From ac1d99677dfc30daa5bdd7016d9e86758036ed26 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 27 Jun 2020 18:30:37 +0100 Subject: [PATCH] ISF: Support deprecating versions --- volatility/framework/constants/__init__.py | 5 +++++ volatility/framework/symbols/intermed.py | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/volatility/framework/constants/__init__.py b/volatility/framework/constants/__init__.py index 025daec2e..6b87de8b0 100644 --- a/volatility/framework/constants/__init__.py +++ b/volatility/framework/constants/__init__.py @@ -84,3 +84,8 @@ class Parallelism(enum.IntEnum): PARALLELISM = Parallelism.Off """Default value to the parallelism setting used throughout volatility""" + +ISF_MINIMUM_SUPPORTED = (2, 0, 0) +"""The minimum supported version of the Intermediate Symbol Format""" +ISF_MINIMUM_DEPRECATED = (3, 9, 9) +"""The highest version of the ISF that's deprecated (usually higher than supported)""" diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 245427159..9ae560ac2 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -120,6 +120,11 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): self._delegate = self._closest_version(metadata.get('format', "0.0.0"), self._versions)(context, config_path, name, json_object, native_types, table_mapping) + if self._delegate.version < constants.ISF_MINIMUM_SUPPORTED: + raise RuntimeError("ISF version {} is no longer supported: {}".format(metadata.get('format', "0.0.0"), + isf_url)) + elif self._delegate.version < constants.ISF_MINIMUM_DEPRECATED: + vollog.warning("ISF version {} has been deprecated: {}".format(metadata.get('format', "0.0.0"), isf_url)) # Inherit super().__init__(context,