mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-25 07:32:23 +02:00
Initial attempt at resolving anonymoous fields.
This commit is contained in:
Mike Auty
@@ -593,3 +593,49 @@ class Version6Format(Version5Format):
|
||||
class Version7Format(Version6Format):
|
||||
"""Class for storing intermediate debugging data as objects and classes."""
|
||||
version = (6, 1, 0)
|
||||
|
||||
|
||||
class Version8Format(Version7Format):
|
||||
"""Class for storing intermediate debugging data as objects and classes."""
|
||||
version = (6, 2, 0)
|
||||
|
||||
def _reduce_indirect_members(self, members: Dict[str, Dict[str, Any]]) -> Dict[str, Dict[str, Any]]:
|
||||
result = {}
|
||||
for member in members:
|
||||
if members[member].get('anonymous', False):
|
||||
# Do checks to make sure the new dictionary is appropriate
|
||||
parent_item = members[member]
|
||||
submembers = self._reduce_indirect_members(self._json_object['user_types'].get(parent_item['type'], {}))
|
||||
for item in submembers:
|
||||
result[item] = submembers[item].copy()
|
||||
result[item]['offset'] = submembers[item]['offset'] + parent_item.get('offset', 0)
|
||||
else:
|
||||
result[member] = members[member]
|
||||
return result
|
||||
|
||||
def get_type(self, type_name: str) -> interfaces.objects.Template:
|
||||
"""Resolves an individual symbol."""
|
||||
if constants.BANG in type_name:
|
||||
index = type_name.find(constants.BANG)
|
||||
table_name, type_name = type_name[:index], type_name[index + 1:]
|
||||
raise exceptions.SymbolError(
|
||||
type_name, table_name,
|
||||
"Symbol for a different table requested: {}".format(table_name + constants.BANG + type_name))
|
||||
if type_name not in self._json_object['user_types']:
|
||||
# Fall back to the natives table
|
||||
return self.natives.get_type(self.name + constants.BANG + type_name)
|
||||
curdict = self._json_object['user_types'][type_name]
|
||||
members = {}
|
||||
for member_name in curdict['fields']:
|
||||
interdict = self._reduce_indirect_members(curdict['fields'][member_name])
|
||||
member = (interdict['offset'], self._interdict_to_template(interdict['type']))
|
||||
members[member_name] = member
|
||||
object_class = self.get_type_class(type_name)
|
||||
if object_class == objects.AggregateType:
|
||||
for clazz in objects.AggregateTypes:
|
||||
if objects.AggregateTypes[clazz] == curdict['kind']:
|
||||
object_class = clazz
|
||||
return objects.templates.ObjectTemplate(type_name = self.name + constants.BANG + type_name,
|
||||
object_class = object_class,
|
||||
size = curdict['length'],
|
||||
members = members)
|
||||
|
||||
@@ -0,0 +1,453 @@
|
||||
{
|
||||
"$schema": "http://json-schema.org/schema#",
|
||||
"id": "http://volatilityfoundation.org/intermediate-format/schema",
|
||||
"title": "Symbol Container",
|
||||
"type": "object",
|
||||
"definitions": {
|
||||
"metadata_producer": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
},
|
||||
"datetime": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
}
|
||||
}
|
||||
},
|
||||
"metadata_windows_pe": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"major": {
|
||||
"type": "integer"
|
||||
},
|
||||
"minor": {
|
||||
"type": "integer"
|
||||
},
|
||||
"revision": {
|
||||
"type": "integer"
|
||||
},
|
||||
"build": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"additionalProperties": false,
|
||||
"required": [
|
||||
"major",
|
||||
"minor",
|
||||
"revision"
|
||||
]
|
||||
},
|
||||
"metadata_windows_pdb": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"GUID": {
|
||||
"type": "string"
|
||||
},
|
||||
"age": {
|
||||
"type": "integer"
|
||||
},
|
||||
"database": {
|
||||
"type": "string"
|
||||
},
|
||||
"machine_type": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"additionalProperties": false,
|
||||
"required": [
|
||||
"GUID",
|
||||
"age",
|
||||
"database",
|
||||
"machine_type"
|
||||
]
|
||||
},
|
||||
"metadata_windows": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"pe": {
|
||||
"$ref": "#/definitions/metadata_windows_pe"
|
||||
},
|
||||
"pdb": {
|
||||
"$ref": "#/definitions/metadata_windows_pdb"
|
||||
}
|
||||
},
|
||||
"additionalProperties": false
|
||||
},
|
||||
"metadata_linux": {
|
||||
"type": "object",
|
||||
"$comment": "Reserved for future use"
|
||||
},
|
||||
"metadata_format": {
|
||||
"type": "string",
|
||||
"pattern": "^6.[0-9]+.[0-9]+$"
|
||||
},
|
||||
"metadata_source": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"type": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"element_metadata": {
|
||||
"type": "object",
|
||||
"oneOf": [
|
||||
{
|
||||
"properties": {
|
||||
"format": {
|
||||
"$ref": "#/definitions/metadata_format"
|
||||
},
|
||||
"producer": {
|
||||
"$ref": "#/definitions/metadata_producer"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"format"
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
{
|
||||
"properties": {
|
||||
"format": {
|
||||
"$ref": "#/definitions/metadata_format"
|
||||
},
|
||||
"producer": {
|
||||
"$ref": "#/definitions/metadata_producer"
|
||||
},
|
||||
"windows": {
|
||||
"$ref": "#/definitions/metadata_windows"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"format",
|
||||
"windows"
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
{
|
||||
"properties": {
|
||||
"format": {
|
||||
"$ref": "#/definitions/metadata_format"
|
||||
},
|
||||
"producer": {
|
||||
"$ref": "#/definitions/metadata_producer"
|
||||
},
|
||||
"linux": {
|
||||
"$ref": "#/definitions/metadata_linux"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"format",
|
||||
"linux"
|
||||
],
|
||||
"additionalProperties": false
|
||||
}
|
||||
]
|
||||
},
|
||||
"element_enum": {
|
||||
"properties": {
|
||||
"size": {
|
||||
"type": "integer"
|
||||
},
|
||||
"base": {
|
||||
"type": "string"
|
||||
},
|
||||
"constants": {
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "integer"
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"size",
|
||||
"base",
|
||||
"constants"
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"element_symbol": {
|
||||
"properties": {
|
||||
"address": {
|
||||
"type": "number"
|
||||
},
|
||||
"linkage_name": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"$ref": "#/definitions/type_descriptor"
|
||||
},
|
||||
"constant_data": {
|
||||
"type": "string",
|
||||
"media": {
|
||||
"binaryEncoding": "base64",
|
||||
"readOnly": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"address"
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"element_base_type": {
|
||||
"properties": {
|
||||
"size": {
|
||||
"type": "integer"
|
||||
},
|
||||
"signed": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"kind": {
|
||||
"type": "string",
|
||||
"pattern": "^(void|int|float|char|bool)$"
|
||||
},
|
||||
"endian": {
|
||||
"type": "string",
|
||||
"pattern": "^(little|big)$"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"size",
|
||||
"kind",
|
||||
"signed",
|
||||
"endian"
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"element_user_type": {
|
||||
"properties": {
|
||||
"kind": {
|
||||
"type": "string",
|
||||
"pattern": "^(struct|union|class)$"
|
||||
},
|
||||
"size": {
|
||||
"type": "integer"
|
||||
},
|
||||
"fields": {
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"$ref": "#/definitions/field"
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind",
|
||||
"size",
|
||||
"fields"
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"field": {
|
||||
"properties": {
|
||||
"type": {
|
||||
"$ref": "#/definitions/type_descriptor"
|
||||
},
|
||||
"offset": {
|
||||
"type": "integer"
|
||||
},
|
||||
"anonymous": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"type",
|
||||
"offset"
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type_descriptor": {
|
||||
"oneOf": [
|
||||
{
|
||||
"$ref": "#/definitions/type_pointer"
|
||||
},
|
||||
{
|
||||
"$ref": "#/definitions/type_base"
|
||||
},
|
||||
{
|
||||
"$ref": "#/definitions/type_array"
|
||||
},
|
||||
{
|
||||
"$ref": "#/definitions/type_struct"
|
||||
},
|
||||
{
|
||||
"$ref": "#/definitions/type_enum"
|
||||
},
|
||||
{
|
||||
"$ref": "#/definitions/type_function"
|
||||
},
|
||||
{
|
||||
"$ref": "#/definitions/type_bitfield"
|
||||
}
|
||||
]
|
||||
},
|
||||
"type_pointer": {
|
||||
"properties": {
|
||||
"kind": {
|
||||
"type": "string",
|
||||
"pattern": "^pointer$"
|
||||
},
|
||||
"base": {
|
||||
"type": "string"
|
||||
},
|
||||
"subtype": {
|
||||
"$ref": "#/definitions/type_descriptor"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind",
|
||||
"subtype"
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type_base": {
|
||||
"properties": {
|
||||
"kind": {
|
||||
"type": "string",
|
||||
"pattern": "^base$"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type_array": {
|
||||
"properties": {
|
||||
"kind": {
|
||||
"type": "string",
|
||||
"pattern": "^array$"
|
||||
},
|
||||
"subtype": {
|
||||
"$ref": "#/definitions/type_descriptor"
|
||||
},
|
||||
"count": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind",
|
||||
"subtype",
|
||||
"count"
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type_struct": {
|
||||
"properties": {
|
||||
"kind": {
|
||||
"type": "string",
|
||||
"pattern": "^(struct|class|union)$"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type_enum": {
|
||||
"properties": {
|
||||
"kind": {
|
||||
"type": "string",
|
||||
"pattern": "^enum$"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type_function": {
|
||||
"properties": {
|
||||
"kind": {
|
||||
"type": "string",
|
||||
"pattern": "^function$"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind"
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type_bitfield": {
|
||||
"properties": {
|
||||
"kind": {
|
||||
"type": "string",
|
||||
"pattern": "^bitfield$"
|
||||
},
|
||||
"bit_position": {
|
||||
"type": "integer"
|
||||
},
|
||||
"bit_length": {
|
||||
"type": "integer"
|
||||
},
|
||||
"type": {
|
||||
"oneOf": [
|
||||
{
|
||||
"$ref": "#/definitions/type_base"
|
||||
},
|
||||
{
|
||||
"$ref": "#/definitions/type_enum"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind",
|
||||
"bit_position",
|
||||
"bit_length",
|
||||
"type"
|
||||
],
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"properties": {
|
||||
"metadata": {
|
||||
"$ref": "#/definitions/element_metadata"
|
||||
},
|
||||
"base_types": {
|
||||
"additionalProperties": {
|
||||
"$ref": "#/definitions/element_base_type"
|
||||
}
|
||||
},
|
||||
"user_types": {
|
||||
"additionalProperties": {
|
||||
"$ref": "#/definitions/element_user_type"
|
||||
}
|
||||
},
|
||||
"enums": {
|
||||
"additionalProperties": {
|
||||
"$ref": "#/definitions/element_enum"
|
||||
}
|
||||
},
|
||||
"symbols": {
|
||||
"additionalProperties": {
|
||||
"$ref": "#/definitions/element_symbol"
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"metadata",
|
||||
"base_types",
|
||||
"user_types",
|
||||
"enums",
|
||||
"symbols"
|
||||
],
|
||||
"additionalProperties": false
|
||||
}
|
||||
Reference in New Issue
Block a user