mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-06 01:37:39 +02:00
linux: module object extension: Add a function to return the extended ELF symbol information (symbol object and its index) so that doesn't change the get_symbols() interface
This commit is contained in:
@@ -212,14 +212,10 @@ class module(generic.GenericIntelProcess):
|
||||
)
|
||||
return elf_table_name
|
||||
|
||||
def get_symbols(
|
||||
def get_symbols_ex(
|
||||
self,
|
||||
) -> Iterable[Tuple[int, interfaces.objects.ObjectInterface]]:
|
||||
"""Get symbols of the module
|
||||
|
||||
Yields:
|
||||
A tuple containing the ELF symbol index and the corresponding ELF symbol object
|
||||
"""
|
||||
"""Get ELF symbol objects and their index for this module"""
|
||||
|
||||
if not self.section_strtab or self.num_symtab < 1:
|
||||
return None
|
||||
@@ -239,10 +235,18 @@ class module(generic.GenericIntelProcess):
|
||||
subtype=sym_type,
|
||||
count=self.num_symtab,
|
||||
)
|
||||
for elf_sym_num, elf_sym_obj in enumerate(elf_syms):
|
||||
for elf_sym_index, elf_sym_obj in enumerate(elf_syms):
|
||||
# Prepare the symbol object for methods like get_name()
|
||||
elf_sym_obj.cached_strtab = self.section_strtab
|
||||
yield elf_sym_num, elf_sym_obj
|
||||
yield elf_sym_index, elf_sym_obj
|
||||
|
||||
def get_symbols(
|
||||
self,
|
||||
) -> Iterable[interfaces.objects.ObjectInterface]:
|
||||
"""Get ELF symbol objects for this module"""
|
||||
|
||||
for _elf_sym_index, elf_sym_obj in self.get_symbols_ex():
|
||||
yield elf_sym_obj
|
||||
|
||||
def get_symbols_names_and_addresses(self) -> Iterable[Tuple[str, int]]:
|
||||
"""Get names and addresses for each symbol of the module
|
||||
@@ -251,13 +255,13 @@ class module(generic.GenericIntelProcess):
|
||||
A tuple for each symbol containing the symbol name and its corresponding value
|
||||
"""
|
||||
layer = self._context.layers[self.vol.layer_name]
|
||||
for _sym_num, sym in self.get_symbols():
|
||||
sym_name = sym.get_name()
|
||||
for elf_sym_obj in self.get_symbols():
|
||||
sym_name = elf_sym_obj.get_name()
|
||||
if not sym_name:
|
||||
continue
|
||||
|
||||
# Normalize sym.st_value offset, which is an address pointing to the symbol value
|
||||
sym_address = sym.st_value & layer.address_mask
|
||||
sym_address = elf_sym_obj.st_value & layer.address_mask
|
||||
yield (sym_name, sym_address)
|
||||
|
||||
def get_symbol(self, wanted_sym_name) -> Optional[int]:
|
||||
|
||||
Reference in New Issue
Block a user