diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index d788be6a4..50aa19697 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -8,6 +8,7 @@ import collections import struct from volatility.framework import interfaces +from volatility.framework.interfaces.objects import ObjectInformation from volatility.framework.objects import templates @@ -83,15 +84,25 @@ class Bytes(PrimitiveObject, bytes): """Primitive Object that handles specific series of bytes""" _struct_type = bytes - def __init__(self, context, structure_name, object_info, struct_format, length = 1): - self._struct_format = str(length) + 's' - PrimitiveObject.__init__(self, - context, - structure_name = structure_name, - object_info = object_info, - struct_format = struct_format) + def __init__(self, context, structure_name, object_info, length = 1): + interfaces.objects.ObjectInterface.__init__(self, + context = context, + structure_name = structure_name, + object_info = object_info, + struct_format = str(length) + "s") self._vol['length'] = length + def __new__(cls, context, structure_name, object_info, **kwargs): + """Creates the appropriate class and returns it so that the native type is inherritted + + The only reason the **kwargs is added, is so that the inherriting types can override __init__ + without needing to override __new__""" + return bytes.__new__(cls, + cls._struct_value(context, + struct_format = str(kwargs["length"]) + "s", + layer_name = object_info.layer_name, + offset = object_info.offset)) + # TODO: Fix up strings unpacking to include an encoding class String(PrimitiveObject, str): diff --git a/volatility/framework/symbols/native.py b/volatility/framework/symbols/native.py index 92c2f7c16..0a593696a 100644 --- a/volatility/framework/symbols/native.py +++ b/volatility/framework/symbols/native.py @@ -20,7 +20,7 @@ class NativeTable(interfaces.symbols.NativeTableInterface): self._overrides[native_type] = native_class # Create this once early, because it may get used a lot self._structures = set(self._native_dictionary).union( - {'Enumeration', 'array', 'BitField', 'void', 'pointer'}) + {'Enumeration', 'array', 'BitField', 'void', 'pointer', 'String', 'Bytes'}) def get_structure_class(self, name): ntype, fmt = native_types.get(name, (objects.Integer, ''))