Rework IntermediateSymbolFile loading to a classmethod.

volatility/framework/layers/registry.py

@@ -1,5 +1,4 @@
 import logging
-import os.path as os_path
 import typing
 
 from volatility.framework import constants, exceptions, interfaces, objects
@@ -31,12 +30,10 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface):
         self._hive_offset = self.config["hive_offset"]
         self._table_name = self.config["nt_symbols"]
 
-        self._reg_table_name = context.symbol_space.free_table_name("registry")
-
-        reg_path = "file://" + os_path.join(os_path.dirname(__file__), '..', 'symbols', 'windows', 'reg.json')
-        table = intermed.IntermediateSymbolTable(context = context, config_path = config_path,
-                                                 name = self._reg_table_name, isf_url = reg_path)
-        context.symbol_space.append(table)
+        self._reg_table_name = intermed.IntermediateSymbolTable.create(context,
+                                                                       self._config_path,
+                                                                       'windows',
+                                                                       'registry')
 
         self.hive = self.context.object(self._table_name + constants.BANG + "_CMHIVE", self._base_layer,
                                         self._hive_offset).Hive

volatility/framework/symbols/intermed.py

@@ -156,6 +156,23 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface):
                             if name.endswith(filename + extension) or (filename == "*" and name.endswith(extension)):
                                 yield "jar:file:" + str(pathlib.Path(zip_path)) + "!" + name
 
+    @classmethod
+    def create(cls,
+               context: interfaces.context.ContextInterface,
+               config_path: str,
+               sub_path: str,
+               filename: str) -> str:
+        """Takes a context and loads an intermediate symbol table based on a filename.
+
+        Returns the name of the added symbol table"""
+        urls = list(cls.file_symbol_url(sub_path, filename))
+        if not urls:
+            raise ValueError("No symbol files found at provided filename: {}", filename)
+        table_name = context.symbol_space.free_table_name(filename)
+        table = cls(context = context, config_path = config_path, name = table_name, isf_url = urls[0])
+        context.symbol_space.append(table)
+        return table_name
+
 
 class ISFormatTable(interfaces.symbols.SymbolTableInterface, metaclass = ABCMeta):
     """Provide a base class to identify all subclasses"""