mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-12 04:37:38 +02:00
Add in additional PrimativeTypes.
This commit is contained in:
@@ -4,15 +4,42 @@ Created on 17 Feb 2013
|
||||
@author: mike
|
||||
'''
|
||||
|
||||
import struct
|
||||
|
||||
class ObjectInterface(object):
|
||||
""" A base object required to be the ancestor of every object used in volatility """
|
||||
def __init__(self, context, offset, layer_name):
|
||||
def __init__(self, context, symbol_name, offset, layer_name):
|
||||
self._context = context
|
||||
self._offset = offset
|
||||
self._layer_name = layer_name
|
||||
self._symbol_name = symbol_name
|
||||
|
||||
class IntegerObject(ObjectInterface, int):
|
||||
class PrimativeObject(ObjectInterface):
|
||||
"""PrimativeObject is an interface for any objects that should simulate a Python primative"""
|
||||
|
||||
def __new__(cls, context, offset, layer_name):
|
||||
@classmethod
|
||||
def _struct_value(cls, struct_format, context, symbol_name, offset, layer_name):
|
||||
aspace = context.get_address_space(layer_name)
|
||||
aspace.read(offset)
|
||||
length = struct.calcsize(struct_format)
|
||||
data = aspace.read(offset, length)
|
||||
(value,) = struct.unpack(struct_format, data)
|
||||
return value
|
||||
|
||||
class IntegerObject(PrimativeObject, int):
|
||||
|
||||
def __new__(cls, context, symbol_name, offset, layer_name):
|
||||
struct_format = context.get_primative_struct_type("int", symbol_name)
|
||||
return cls._struct_value(struct_format, context, symbol_name, offset, layer_name)
|
||||
|
||||
|
||||
class FloatObject(PrimativeObject, float):
|
||||
|
||||
def __new__(cls, context, symbol_name, offset, layer_name):
|
||||
struct_format = context.get_primative_struct_type("float", symbol_name)
|
||||
return cls._struct_value(struct_format, context, symbol_name, offset, layer_name)
|
||||
|
||||
class StringObject(PrimativeObject, str):
|
||||
#TODO: Make this inherit from bytestr rather than str
|
||||
|
||||
def __new__(cls, context, symbol_name, offset, layer_name, length = 1):
|
||||
return cls._struct_value(str(length) + "s", context, symbol_name, offset, layer_name)
|
||||
|
||||
Reference in New Issue
Block a user