mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-07 10:17:38 +02:00
Linux/Mac: Address code review suggestions
- Add getters for Linux/Mac ISF sources - Avoid using internal attributes - Use the dict repr instead of walking the dict to simplify code
This commit is contained in:
@@ -161,27 +161,29 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface):
|
||||
] = layer.address_mask
|
||||
|
||||
# Keep track of the existing table names so we know which ones were added
|
||||
old_table_names = set(context.symbol_space._dict)
|
||||
old_table_names = set(context.symbol_space)
|
||||
|
||||
# Construct the appropriate symbol table
|
||||
requirement.construct(context, config_path)
|
||||
|
||||
new_table_names = context.symbol_space._dict.keys() - old_table_names
|
||||
new_table_names = set(context.symbol_space) - old_table_names
|
||||
# It should add only one symbol table. Ignore the next steps if it doesn't
|
||||
if len(new_table_names) == 1:
|
||||
new_table_name = new_table_names.pop()
|
||||
symbol_table = context.symbol_space._dict[new_table_name]
|
||||
producer = symbol_table.producer
|
||||
symbol_table = context.symbol_space[new_table_name]
|
||||
producer_metadata = symbol_table.producer
|
||||
vollog.debug(
|
||||
f"producer_name: {producer.name}, producer_version: {producer.version_string}"
|
||||
f"producer_name: {producer_metadata.name}, producer_version: {producer_metadata.version_string}"
|
||||
)
|
||||
for category in symbol_table.metadata._json_data:
|
||||
vollog.debug(f"{category}:")
|
||||
for subkey in symbol_table.metadata._json_data[category]:
|
||||
subkey_item = ", ".join(
|
||||
f"{key}: '{value}'" for key, value in subkey.items()
|
||||
)
|
||||
vollog.debug(f"\t{subkey_item}")
|
||||
|
||||
symbol_metadata = symbol_table.metadata
|
||||
vollog.debug("Types:")
|
||||
for types_source_dict in symbol_metadata.get_types_sources():
|
||||
vollog.debug(f"\t{types_source_dict}")
|
||||
|
||||
vollog.debug("Symbols:")
|
||||
for symbol_source_dict in symbol_metadata.get_symbols_sources():
|
||||
vollog.debug(f"\t{symbol_source_dict}")
|
||||
|
||||
break
|
||||
else:
|
||||
|
||||
@@ -4,8 +4,7 @@
|
||||
|
||||
import datetime
|
||||
import logging
|
||||
from typing import Optional, Tuple, Union
|
||||
|
||||
from typing import Optional, Tuple, Union, List, Dict
|
||||
from volatility3.framework import constants, interfaces
|
||||
|
||||
vollog = logging.getLogger(__name__)
|
||||
@@ -86,9 +85,21 @@ class WindowsMetadata(interfaces.symbols.MetadataInterface):
|
||||
return self._json_data.get("pdb", {}).get("age", None)
|
||||
|
||||
|
||||
class LinuxMetadata(interfaces.symbols.MetadataInterface):
|
||||
class DwarfMetadata(interfaces.symbols.MetadataInterface):
|
||||
"""Base class to handle metadata of DWARF-based ISF sources"""
|
||||
|
||||
def get_types_sources(self) -> List[Optional[Dict]]:
|
||||
"""Returns the types sources metadata"""
|
||||
return self._json_data.get("types", [])
|
||||
|
||||
def get_symbols_sources(self) -> List[Optional[Dict]]:
|
||||
"""Returns the symbols sources metadata"""
|
||||
return self._json_data.get("symbols", [])
|
||||
|
||||
|
||||
class LinuxMetadata(DwarfMetadata):
|
||||
"""Class to handle the metadata from a Linux symbol table."""
|
||||
|
||||
|
||||
class MacMetadata(interfaces.symbols.MetadataInterface):
|
||||
class MacMetadata(DwarfMetadata):
|
||||
"""Class to handle the metadata from a Mac symbol table."""
|
||||
|
||||
Reference in New Issue
Block a user