Move type_classes to dictionaries stored in their modules rather than separate tables.

volatility/framework/plugins/windows/info.py

@@ -25,8 +25,9 @@ from volatility.framework.interfaces import plugins
 from volatility.framework import constants, interfaces, layers
 from volatility.framework.configuration import requirements
 from volatility.framework.renderers import TreeGrid
-from volatility.framework.symbols.windows.kdbg import KdbgIntermedSymbols
-from volatility.framework.symbols.windows.pe import PEIntermedSymbols
+from volatility.framework.symbols import intermed
+from volatility.framework.symbols.windows import extensions
+from volatility.framework.symbols.windows.extensions import kdbg
 
 
 class Info(plugins.PluginInterface):
@@ -66,10 +67,16 @@ class Info(plugins.PluginInterface):
 
         native_types = self.context.symbol_space[self.config["nt_symbols"]].natives
 
-        kdbg_table_name = KdbgIntermedSymbols.create(
-            self.context, self.config_path, "windows", "kdbg", native_types = native_types)
+        kdbg_table_name = intermed.IntermediateSymbolTable.create(
+            self.context,
+            self.config_path,
+            "windows",
+            "kdbg",
+            native_types = native_types,
+            class_types = extensions.kdbg.class_types)
 
-        pe_table_name = PEIntermedSymbols.create(self.context, self.config_path, "windows", "pe")
+        pe_table_name = intermed.IntermediateSymbolTable.create(
+            self.context, self.config_path, "windows", "pe", class_types = extensions.pe.class_types)
 
         kvo = virtual_layer.config["kernel_virtual_offset"]
 

volatility/framework/plugins/windows/moddump.py

@@ -21,21 +21,19 @@
 import logging
 from typing import List, Generator, Iterable
 
-import volatility.framework.constants as constants
-import volatility.framework.exceptions as exceptions
-import volatility.framework.interfaces.plugins as interfaces_plugins
-import volatility.framework.renderers as renderers
-import volatility.plugins.windows.modules as modules
-import volatility.plugins.windows.pslist as pslist
+from volatility.plugins.windows import pslist, modules
+
+from volatility.framework import constants, exceptions, renderers
 from volatility.framework import interfaces
 from volatility.framework.configuration import requirements
 from volatility.framework.renderers import format_hints
-from volatility.framework.symbols.windows.pe import PEIntermedSymbols
+from volatility.framework.symbols import intermed
+from volatility.framework.symbols.windows.extensions import pe
 
 vollog = logging.getLogger(__name__)
 
 
-class ModDump(interfaces_plugins.PluginInterface):
+class ModDump(interfaces.plugins.PluginInterface):
     """Dumps kernel modules"""
 
     @classmethod
@@ -108,7 +106,8 @@ class ModDump(interfaces_plugins.PluginInterface):
     def _generator(self, mods):
 
         session_layers = list(self.get_session_layers(self.context, self.config['primary'], self.config['nt_symbols']))
-        pe_table_name = PEIntermedSymbols.create(self.context, self.config_path, "windows", "pe")
+        pe_table_name = intermed.IntermediateSymbolTable.create(
+            self.context, self.config_path, "windows", "pe", class_types = pe.class_types)
 
         for mod in mods:
             try:
@@ -126,7 +125,7 @@ class ModDump(interfaces_plugins.PluginInterface):
                         offset = mod.DllBase,
                         layer_name = session_layer_name)
 
-                    filedata = interfaces_plugins.FileInterface("module.{0:#x}.dmp".format(mod.DllBase))
+                    filedata = interfaces.plugins.FileInterface("module.{0:#x}.dmp".format(mod.DllBase))
 
                     for offset, data in dos_header.reconstruct():
                         filedata.data.seek(offset)

volatility/framework/plugins/windows/procdump.py

@@ -29,7 +29,9 @@ import volatility.plugins.windows.pslist as pslist
 from volatility.framework import interfaces
 from volatility.framework.configuration import requirements
 from volatility.framework.objects import utility
-from volatility.framework.symbols.windows.pe import PEIntermedSymbols
+from volatility.framework.symbols.windows.extensions import pe
+
+from volatility.framework.symbols import intermed
 
 vollog = logging.getLogger(__name__)
 
@@ -48,7 +50,8 @@ class ProcDump(interfaces_plugins.PluginInterface):
 
     def _generator(self, procs):
 
-        pe_table_name = PEIntermedSymbols.create(self.context, self.config_path, "windows", "pe")
+        pe_table_name = intermed.IntermediateSymbolTable.create(
+            self.context, self.config_path, "windows", "pe", class_types = pe.class_types)
 
         for proc in procs:
             process_name = utility.array_to_string(proc.ImageFileName)

volatility/framework/symbols/windows/extensions/kdbg.py

@@ -47,3 +47,6 @@ class _KDDEBUGGER_DATA64(objects.Struct):
             symbol_table_name + constants.BANG + "unsigned long", layer_name = layer_name, offset = self.CmNtCSDVersion)
 
         return (csdresult >> 8) & 0xffffffff
+
+
+class_types = {'_KDDEBUGGER_DATA64': _KDDEBUGGER_DATA64}

volatility/framework/symbols/windows/extensions/pe.py

@@ -183,3 +183,11 @@ class _IMAGE_NT_HEADERS(objects.Struct):
                 symbol_table_name + constants.BANG + "_IMAGE_SECTION_HEADER",
                 offset = sect_addr,
                 layer_name = layer_name)
+
+
+class_types = {
+    '_IMAGE_DOS_HEADER': _IMAGE_DOS_HEADER,
+    # the 32- and 64-bit extensions behave the same way, but the underlying structure is different
+    '_IMAGE_NT_HEADERS': _IMAGE_NT_HEADERS,
+    '_IMAGE_NT_HEADERS64': _IMAGE_NT_HEADERS
+}

volatility/framework/symbols/windows/extensions/registry.py

@@ -25,6 +25,7 @@ from typing import Optional, Iterable, Union
 
 from volatility.framework import constants, exceptions, objects, interfaces
 from volatility.framework.layers.registry import RegistryHive
+from volatility.framework.symbols import intermed
 
 vollog = logging.getLogger(__name__)
 

volatility/framework/symbols/windows/kdbg.py

@@ -1,28 +0,0 @@
-# This file was contributed to the Volatility Framework Version 3.
-# Copyright (C) 2018 Volatility Foundation.
-#
-# THE LICENSED WORK IS PROVIDED UNDER THE TERMS OF THE Volatility Contributors
-# Public License V1.0("LICENSE") AS FIRST COMPLETED BY: Volatility Foundation,
-# Inc. ANY USE, PUBLIC DISPLAY, PUBLIC PERFORMANCE, REPRODUCTION OR DISTRIBUTION
-# OF, OR PREPARATION OF SUBSEQUENT WORKS, DERIVATIVE WORKS OR DERIVED WORKS BASED
-# ON, THE LICENSED WORK CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS LICENSE AND ITS
-# TERMS, WHETHER OR NOT SUCH RECIPIENT READS THE TERMS OF THE LICENSE. "LICENSED
-# WORK,” “RECIPIENT" AND “DISTRIBUTOR" ARE DEFINED IN THE LICENSE. A COPY OF THE
-# LICENSE IS LOCATED IN THE TEXT FILE ENTITLED "LICENSE.txt" ACCOMPANYING THE
-# CONTENTS OF THIS FILE. IF A COPY OF THE LICENSE DOES NOT ACCOMPANY THIS FILE, A
-# COPY OF THE LICENSE MAY ALSO BE OBTAINED AT THE FOLLOWING WEB SITE:
-# https://www.volatilityfoundation.org/license/vcpl_v1.0
-#
-# Software distributed under the License is distributed on an "AS IS" basis,
-# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for the
-# specific language governing rights and limitations under the License.
-#
-
-from volatility.framework.symbols import intermed
-from volatility.framework.symbols.windows.extensions import kdbg
-
-
-class KdbgIntermedSymbols(intermed.IntermediateSymbolTable):
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs, class_types = {'_KDDEBUGGER_DATA64': kdbg._KDDEBUGGER_DATA64})

volatility/framework/symbols/windows/pe.py

@@ -1,36 +0,0 @@
-# This file was contributed to the Volatility Framework Version 3.
-# Copyright (C) 2018 Volatility Foundation.
-#
-# THE LICENSED WORK IS PROVIDED UNDER THE TERMS OF THE Volatility Contributors
-# Public License V1.0("LICENSE") AS FIRST COMPLETED BY: Volatility Foundation,
-# Inc. ANY USE, PUBLIC DISPLAY, PUBLIC PERFORMANCE, REPRODUCTION OR DISTRIBUTION
-# OF, OR PREPARATION OF SUBSEQUENT WORKS, DERIVATIVE WORKS OR DERIVED WORKS BASED
-# ON, THE LICENSED WORK CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS LICENSE AND ITS
-# TERMS, WHETHER OR NOT SUCH RECIPIENT READS THE TERMS OF THE LICENSE. "LICENSED
-# WORK,” “RECIPIENT" AND “DISTRIBUTOR" ARE DEFINED IN THE LICENSE. A COPY OF THE
-# LICENSE IS LOCATED IN THE TEXT FILE ENTITLED "LICENSE.txt" ACCOMPANYING THE
-# CONTENTS OF THIS FILE. IF A COPY OF THE LICENSE DOES NOT ACCOMPANY THIS FILE, A
-# COPY OF THE LICENSE MAY ALSO BE OBTAINED AT THE FOLLOWING WEB SITE:
-# https://www.volatilityfoundation.org/license/vcpl_v1.0
-#
-# Software distributed under the License is distributed on an "AS IS" basis,
-# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for the
-# specific language governing rights and limitations under the License.
-#
-
-from volatility.framework.symbols import intermed
-from volatility.framework.symbols.windows.extensions import pe
-
-
-class PEIntermedSymbols(intermed.IntermediateSymbolTable):
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(
-            *args,
-            **kwargs,
-            class_types = {
-                '_IMAGE_DOS_HEADER': pe._IMAGE_DOS_HEADER,
-                # the 32- and 64-bit extensions behave the same way, but the underlying structure is different
-                '_IMAGE_NT_HEADERS': pe._IMAGE_NT_HEADERS,
-                '_IMAGE_NT_HEADERS64': pe._IMAGE_NT_HEADERS
-            })