diff --git a/volatility/framework/automagic/linux_symbol_cache.py b/volatility/framework/automagic/linux_symbol_cache.py index d4f7b91c3..8c5bd7f30 100644 --- a/volatility/framework/automagic/linux_symbol_cache.py +++ b/volatility/framework/automagic/linux_symbol_cache.py @@ -64,7 +64,7 @@ class LinuxSymbolCache(interfaces.automagic.AutomagicInterface): try: # Loading the symbol table will be very slow until it's been validated - isf = intermed.IntermediateSymbolTable(context, config_path, "temp", isf_url) + isf = intermed.IntermediateSymbolTable(context, config_path, "temp", isf_url, validate = False) # We should store the banner against the filename # We don't bother with the hash (it'll likely take too long to validate) diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 4ab96a19d..84f896759 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -51,12 +51,29 @@ def _construct_delegate_function(name, is_property = False): class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): - def __init__(self, context, config_path, name, isf_filepath, native_types = None): + def __init__(self, context, config_path, name, isf_filepath, native_types = None, validate = True): + """Instantiates an SymbolTable based on an IntermediateSymbolFormat JSON file. This is validated against the + appropriate schema. The validation can be disabled by passing validate = False, but this should almost never be + done. + + :param context: + :type context: + :param config_path: + :type config_path: + :param name: + :type name: + :param isf_filepath: + :type isf_filepath: + :param native_types: + :type native_types: + :param validate: Determines whether the ISF file will be validated against the appropriate schema + :type validate: bool + """ # Check there are no obvious errors url = urllib.parse.urlparse(isf_filepath) if url.scheme != 'file': raise NotImplementedError( - "This scheme is not yet implement for the Intermediate Symbol Format: {}".format(url.scheme)) + "This scheme is not yet implemented for the Intermediate Symbol Format: {}".format(url.scheme)) # Open the file and test the version self._versions = dict([(x.version, x) for x in class_subclasses(ISFormatTable)]) @@ -69,7 +86,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): fp.close() # Validation is expensive, but we cache to store the hashes of successfully validated json objects - if not schemas.validate(json_object): + if validate and not schemas.validate(json_object): raise SymbolSpaceError("File does not pass version validation: {}".format(url.geturl())) metadata = json_object.get('metadata', None)