WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-25 23:52:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add in fix for absolute symbol offsets within modules.

Browse Source
This commit is contained in:
Mike Auty
2018-12-20 15:46:42 +00:00
committed by ikelos
parent 4308245499
commit 67c9c7e097
2 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/contexts/__init__.py
+6 -3
View File
@@ -182,7 +182,8 @@ class Module(interfaces.context.ModuleInterface):
if symbol.type is None:
raise ValueError("Symbol {} has no associated type information".format(symbol.name))
type_arg = symbol.type
offset = symbol.address + self._offset
if not self._absolute_symbol_addresses:
offset = symbol.address + self._offset
elif type_name is not None and offset is not None:
self._check_type(type_name, str)
self._check_type(offset, int)
@@ -213,14 +214,16 @@ class SizedModule(Module):
offset: int,
size: int,
symbol_table_name: Optional[str] = None,
native_layer_name: Optional[str] = None) -> None:
native_layer_name: Optional[str] = None,
absolute_symbol_offsets: bool = False) -> None:
super().__init__(
context,
module_name = module_name,
layer_name = layer_name,
offset = offset,
native_layer_name = native_layer_name,
symbol_table_name = symbol_table_name)
symbol_table_name = symbol_table_name,
absolute_symbol_offsets = absolute_symbol_offsets)
self._size = self._check_type(size, int)
@property
volatility/framework/interfaces/context.py
+3 -1
View File
@@ -115,7 +115,8 @@ class ModuleInterface(validity.ValidityRoutines, metaclass = ABCMeta):
layer_name: str,
offset: int,
symbol_table_name: Optional[str] = None,
native_layer_name: Optional[str] = None) -> None:
native_layer_name: Optional[str] = None,
absolute_symbol_addresses: bool = False) -> None:
self._context = self._check_type(context, ContextInterface)
self._module_name = self._check_type(module_name, str)
self._layer_name = self._check_type(layer_name, str)
@@ -124,6 +125,7 @@ class ModuleInterface(validity.ValidityRoutines, metaclass = ABCMeta):
if native_layer_name:
self._native_layer_name = self._check_type(native_layer_name, str)
self.symbol_table_name = symbol_table_name or self._module_name
self._absolute_symbol_addresses = absolute_symbol_addresses
super().__init__()
@property