From 6aac0571e6dfd0c39af65984997b7c98f81a7567 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Tue, 18 Dec 2018 10:16:50 -0600 Subject: [PATCH] add support for objective C classes in OSX and json format --- volatility/framework/objects/__init__.py | 2 ++ volatility/framework/symbols/intermed.py | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index a8cf29bdf..630cb4332 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -647,6 +647,8 @@ class Struct(interfaces.objects.ObjectInterface): class Union(Struct): pass +class vol_class(Struct): + pass # Really nasty way of duplicating the class # WILL cause problems with any mutable class/static variables diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index a59cf097e..4fab65498 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -342,7 +342,7 @@ class Version1Format(ISFormatTable): return native_template # Otherwise - if dictionary['kind'] not in ['struct', 'union']: + if dictionary['kind'] not in ['struct', 'union', 'vol_class']: raise exceptions.SymbolSpaceError("Unknown Intermediate format: {}".format(dictionary)) reference_name = dictionary['name']