From 8e334ca086399792943b71541dd55538151ff2c3 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 25 Dec 2016 18:37:54 +0000 Subject: [PATCH] Remove fallthrough/default natives from symbol_spaces. --- volatility/framework/contexts/__init__.py | 4 ++-- volatility/framework/symbols/__init__.py | 21 +-------------------- 2 files changed, 3 insertions(+), 22 deletions(-) diff --git a/volatility/framework/contexts/__init__.py b/volatility/framework/contexts/__init__.py index 3fb925195..e45f3db2e 100644 --- a/volatility/framework/contexts/__init__.py +++ b/volatility/framework/contexts/__init__.py @@ -13,7 +13,7 @@ class Context(interfaces.context.ContextInterface): for creating new objects. """ - def __init__(self, natives = symbols.native.x86NativeTable): + def __init__(self): """Initializes the context. This initializes the context and provides a default set of native types for the empty symbol space. @@ -22,7 +22,7 @@ class Context(interfaces.context.ContextInterface): :type natives: interfaces.symbols.NativeTableInterface """ super().__init__() - self._symbol_space = symbols.SymbolSpace(natives) + self._symbol_space = symbols.SymbolSpace() self._memory = interfaces.layers.Memory() self._config = HierarchicalDict() diff --git a/volatility/framework/symbols/__init__.py b/volatility/framework/symbols/__init__.py index db883a254..77869dc0b 100644 --- a/volatility/framework/symbols/__init__.py +++ b/volatility/framework/symbols/__init__.py @@ -28,11 +28,8 @@ class SymbolSpace(collections.abc.Mapping): proceed down through the ranks if a namespace isn't specified. """ - def __init__(self, native_types = None): - if not isinstance(native_types, interfaces.symbols.NativeTableInterface): - raise TypeError("SymbolSpace native_types must be NativeSymbolInterface") + def __init__(self): self._dict = collections.OrderedDict() - self._native_types = native_types # Permanently cache all resolved symbols self._resolved = {} @@ -56,20 +53,6 @@ class SymbolSpace(collections.abc.Mapping): for symbol_name in self._dict[table].get_symbols_by_location(address = address): yield table + constants.BANG + symbol_name - ### Native functions - - @property - def natives(self): - """Returns the native_types for this symbol space""" - return self._native_types - - @natives.setter - def natives(self, native_types): - if native_types is not None: - vollog.warning( - "Resetting the native type can cause have drastic effects on memory analysis using this space") - self._native_types = native_types - ### Space functions def __len__(self): @@ -134,8 +117,6 @@ class SymbolSpace(collections.abc.Mapping): return getattr(self._dict[table_name], get_function)(component_name) except (exceptions.SymbolError, KeyError): return self._UnresolvedTemplate(name) - elif name in self.natives.types: - return getattr(self.natives, get_function)(name) raise exceptions.SymbolError("Malformed name: {}".format(name)) def get_type(self, type_name):