diff --git a/volatility3/framework/automagic/symbol_finder.py b/volatility3/framework/automagic/symbol_finder.py index 55e2ad6f5..6d689e194 100644 --- a/volatility3/framework/automagic/symbol_finder.py +++ b/volatility3/framework/automagic/symbol_finder.py @@ -161,27 +161,29 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface): ] = layer.address_mask # Keep track of the existing table names so we know which ones were added - old_table_names = set(context.symbol_space._dict) + old_table_names = set(context.symbol_space) # Construct the appropriate symbol table requirement.construct(context, config_path) - new_table_names = context.symbol_space._dict.keys() - old_table_names + new_table_names = set(context.symbol_space) - old_table_names # It should add only one symbol table. Ignore the next steps if it doesn't if len(new_table_names) == 1: new_table_name = new_table_names.pop() - symbol_table = context.symbol_space._dict[new_table_name] - producer = symbol_table.producer + symbol_table = context.symbol_space[new_table_name] + producer_metadata = symbol_table.producer vollog.debug( - f"producer_name: {producer.name}, producer_version: {producer.version_string}" + f"producer_name: {producer_metadata.name}, producer_version: {producer_metadata.version_string}" ) - for category in symbol_table.metadata._json_data: - vollog.debug(f"{category}:") - for subkey in symbol_table.metadata._json_data[category]: - subkey_item = ", ".join( - f"{key}: '{value}'" for key, value in subkey.items() - ) - vollog.debug(f"\t{subkey_item}") + + symbol_metadata = symbol_table.metadata + vollog.debug("Types:") + for types_source_dict in symbol_metadata.get_types_sources(): + vollog.debug(f"\t{types_source_dict}") + + vollog.debug("Symbols:") + for symbol_source_dict in symbol_metadata.get_symbols_sources(): + vollog.debug(f"\t{symbol_source_dict}") break else: diff --git a/volatility3/framework/symbols/metadata.py b/volatility3/framework/symbols/metadata.py index 39ddd6544..02e9cc489 100644 --- a/volatility3/framework/symbols/metadata.py +++ b/volatility3/framework/symbols/metadata.py @@ -4,8 +4,7 @@ import datetime import logging -from typing import Optional, Tuple, Union - +from typing import Optional, Tuple, Union, List, Dict from volatility3.framework import constants, interfaces vollog = logging.getLogger(__name__) @@ -86,9 +85,21 @@ class WindowsMetadata(interfaces.symbols.MetadataInterface): return self._json_data.get("pdb", {}).get("age", None) -class LinuxMetadata(interfaces.symbols.MetadataInterface): +class DwarfMetadata(interfaces.symbols.MetadataInterface): + """Base class to handle metadata of DWARF-based ISF sources""" + + def get_types_sources(self) -> List[Optional[Dict]]: + """Returns the types sources metadata""" + return self._json_data.get("types", []) + + def get_symbols_sources(self) -> List[Optional[Dict]]: + """Returns the symbols sources metadata""" + return self._json_data.get("symbols", []) + + +class LinuxMetadata(DwarfMetadata): """Class to handle the metadata from a Linux symbol table.""" -class MacMetadata(interfaces.symbols.MetadataInterface): +class MacMetadata(DwarfMetadata): """Class to handle the metadata from a Mac symbol table."""