Add in support for looking for symbols in zip files.

We use the jar scheme because that's actually registered with the right
bodies, even if the syntax is a bit weird.  The contents is still
processed by the ResourceAccessor meaning it can be compressed with any
of the supported compression methods.

volatility/framework/layers/__init__.py

@@ -33,6 +33,8 @@ class ResourceAccessor(object):
 
     def open(self, url, mode = "rb"):
         """Returns a file-like object for a particular URL opened in mode"""
+        urllib.request.install_opener(urllib.request.build_opener(JarHandler))
+
         with contextlib.closing(urllib.request.urlopen(url, context = self._context)) as fp:
             # Cache the file locally
             url_type, path = urllib.parse.splittype(url)
@@ -86,3 +88,24 @@ class ResourceAccessor(object):
         if curfile is None:
             raise ValueError("URL does not reference an openable file")
         return curfile
+
+
+class JarHandler(request.BaseHandler):
+    """Handles the jar scheme for URIs"""
+
+    def default_open(self, req):
+        """Handles the request if it's the jar scheme"""
+        if req.type == 'jar':
+            subscheme, remainder = req.full_url.split(":")[1], ":".join(req.full_url.split(":")[2:])
+            if subscheme != 'file':
+                vollog.log(constants.LOGLEVEL_VVV, "Unsupported jar subscheme {}".format(subscheme))
+                return None
+
+            zipsplit = remainder.split("!")
+            if len(zipsplit) != 2:
+                vollog.log(constants.LOGLEVEL_VVV,
+                           "Path did not contain exactly one fragment indicator: {}".format(remainder))
+                return None
+
+            zippath, filepath = zipsplit
+            return zipfile.ZipFile(zippath).open(filepath)

volatility/framework/symbols/intermed.py

@@ -4,6 +4,7 @@ import json
 import logging
 import os
 import pathlib
+import zipfile
 
 from volatility import schemas
 from volatility.framework import class_subclasses, constants, exceptions, interfaces, objects, layers
@@ -135,8 +136,16 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface):
                 except FileNotFoundError:
                     # If there's no linux symbols, don't cry about it
                     pass
-        # Finally try looking in zip files
-        pass
+            # Finally try looking in zip files
+            zip_path = os.path.join(path, sub_path + ".zip")
+            if os.path.exists(zip_path):
+                # We have a zipfile, so run through it and look for sub files that match the filename
+                with zipfile.ZipFile(zip_path) as zfile:
+                    for name in zfile.namelist():
+                        for extension in extensions:
+                            # By ending with an extension (and therefore, not /), we should not return any directories
+                            if name.endswith(filename + extension) or (filename == "*" and name.endswith(extension)):
+                                yield "jar:file:" + str(pathlib.Path(zip_path)) + "!" + name
 
 
 class ISFormatTable(interfaces.symbols.SymbolTableInterface):