WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-21 17:17:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add in further pointer fixes.

Browse Source
This commit is contained in:
Mike Auty
2019-07-30 22:14:19 +01:00
committed by ikelos
parent 927bcd3318
commit 848fe7391a
3 changed files with 454 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/intermed.py
+3 -2
View File
@@ -358,8 +358,9 @@ class Version1Format(ISFormatTable):
update['count'] = dictionary['count']
update['subtype'] = self._interdict_to_template(dictionary['subtype'])
elif type_name == 'pointer':
if dictionary.get('name', None):
native_template = self.natives.get_type(self.name + constants.BANG + dictionary['name'])
if dictionary.get('base', None):
base_type = self.natives.get_type(self.name + constants.BANG + dictionary['base'])
update['data_format'] = base_type.vol['data_format']
update['subtype'] = self._interdict_to_template(dictionary['subtype'])
elif type_name == 'enum':
update = self._lookup_enum(dictionary['name'])
volatility/framework/symbols/windows/mspdb.py
+1 -1
View File
@@ -582,7 +582,7 @@ class PdbReader:
result = {"kind": "pointer", "subtype": result}
else:
self.bases[pointer_name] = pointer_base
result = {"kind": "pointer", "name": pointer_name, "subtype": result}
result = {"kind": "pointer", "base": pointer_name, "subtype": result}
return result
else:
leaf_type, name, value = self.types[index - 0x1000]
volatility/schemas/schema-6.1.0.json
+450
View File
@@ -0,0 +1,450 @@
{
"$schema": "http://json-schema.org/schema#",
"id": "http://volatilityfoundation.org/intermediate-format/schema",
"title": "Symbol Container",
"type": "object",
"definitions": {
"metadata_producer": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"version": {
"type": "string"
},
"datetime": {
"type": "string",
"format": "date-time"
}
}
},
"metadata_windows_pe": {
"type": "object",
"properties": {
"major": {
"type": "integer"
},
"minor": {
"type": "integer"
},
"revision": {
"type": "integer"
},
"build": {
"type": "integer"
}
},
"additionalProperties": false,
"required": [
"major",
"minor",
"revision"
]
},
"metadata_windows_pdb": {
"type": "object",
"properties": {
"GUID": {
"type": "string"
},
"age": {
"type": "integer"
},
"database": {
"type": "string"
},
"machine_type": {
"type": "integer"
}
},
"additionalProperties": false,
"required": [
"GUID",
"age",
"database",
"machine_type"
]
},
"metadata_windows": {
"type": "object",
"properties": {
"pe": {
"$ref": "#/definitions/metadata_windows_pe"
},
"pdb": {
"$ref": "#/definitions/metadata_windows_pdb"
}
},
"additionalProperties": false
},
"metadata_linux": {
"type": "object",
"$comment": "Reserved for future use"
},
"metadata_format": {
"type": "string",
"pattern": "^6.[0-9]+.[0-9]+$"
},
"metadata_source": {
"type": "object",
"properties": {
"type": {
"type": "string"
}
}
},
"element_metadata": {
"type": "object",
"oneOf": [
{
"properties": {
"format": {
"$ref": "#/definitions/metadata_format"
},
"producer": {
"$ref": "#/definitions/metadata_producer"
}
},
"required": [
"format"
],
"additionalProperties": false
},
{
"properties": {
"format": {
"$ref": "#/definitions/metadata_format"
},
"producer": {
"$ref": "#/definitions/metadata_producer"
},
"windows": {
"$ref": "#/definitions/metadata_windows"
}
},
"required": [
"format",
"windows"
],
"additionalProperties": false
},
{
"properties": {
"format": {
"$ref": "#/definitions/metadata_format"
},
"producer": {
"$ref": "#/definitions/metadata_producer"
},
"linux": {
"$ref": "#/definitions/metadata_linux"
}
},
"required": [
"format",
"linux"
],
"additionalProperties": false
}
]
},
"element_enum": {
"properties": {
"size": {
"type": "integer"
},
"base": {
"type": "string"
},
"constants": {
"type": "object",
"additionalProperties": {
"type": "integer"
}
}
},
"required": [
"size",
"base",
"constants"
],
"additionalProperties": false
},
"element_symbol": {
"properties": {
"address": {
"type": "number"
},
"linkage_name": {
"type": "string"
},
"type": {
"$ref": "#/definitions/type_descriptor"
},
"constant_data": {
"type": "string",
"media": {
"binaryEncoding": "base64",
"readOnly": true
}
}
},
"required": [
"address"
],
"additionalProperties": false
},
"element_base_type": {
"properties": {
"size": {
"type": "integer"
},
"signed": {
"type": "boolean"
},
"kind": {
"type": "string",
"pattern": "^(void|int|float|char|bool)$"
},
"endian": {
"type": "string",
"pattern": "^(little|big)$"
}
},
"required": [
"size",
"kind",
"signed",
"endian"
],
"additionalProperties": false
},
"element_user_type": {
"properties": {
"kind": {
"type": "string",
"pattern": "^(struct|union|class)$"
},
"size": {
"type": "integer"
},
"fields": {
"type": "object",
"additionalProperties": {
"$ref": "#/definitions/field"
}
}
},
"required": [
"kind",
"size",
"fields"
],
"additionalProperties": false
},
"field": {
"properties": {
"type": {
"$ref": "#/definitions/type_descriptor"
},
"offset": {
"type": "integer"
}
},
"required": [
"type",
"offset"
],
"additionalProperties": false
},
"type_descriptor": {
"oneOf": [
{
"$ref": "#/definitions/type_pointer"
},
{
"$ref": "#/definitions/type_base"
},
{
"$ref": "#/definitions/type_array"
},
{
"$ref": "#/definitions/type_struct"
},
{
"$ref": "#/definitions/type_enum"
},
{
"$ref": "#/definitions/type_function"
},
{
"$ref": "#/definitions/type_bitfield"
}
]
},
"type_pointer": {
"properties": {
"kind": {
"type": "string",
"pattern": "^pointer$"
},
"base": {
"type": "string"
},
"subtype": {
"$ref": "#/definitions/type_descriptor"
}
},
"required": [
"kind",
"subtype"
],
"additionalProperties": false
},
"type_base": {
"properties": {
"kind": {
"type": "string",
"pattern": "^base$"
},
"name": {
"type": "string"
}
},
"required": [
"kind",
"name"
],
"additionalProperties": false
},
"type_array": {
"properties": {
"kind": {
"type": "string",
"pattern": "^array$"
},
"subtype": {
"$ref": "#/definitions/type_descriptor"
},
"count": {
"type": "integer"
}
},
"required": [
"kind",
"subtype",
"count"
],
"additionalProperties": false
},
"type_struct": {
"properties": {
"kind": {
"type": "string",
"pattern": "^(struct|class|union)$"
},
"name": {
"type": "string"
}
},
"required": [
"kind",
"name"
],
"additionalProperties": false
},
"type_enum": {
"properties": {
"kind": {
"type": "string",
"pattern": "^enum$"
},
"name": {
"type": "string"
}
},
"required": [
"kind",
"name"
],
"additionalProperties": false
},
"type_function": {
"properties": {
"kind": {
"type": "string",
"pattern": "^function$"
}
},
"required": [
"kind"
],
"additionalProperties": false
},
"type_bitfield": {
"properties": {
"kind": {
"type": "string",
"pattern": "^bitfield$"
},
"bit_position": {
"type": "integer"
},
"bit_length": {
"type": "integer"
},
"type": {
"oneOf": [
{
"$ref": "#/definitions/type_base"
},
{
"$ref": "#/definitions/type_enum"
}
]
}
},
"required": [
"kind",
"bit_position",
"bit_length",
"type"
],
"additionalProperties": false
}
},
"properties": {
"metadata": {
"$ref": "#/definitions/element_metadata"
},
"base_types": {
"additionalProperties": {
"$ref": "#/definitions/element_base_type"
}
},
"user_types": {
"additionalProperties": {
"$ref": "#/definitions/element_user_type"
}
},
"enums": {
"additionalProperties": {
"$ref": "#/definitions/element_enum"
}
},
"symbols": {
"additionalProperties": {
"$ref": "#/definitions/element_symbol"
}
}
},
"required": [
"metadata",
"base_types",
"user_types",
"enums",
"symbols"
],
"additionalProperties": false
}