diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 5f4b7c170..2e06ee687 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -212,14 +212,10 @@ class module(generic.GenericIntelProcess): ) return elf_table_name - def get_symbols( + def get_symbols_ex( self, ) -> Iterable[Tuple[int, interfaces.objects.ObjectInterface]]: - """Get symbols of the module - - Yields: - A tuple containing the ELF symbol index and the corresponding ELF symbol object - """ + """Get ELF symbol objects and their index for this module""" if not self.section_strtab or self.num_symtab < 1: return None @@ -239,10 +235,18 @@ class module(generic.GenericIntelProcess): subtype=sym_type, count=self.num_symtab, ) - for elf_sym_num, elf_sym_obj in enumerate(elf_syms): + for elf_sym_index, elf_sym_obj in enumerate(elf_syms): # Prepare the symbol object for methods like get_name() elf_sym_obj.cached_strtab = self.section_strtab - yield elf_sym_num, elf_sym_obj + yield elf_sym_index, elf_sym_obj + + def get_symbols( + self, + ) -> Iterable[interfaces.objects.ObjectInterface]: + """Get ELF symbol objects for this module""" + + for _elf_sym_index, elf_sym_obj in self.get_symbols_ex(): + yield elf_sym_obj def get_symbols_names_and_addresses(self) -> Iterable[Tuple[str, int]]: """Get names and addresses for each symbol of the module @@ -251,13 +255,13 @@ class module(generic.GenericIntelProcess): A tuple for each symbol containing the symbol name and its corresponding value """ layer = self._context.layers[self.vol.layer_name] - for _sym_num, sym in self.get_symbols(): - sym_name = sym.get_name() + for elf_sym_obj in self.get_symbols(): + sym_name = elf_sym_obj.get_name() if not sym_name: continue # Normalize sym.st_value offset, which is an address pointing to the symbol value - sym_address = sym.st_value & layer.address_mask + sym_address = elf_sym_obj.st_value & layer.address_mask yield (sym_name, sym_address) def get_symbol(self, wanted_sym_name) -> Optional[int]: