitions/element_metadata" + }, + "base_types": { + "additionalProperties": { + "$ref": "#/definitions/element_base_type" + } + }, + "user_types": { + "additionalProperties": { + "$ref": "#/definitions/element_user_type" + } + }, + "enums": { + "additionalProperties": { + "$ref": "#/definitions/element_enum" + } + }, + "symbols": { + "additionalProperties": { + "$ref": "#/definitions/element_symbol" + } + } + }, + "required": [ + "metadata", + "base_types", + "user_types", + "enums", + "symbols" + ], + "additionalProperties": false +}