diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index 3a09e74c5..783443464 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -28,6 +28,14 @@ class Void(interfaces.objects.ObjectInterface): def template_replace_child(cls, old_child, new_child, arguments): """Dummy method that does nothing for Void objects""" + @classmethod + def template_relative_child_offset(cls, arguments, child): + """Dummy method that does nothing for Void objects""" + + def write(self, value): + """Dummy method that does nothing for Void objects""" + raise TypeError("Cannot write data to a void, recast as another object") + class PrimitiveObject(interfaces.objects.ObjectInterface): """PrimitiveObject is an interface for any objects that should simulate a Python primitive""" @@ -63,6 +71,10 @@ class PrimitiveObject(interfaces.objects.ObjectInterface): def template_replace_child(cls, old_child, new_child, arguments): """Since this template can't ever have children, this method can be empty""" + @classmethod + def template_relative_child_offset(cls, arguments, child): + """Since this template can't ever have children, this method can be empty as well""" + class Integer(PrimitiveObject, int): """Primitive Object that handles standard numeric types""" @@ -263,6 +275,13 @@ class Array(interfaces.objects.ObjectInterface, collections.Sequence): if arguments['target'] == old_child: arguments['target'] = new_child + @classmethod + def template_relative_child_offset(cls, arguments, child): + """Returns the relative offset from the head of the parent data to the child member""" + if 'target' in arguments and child == 'target': + return 0 + raise IndexError("Member " + child + " not present in array template") + def __getitem__(self, i): """Returns the i-th item from the array""" if i >= self._count or 0 > i: