From 67c9c7e0973ef6979679e851f5abc4bfbe2e92ad Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 19 Dec 2018 22:30:12 +0000 Subject: [PATCH] Add in fix for absolute symbol offsets within modules. --- volatility/framework/contexts/__init__.py | 9 ++++++--- volatility/framework/interfaces/context.py | 4 +++- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/volatility/framework/contexts/__init__.py b/volatility/framework/contexts/__init__.py index 18aa3aa46..5c3095d2d 100644 --- a/volatility/framework/contexts/__init__.py +++ b/volatility/framework/contexts/__init__.py @@ -182,7 +182,8 @@ class Module(interfaces.context.ModuleInterface): if symbol.type is None: raise ValueError("Symbol {} has no associated type information".format(symbol.name)) type_arg = symbol.type - offset = symbol.address + self._offset + if not self._absolute_symbol_addresses: + offset = symbol.address + self._offset elif type_name is not None and offset is not None: self._check_type(type_name, str) self._check_type(offset, int) @@ -213,14 +214,16 @@ class SizedModule(Module): offset: int, size: int, symbol_table_name: Optional[str] = None, - native_layer_name: Optional[str] = None) -> None: + native_layer_name: Optional[str] = None, + absolute_symbol_offsets: bool = False) -> None: super().__init__( context, module_name = module_name, layer_name = layer_name, offset = offset, native_layer_name = native_layer_name, - symbol_table_name = symbol_table_name) + symbol_table_name = symbol_table_name, + absolute_symbol_offsets = absolute_symbol_offsets) self._size = self._check_type(size, int) @property diff --git a/volatility/framework/interfaces/context.py b/volatility/framework/interfaces/context.py index dc97b0d30..1a5a42786 100644 --- a/volatility/framework/interfaces/context.py +++ b/volatility/framework/interfaces/context.py @@ -115,7 +115,8 @@ class ModuleInterface(validity.ValidityRoutines, metaclass = ABCMeta): layer_name: str, offset: int, symbol_table_name: Optional[str] = None, - native_layer_name: Optional[str] = None) -> None: + native_layer_name: Optional[str] = None, + absolute_symbol_addresses: bool = False) -> None: self._context = self._check_type(context, ContextInterface) self._module_name = self._check_type(module_name, str) self._layer_name = self._check_type(layer_name, str) @@ -124,6 +125,7 @@ class ModuleInterface(validity.ValidityRoutines, metaclass = ABCMeta): if native_layer_name: self._native_layer_name = self._check_type(native_layer_name, str) self.symbol_table_name = symbol_table_name or self._module_name + self._absolute_symbol_addresses = absolute_symbol_addresses super().__init__() @property