WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-11 04:07:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

symbols getters follow vol2 format

Browse Source
This commit is contained in:
Abyss Watcher
2023-11-17 17:52:58 +01:00
parent 1a73717b93
commit 6372b6f367
1 changed files with 18 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/linux/extensions/__init__.py
+18 -18
View File
@@ -132,37 +132,37 @@ class module(generic.GenericIntelProcess):
),
count=self.num_symtab + 1,
)
if self.section_strtab:
for sym in syms:
sym_arr = self._context.object(
self.get_symbol_table_name() + constants.BANG + "array",
layer_name=self.vol.native_layer_name,
offset=self.section_strtab + sym.st_name,
)
try:
sym_offset = self.section_strtab + sym.st_name
sym_name = self._context.layers[self.vol.layer_name].read(
sym_offset, 512
) # 512 is the value of KSYM_NAME_LEN
except exceptions.PagedInvalidAddressException:
sym_name = utility.array_to_string(
sym_arr, 512
) # 512 is the value of KSYM_NAME_LEN kernel constant
except exceptions.InvalidAddressException:
continue
# Stop at first null byte (strtab is a null terminated strings list)
sym_name = sym_name.split(b"\x00")[0].decode("latin-1")
if sym_name != "":
# Normalize sym_value
# Normalize sym.st_value offset, which is an address pointing to the symbol value
mask = self._context.layers[self.vol.layer_name].address_mask
sym_value = sym.st_value & mask
yield (sym_name, sym_value, sym_offset)
sym_address = sym.st_value & mask
yield (sym_name, sym_address)
def get_symbol(self, wanted_sym_name):
"""Get symbol value for a given symbol name"""
for sym_name, sym_value, sym_offset in self.get_symbols():
for sym_name, sym_address in self.get_symbols():
if wanted_sym_name == sym_name:
return sym_value
return sym_address
return None
def get_symbol_name_from_value(self, wanted_sym_value):
"""Get symbol name for a given symbol value"""
for sym_name, sym_value, sym_offset in self.get_symbols():
if wanted_sym_value == sym_value:
def get_symbol_from_address(self, wanted_sym_address):
"""Get symbol name for a given symbol address"""
for sym_name, sym_address in self.get_symbols():
if wanted_sym_address == sym_address:
return sym_name
return None