diff --git a/volatility/cli/volshell/generic.py b/volatility/cli/volshell/generic.py index ee1c301c9..4d55fd9a0 100644 --- a/volatility/cli/volshell/generic.py +++ b/volatility/cli/volshell/generic.py @@ -106,7 +106,7 @@ class Volshell(interfaces.plugins.PluginInterface): (['dpo', 'display_plugin_output'], self.display_plugin_output), (['gt', 'generate_treegrid'], self.generate_treegrid), (['rt', 'render_treegrid'], self.render_treegrid), - (['hh', 'help'], self.help)] + (['ds', 'display_symbols'], self.display_symbols), (['hh', 'help'], self.help)] def _construct_locals_dict(self) -> Dict[str, Any]: """Returns a dictionary of the locals """ @@ -281,8 +281,27 @@ class Volshell(interfaces.plugins.PluginInterface): renderer.render(treegrid) def display_plugin_output(self, plugin: Type[interfaces.plugins.PluginInterface], **kwargs) -> None: + """Displays the output for a particular plugin (with keyword arguments)""" self.render_treegrid(self.generate_treegrid(plugin, **kwargs)) + def display_symbols(self, symbol_table: str = None): + """Prints an alphabetical list of symbols for a symbol table""" + if symbol_table is None: + print("No symbol table provided") + return + longest_offset = longest_name = 0 + + table = self.context.symbol_space[symbol_table] + for symbol_name in table.symbols: + symbol = table.get_symbol(symbol_name) + longest_offset = max(longest_offset, len(hex(symbol.address))) + longest_name = max(longest_name, len(symbol.name)) + + for symbol_name in sorted(table.symbols): + symbol = table.get_symbol(symbol_name) + len_offset = len(hex(symbol.address)) + print(" " * (longest_offset - len_offset), hex(symbol.address), " ", symbol.name) + class NullFileConsumer(interfaces.plugins.FileConsumerInterface): """Null FileConsumer that swallows files whole""" diff --git a/volatility/cli/volshell/linux.py b/volatility/cli/volshell/linux.py index 64b80e88e..316d97bdc 100644 --- a/volatility/cli/volshell/linux.py +++ b/volatility/cli/volshell/linux.py @@ -56,3 +56,9 @@ class Volshell(generic.Volshell): if constants.BANG not in object: object = self.config['vmlinux'] + constants.BANG + object return super().display_type(object) + + def display_symbols(self, symbol_table: str = None): + """Prints an alphabetical list of symbols for a symbol table""" + if symbol_table is None: + symbol_table = self.config['vmlinux'] + return super().display_symbols(symbol_table) diff --git a/volatility/cli/volshell/mac.py b/volatility/cli/volshell/mac.py index 25ed0f09f..48fb52f94 100644 --- a/volatility/cli/volshell/mac.py +++ b/volatility/cli/volshell/mac.py @@ -56,3 +56,9 @@ class Volshell(generic.Volshell): if constants.BANG not in object: object = self.config['darwin'] + constants.BANG + object return super().display_type(object) + + def display_symbols(self, symbol_table: str = None): + """Prints an alphabetical list of symbols for a symbol table""" + if symbol_table is None: + symbol_table = self.config['darwin'] + return super().display_symbols(symbol_table) diff --git a/volatility/cli/volshell/windows.py b/volatility/cli/volshell/windows.py index 9958edb2e..643e95250 100644 --- a/volatility/cli/volshell/windows.py +++ b/volatility/cli/volshell/windows.py @@ -53,3 +53,9 @@ class Volshell(generic.Volshell): if constants.BANG not in object: object = self.config['nt_symbols'] + constants.BANG + object return super().display_type(object) + + def display_symbols(self, symbol_table: str = None): + """Prints an alphabetical list of symbols for a symbol table""" + if symbol_table is None: + symbol_table = self.config['nt_symbols'] + return super().display_symbols(symbol_table)