WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-29 03:09:48 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add support for separate symbol_tables and name in Modules.

Browse Source
This commit is contained in:
Mike Auty
2018-06-21 00:25:55 +01:00
parent d68d62e47d
commit aedcf40fc2
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/contexts/__init__.py
+3 -3
View File
@@ -135,7 +135,7 @@ class Module(interfaces.context.Module):
self._check_type(symbol_name, str)
if constants.BANG in symbol_name:
raise ValueError("Symbol_name cannot reference another module")
symbol = self._context.symbol_space.get_symbol(self._module_name + constants.BANG + symbol_name)
symbol = self._context.symbol_space.get_symbol(self.symbol_table + constants.BANG + symbol_name)
if symbol.type is None:
raise ValueError("Symbol {} has no associated type information".format(symbol.name))
type_arg = symbol.type
@@ -145,7 +145,7 @@ class Module(interfaces.context.Module):
self._check_type(offset, int)
if constants.BANG in type_name:
raise ValueError("Type_name cannot reference another module")
type_arg = self._module_name + constants.BANG + type_name
type_arg = self.symbol_table + constants.BANG + type_name
else:
raise ValueError("One of symbol_name, or type_name & offset, must be specified to construct a module")
# Ensure we don't use a layer_name other than the module's, why would anyone do that?
@@ -163,7 +163,7 @@ class Module(interfaces.context.Module):
def get_symbols_by_absolute_location(self, offset: int):
"""Returns the symbols at a specified absolute location """
return self._context.symbol_space.get_symbols_by_location(offset = offset - self._offset,
table_name = self.name)
table_name = self.symbol_table)
class ModuleCollection(validity.ValidityRoutines):
volatility/framework/interfaces/context.py
+3 -1
View File
@@ -91,11 +91,13 @@ class Module(validity.ValidityRoutines, metaclass = ABCMeta):
context: ContextInterface,
module_name: str,
layer_name: str,
offset: int) -> None:
offset: int,
symbol_table: typing.Optional[str] = None) -> None:
self._context = self._check_type(context, ContextInterface)
self._module_name = self._check_type(module_name, str)
self._layer_name = self._check_type(layer_name, str)
self._offset = self._check_type(offset, int)
self.symbol_table = symbol_table or self._module_name
super().__init__()
@property