From 8db3adae05cb0e28d9507c16fe172734b92fee48 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 30 Jul 2016 00:38:53 +0100 Subject: [PATCH] Update the scanner interface to return all kind of objects. This one's slightly contencious, in that scanner now don't all return a uniform value, and therefore nothing can simply run through scanners. Worst case scenario we make a separate stricter interface that says it only returns offsets which will then allow things that need it to dynamically find them, but it's probably too useful to be able to return arbitrary objects of a type (as long as the objects returned are always of that type). --- volatility/framework/interfaces/layers.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/interfaces/layers.py b/volatility/framework/interfaces/layers.py index b5f9197ed..b0479e28c 100644 --- a/volatility/framework/interfaces/layers.py +++ b/volatility/framework/interfaces/layers.py @@ -55,7 +55,7 @@ class ScannerInterface(validity.ValidityRoutines, metaclass = ABCMeta): @abstractmethod def __call__(self, data, data_offset): """Searches through a chunk of data for a particular value/pattern/etc - Returns the ABSOLUTE offset (ie, offset_within_data + data_offset) + Always returns an iterator of the same type of object (need not be a volatility object) data is the chunk of data to search through data_offset is the offset within the layer that the data being searched starts at