WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 11:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refactor symbol to object_type (so it doesn't shadow builtin type).

Browse Source
This commit is contained in:
Mike Auty
2019-08-14 20:50:42 +01:00
committed by ikelos
parent 18283ab410
commit be27aab8ae
27 changed files with 89 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/cli/volshell/windows.py
+2 -2
View File
@@ -44,7 +44,7 @@ class Volshell(shellplugin.Volshell):
ntkrnlmp = self.context.module(self.config['nt_symbols'], layer_name = layer_name, offset = kvo)
ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address
list_entry = ntkrnlmp.object(symbol = "_LIST_ENTRY", offset = ps_aph_offset)
list_entry = ntkrnlmp.object(object_type = "_LIST_ENTRY", offset = ps_aph_offset)
# This is example code to demonstrate how to use symbol_space directly, rather than through a module:
#
@@ -58,7 +58,7 @@ class Volshell(shellplugin.Volshell):
# having been present. Strictly, the value of the requirement should be joined with the BANG character
# defined in the constants file
reloff = ntkrnlmp.get_type("_EPROCESS").relative_child_offset("ActiveProcessLinks")
eproc = ntkrnlmp.object(symbol = "_EPROCESS", offset = list_entry.vol.offset - reloff, absolute = True)
eproc = ntkrnlmp.object(object_type = "_EPROCESS", offset = list_entry.vol.offset - reloff, absolute = True)
for proc in eproc.ActiveProcessLinks:
yield proc
volatility/framework/automagic/linux.py
+1 -1
View File
@@ -303,7 +303,7 @@ class LinuxUtilities(object):
progress_callback = progress_callback):
task_symbol = module.get_type('task_struct')
init_task_address = offset - task_symbol.relative_child_offset('comm')
init_task = module.object(symbol = 'task_struct', offset = init_task_address, absolute = True)
init_task = module.object(object_type = 'task_struct', offset = init_task_address, absolute = True)
if init_task.pid != 0:
continue
elif init_task.has_member('state') and init_task.state.cast('unsigned int') != 0:
volatility/framework/contexts/__init__.py
+19 -16
View File
@@ -90,7 +90,7 @@ class Context(interfaces.context.ContextInterface):
# ## Object Factory Functions
def object(self,
symbol: Union[str, interfaces.objects.Template],
object_type: Union[str, interfaces.objects.Template],
layer_name: str,
offset: int,
native_layer_name: Optional[str] = None,
@@ -101,7 +101,7 @@ class Context(interfaces.context.ContextInterface):
and constructs an object using the object template on the layer at the offset.
Args:
symbol: The name (or template) of the symbol type on which to construct the object. If this is a name, it should contain an explicit table name.
object_type: The name (or template) of the symbol type on which to construct the object. If this is a name, it should contain an explicit table name.
layer_name: The name of the layer on which to construct the object
offset: The offset within the layer at which the data used to create the object lives
@@ -109,13 +109,13 @@ class Context(interfaces.context.ContextInterface):
Returns:
A fully constructed object
"""
if not isinstance(symbol, interfaces.objects.Template):
if not isinstance(object_type, interfaces.objects.Template):
try:
object_template = self._symbol_space.get_type(symbol)
object_template = self._symbol_space.get_type(object_type)
except exceptions.SymbolError:
object_template = self._symbol_space.get_enumeration(symbol)
object_template = self._symbol_space.get_enumeration(object_type)
else:
object_template = symbol
object_template = object_type
# Ensure that if a pre-constructed type is provided we just instantiate it
arguments.update(object_template.vol)
@@ -170,7 +170,7 @@ def get_module_wrapper(method: str) -> Callable:
class Module(interfaces.context.ModuleInterface):
def object(self,
symbol: str,
object_type: str,
offset: int = None,
native_layer_name: Optional[str] = None,
absolute: bool = False,
@@ -178,12 +178,12 @@ class Module(interfaces.context.ModuleInterface):
"""Returns an object created using the symbol_table_name and layer_name of the Module
Args:
symbol: Name of the type/symbol/enumeration (within the module) to construct
object_type: Name of the type/symbol/enumeration (within the module) to construct
offset: The location of the object, ignored when symbol_type is SYMBOL
native_layer_name: Name of the layer in which constructed objects are made (for pointers)
"""
if constants.BANG not in symbol:
symbol = self.symbol_table_name + constants.BANG + symbol
if constants.BANG not in object_type:
object_type = self.symbol_table_name + constants.BANG + object_type
else:
raise ValueError("Cannot reference another module when constructing an object")
@@ -197,21 +197,24 @@ class Module(interfaces.context.ModuleInterface):
if 'layer_name' in kwargs:
del kwargs['layer_name']
return self._context.object(
symbol = symbol,
object_type = object_type,
layer_name = self._layer_name,
offset = offset,
native_layer_name = native_layer_name or self._native_layer_name,
**kwargs)
def object_from_symbol(self, symbol: str, native_layer_name: Optional[str] = None, absolute: bool = False,
def object_from_symbol(self,
object_type: str,
native_layer_name: Optional[str] = None,
absolute: bool = False,
**kwargs) -> 'interfaces.objects.ObjectInterface':
if constants.BANG not in symbol:
symbol = self.symbol_table_name + constants.BANG + symbol
if constants.BANG not in object_type:
object_type = self.symbol_table_name + constants.BANG + object_type
else:
raise ValueError("Cannot reference another module when constructing an object")
# Only set the offset if type is Symbol and we were given a name, not a template
symbol_val = self._context.symbol_space.get_symbol(symbol)
symbol_val = self._context.symbol_space.get_symbol(object_type)
offset = symbol_val.address
if not absolute:
@@ -226,7 +229,7 @@ class Module(interfaces.context.ModuleInterface):
# Since type may be a template, we don't just call our own module method
return self._context.object(
symbol = symbol_val.type,
object_type = symbol_val.type,
layer_name = self._layer_name,
offset = offset,
native_layer_name = native_layer_name or self._native_layer_name,
volatility/framework/interfaces/context.py
+6 -3
View File
@@ -74,7 +74,7 @@ class ContextInterface(object, metaclass = ABCMeta):
@abstractmethod
def object(self,
symbol: Union[str, 'interfaces.objects.Template'],
object_type: Union[str, 'interfaces.objects.Template'],
layer_name: str,
offset: int,
native_layer_name: str = None,
@@ -147,7 +147,7 @@ class ModuleInterface(metaclass = ABCMeta):
@abstractmethod
def object(self,
symbol: str,
object_type: str,
offset: int = None,
native_layer_name: Optional[str] = None,
absolute: bool = False,
@@ -155,7 +155,10 @@ class ModuleInterface(metaclass = ABCMeta):
"""Returns an object created using the symbol_table_name and layer_name of the Module"""
@abstractmethod
def object_from_symbol(self, symbol: str, native_layer_name: Optional[str] = None, absolute: bool = False,
def object_from_symbol(self,
object_type: str,
native_layer_name: Optional[str] = None,
absolute: bool = False,
**kwargs) -> 'interfaces.objects.ObjectInterface':
"""Returns an object created usnig the symbol_table_name and layer_name of the Module"""
volatility/framework/layers/msf.py
+5 -5
View File
@@ -63,7 +63,7 @@ class PdbMultiStreamFormat(interfaces.layers.TranslationLayerInterface):
root_table_num_pages = math.ceil(self._header.StreamInfo.StreamInfoSize / self._header.PageSize)
root_index_size = math.ceil((root_table_num_pages * entry_size) / self._header.PageSize)
root_index = module.object(
symbol = "array",
object_type = "array",
offset = self._header.vol.size,
count = root_index_size,
subtype = module.get_type("unsigned long"))
@@ -72,14 +72,14 @@ class PdbMultiStreamFormat(interfaces.layers.TranslationLayerInterface):
module = self.context.module(self.pdb_symbol_table, root_index_layer_name, offset = 0)
root_pages = module.object(
symbol = "array", offset = 0, count = root_table_num_pages, subtype = module.get_type("unsigned long"))
object_type = "array", offset = 0, count = root_table_num_pages, subtype = module.get_type("unsigned long"))
root_layer_name = self.create_stream_from_pages("root", self._header.StreamInfo.StreamInfoSize,
[x for x in root_pages])
module = self.context.module(self.pdb_symbol_table, root_layer_name, offset = 0)
num_streams = module.object(symbol = "unsigned long", offset = 0)
num_streams = module.object(object_type = "unsigned long", offset = 0)
stream_sizes = module.object(
symbol = "array", offset = entry_size, count = num_streams, subtype = module.get_type("unsigned long"))
object_type = "array", offset = entry_size, count = num_streams, subtype = module.get_type("unsigned long"))
current_offset = (num_streams + 1) * entry_size
@@ -89,7 +89,7 @@ class PdbMultiStreamFormat(interfaces.layers.TranslationLayerInterface):
self._streams[stream] = None
else:
stream_page_list = module.object(
symbol = "array",
object_type = "array",
offset = current_offset,
count = list_size,
subtype = module.get_type("unsigned long"))
volatility/framework/layers/registry.py
+3 -1
View File
@@ -119,7 +119,9 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface):
"""Returns the appropriate Cell value for a cell offset"""
# This would be an _HCELL containing CELL_DATA, but to save time we skip the size of the HCELL
cell = self._context.object(
symbol = self._table_name + constants.BANG + "_CELL_DATA", offset = cell_offset + 4, layer_name = self.name)
object_type = self._table_name + constants.BANG + "_CELL_DATA",
offset = cell_offset + 4,
layer_name = self.name)
return cell
def get_node(self, cell_offset: int) -> 'objects.Struct':
volatility/framework/plugins/linux/check_afinfo.py
+1 -1
View File
@@ -98,7 +98,7 @@ class Check_afinfo(plugins.PluginInterface):
except exceptions.SymbolError:
continue
global_var = vmlinux.object(symbol = struct_type, offset = global_var.address)
global_var = vmlinux.object(object_type = struct_type, offset = global_var.address)
for name, member, address in self._check_afinfo(global_var_name, global_var, op_members, seq_members):
yield 0, (name, member, format_hints.Hex(address))
volatility/framework/plugins/linux/check_syscall.py
+1 -1
View File
@@ -176,7 +176,7 @@ class Check_syscall(plugins.PluginInterface):
for (table_name, (tableaddr, tblsz)) in tables:
table = vmlinux.object(
symbol = "array", subtype = vmlinux.get_type("pointer"), offset = tableaddr, count = tblsz)
object_type = "array", subtype = vmlinux.get_type("pointer"), offset = tableaddr, count = tblsz)
for (i, call_addr) in enumerate(table):
if not call_addr:
volatility/framework/plugins/linux/lsmod.py
+1 -1
View File
@@ -50,7 +50,7 @@ class Lsmod(plugins.PluginInterface):
vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0)
modules = vmlinux.object_from_symbol(symbol = "modules").cast("list_head")
modules = vmlinux.object_from_symbol(object_type = "modules").cast("list_head")
table_name = modules.vol.type_name.split(constants.BANG)[0]
volatility/framework/plugins/linux/pslist.py
+1 -1
View File
@@ -77,7 +77,7 @@ class PsList(interfaces_plugins.PluginInterface):
vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0)
init_task = vmlinux.object_from_symbol(symbol = "init_task")
init_task = vmlinux.object_from_symbol(object_type = "init_task")
for task in init_task.tasks:
if not filter_func(task):
volatility/framework/plugins/mac/check_syscall.py
+2 -2
View File
@@ -27,8 +27,8 @@ class Check_syscall(plugins.PluginInterface):
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
nsysent = kernel.object_from_symbol(symbol = "nsysent")
table = kernel.object_from_symbol(symbol = "sysent")
nsysent = kernel.object_from_symbol(object_type = "nsysent")
table = kernel.object_from_symbol(object_type = "sysent")
# smear help
num_ents = min(nsysent, table.count)
volatility/framework/plugins/mac/check_sysctl.py
+2 -2
View File
@@ -36,7 +36,7 @@ class Check_sysctl(plugins.PluginInterface):
var_name = known_sysctls[name]
try:
var_array = kernel.object(symbol = var_name)
var_array = kernel.object(object_type = var_name)
except exceptions.SymbolError:
var_array = None
@@ -110,7 +110,7 @@ class Check_sysctl(plugins.PluginInterface):
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
sysctl_list = kernel.object_from_symbol(symbol = "sysctl__children")
sysctl_list = kernel.object_from_symbol(object_type = "sysctl__children")
for sysctl, name, val in self._process_sysctl_list(kernel, sysctl_list):
check_addr = sysctl.oid_handler
volatility/framework/plugins/mac/check_trap_table.py
+1 -1
View File
@@ -27,7 +27,7 @@ class Check_trap_table(plugins.PluginInterface):
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
table = kernel.object_from_symbol(symbol = "mach_trap_table")
table = kernel.object_from_symbol(object_type = "mach_trap_table")
for i, ent in enumerate(table):
try:
volatility/framework/plugins/mac/lsmod.py
+1 -1
View File
@@ -47,7 +47,7 @@ class Lsmod(plugins.PluginInterface):
kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
kmod_ptr = kernel.object_from_symbol(symbol = "kmod")
kmod_ptr = kernel.object_from_symbol(object_type = "kmod")
# TODO - use smear-proof list walking API after dev release
kmod = kmod_ptr.dereference().cast("kmod_info")
volatility/framework/plugins/mac/pslist.py
+1 -1
View File
@@ -80,7 +80,7 @@ class PsList(interfaces_plugins.PluginInterface):
kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
proc = kernel.object_from_symbol(symbol = "allproc").lh_first
proc = kernel.object_from_symbol(object_type = "allproc").lh_first
seen = {}
while proc is not None and proc.vol.offset != 0:
volatility/framework/plugins/mac/trustedbsd.py
+2 -2
View File
@@ -49,10 +49,10 @@ class Check_syscall(plugins.PluginInterface):
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
policy_list = kernel.object_from_symbol(symbol = "_mac_policy_list").cast("mac_policy_list")
policy_list = kernel.object_from_symbol(object_type = "_mac_policy_list").cast("mac_policy_list")
entries = kernel.object(
symbol = "array",
object_type = "array",
offset = policy_list.entries.dereference().vol.offset,
subtype = kernel.get_type('mac_policy_list_element'),
count = policy_list.staticmax + 1)
volatility/framework/plugins/windows/handles.py
+2 -2
View File
@@ -162,7 +162,7 @@ class Handles(interfaces_plugins.PluginInterface):
table_addr = ntkrnlmp.get_symbol("ObpObjectTypes").address
ptrs = ntkrnlmp.object(
symbol = "array", offset = table_addr, subtype = ntkrnlmp.get_type("pointer"), count = 100)
object_type = "array", offset = table_addr, subtype = ntkrnlmp.get_type("pointer"), count = 100)
for i, ptr in enumerate(ptrs): #type: ignore
# the first entry in the table is always null. break the
@@ -214,7 +214,7 @@ class Handles(interfaces_plugins.PluginInterface):
if not self.context.layers[virtual].is_valid(offset):
return
table = ntkrnlmp.object(symbol = "array", offset = offset, subtype = subtype, count = int(count))
table = ntkrnlmp.object(object_type = "array", offset = offset, subtype = subtype, count = int(count))
layer_object = self.context.layers[virtual]
masked_offset = (offset & layer_object.maximum_address)
volatility/framework/plugins/windows/info.py
+5 -3
View File
@@ -105,7 +105,8 @@ class Info(plugins.PluginInterface):
vers_offset = ntkrnlmp.get_symbol("KdVersionBlock").address
vers = ntkrnlmp.object(symbol = "_DBGKD_GET_VERSION64", layer_name = virtual_layer_name, offset = vers_offset)
vers = ntkrnlmp.object(
object_type = "_DBGKD_GET_VERSION64", layer_name = virtual_layer_name, offset = vers_offset)
yield (0, ("KdVersionBlock", hex(vers.vol.offset)))
yield (0, ("Major/Minor", "{0}.{1}".format(vers.MajorVersion, vers.MinorVersion)))
@@ -113,7 +114,8 @@ class Info(plugins.PluginInterface):
cpu_count_offset = ntkrnlmp.get_symbol("KeNumberProcessors").address
cpu_count = ntkrnlmp.object(symbol = "unsigned int", layer_name = virtual_layer_name, offset = cpu_count_offset)
cpu_count = ntkrnlmp.object(
object_type = "unsigned int", layer_name = virtual_layer_name, offset = cpu_count_offset)
yield (0, ("KeNumberProcessors", str(cpu_count)))
@@ -124,7 +126,7 @@ class Info(plugins.PluginInterface):
kuser_addr = 0xFFFFF78000000000
kuser = ntkrnlmp.object(
symbol = "_KUSER_SHARED_DATA", layer_name = virtual_layer_name, offset = kuser_addr, absolute = True)
object_type = "_KUSER_SHARED_DATA", layer_name = virtual_layer_name, offset = kuser_addr, absolute = True)
yield (0, ("SystemTime", str(kuser.SystemTime.get_time())))
yield (0, ("NtSystemRoot",
volatility/framework/plugins/windows/modules.py
+2 -2
View File
@@ -75,9 +75,9 @@ class Modules(interfaces.plugins.PluginInterface):
type_name = ldr_entry_type.type_name.split(constants.BANG)[1]
list_head = ntkrnlmp.get_symbol("PsLoadedModuleList").address
list_entry = ntkrnlmp.object(symbol = "_LIST_ENTRY", offset = list_head)
list_entry = ntkrnlmp.object(object_type = "_LIST_ENTRY", offset = list_head)
reloff = ldr_entry_type.relative_child_offset("InLoadOrderLinks")
module = ntkrnlmp.object(symbol = type_name, offset = list_entry.vol.offset - reloff, absolute = True)
module = ntkrnlmp.object(object_type = type_name, offset = list_entry.vol.offset - reloff, absolute = True)
for mod in module.InLoadOrderLinks:
yield mod
volatility/framework/plugins/windows/poolscanner.py
+1 -1
View File
@@ -88,7 +88,7 @@ class PoolHeaderScanner(interfaces.layers.ScannerInterface):
def __call__(self, data: bytes, data_offset: int):
for offset, pattern in self._subscanner(data, data_offset):
header = self._module.object(
symbol = "_POOL_HEADER", offset = offset - self._header_offset, absolute = True)
object_type = "_POOL_HEADER", offset = offset - self._header_offset, absolute = True)
constraint = self._constraint_lookup[pattern]
try:
# Size check
volatility/framework/plugins/windows/pslist.py
+2 -2
View File
@@ -87,7 +87,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo)
ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address
list_entry = ntkrnlmp.object(symbol = "_LIST_ENTRY", offset = ps_aph_offset)
list_entry = ntkrnlmp.object(object_type = "_LIST_ENTRY", offset = ps_aph_offset)
# This is example code to demonstrate how to use symbol_space directly, rather than through a module:
#
@@ -101,7 +101,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
# having been present. Strictly, the value of the requirement should be joined with the BANG character
# defined in the constants file
reloff = ntkrnlmp.get_type("_EPROCESS").relative_child_offset("ActiveProcessLinks")
eproc = ntkrnlmp.object(symbol = "_EPROCESS", offset = list_entry.vol.offset - reloff, absolute = True)
eproc = ntkrnlmp.object(object_type = "_EPROCESS", offset = list_entry.vol.offset - reloff, absolute = True)
for proc in eproc.ActiveProcessLinks:
if not filter_func(proc):
volatility/framework/plugins/windows/registry/hivelist.py
+2 -2
View File
@@ -63,9 +63,9 @@ class HiveList(plugins.PluginInterface):
ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo)
list_head = ntkrnlmp.get_symbol("CmpHiveListHead").address
list_entry = ntkrnlmp.object(symbol = "_LIST_ENTRY", offset = list_head)
list_entry = ntkrnlmp.object(object_type = "_LIST_ENTRY", offset = list_head)
reloff = ntkrnlmp.get_type("_CMHIVE").relative_child_offset("HiveList")
cmhive = ntkrnlmp.object(symbol = "_CMHIVE", offset = list_entry.vol.offset - reloff, absolute = True)
cmhive = ntkrnlmp.object(object_type = "_CMHIVE", offset = list_entry.vol.offset - reloff, absolute = True)
# Run through the list fowards
seen = set()
volatility/framework/plugins/windows/registry/userassist.py
+1 -1
View File
@@ -86,7 +86,7 @@ class UserAssist(interfaces.plugins.PluginInterface):
buffer = BufferDataLayer(self.context, self._config_path, userassist_layer_name, userassist_data)
self.context.add_layer(buffer)
userassist_obj = self.context.object(
symbol = self._reg_table_name + constants.BANG + self._userassist_type_name,
object_type = self._reg_table_name + constants.BANG + self._userassist_type_name,
layer_name = userassist_layer_name,
offset = 0)
volatility/framework/plugins/windows/ssdt.py
+2 -2
View File
@@ -85,7 +85,7 @@ class SSDT(plugins.PluginInterface):
## we could also find nt!KeServiceDescriptorTable (NT) and KeServiceDescriptorTableShadow (NT, Win32K)
service_table_address = ntkrnlmp.get_symbol("KiServiceTable").address
service_limit_address = ntkrnlmp.get_symbol("KiServiceLimit").address
service_limit = ntkrnlmp.object(symbol = "int", offset = service_limit_address)
service_limit = ntkrnlmp.object(object_type = "int", offset = service_limit_address)
# on 32-bit systems the table indexes are 32-bits and contain pointers (unsigned)
# on 64-bit systems the indexes are also 32-bits but they're offsets from the
@@ -107,7 +107,7 @@ class SSDT(plugins.PluginInterface):
find_address = passthrough
functions = ntkrnlmp.object(
symbol = "array",
object_type = "array",
offset = service_table_address,
subtype = ntkrnlmp.get_type(array_subtype),
count = service_limit)
volatility/framework/plugins/windows/vadinfo.py
+1 -1
View File
@@ -78,7 +78,7 @@ class VadInfo(interfaces.plugins.PluginInterface):
kvo = context.layers[virtual_layer].config["kernel_virtual_offset"]
ntkrnlmp = context.module(nt_symbols, layer_name = virtual_layer, offset = kvo)
addr = ntkrnlmp.get_symbol("MmProtectToValue").address
values = ntkrnlmp.object(symbol = "array", offset = addr, subtype = ntkrnlmp.get_type("int"), count = 32)
values = ntkrnlmp.object(object_type = "array", offset = addr, subtype = ntkrnlmp.get_type("int"), count = 32)
return values # type: ignore
@classmethod
volatility/framework/symbols/windows/extensions/__init__.py
+1 -1
View File
@@ -700,7 +700,7 @@ class _EPROCESS(generic.GenericIntelProcess, ExecutiveObject):
layer_name = self.vol.native_layer_name,
offset = kvo,
native_layer_name = self.vol.native_layer_name)
session = ntkrnlmp.object(symbol = "_MM_SESSION_SPACE", offset = self.Session, absolute = True)
session = ntkrnlmp.object(object_type = "_MM_SESSION_SPACE", offset = self.Session, absolute = True)
if session.has_member("SessionId"):
return session.SessionId
volatility/framework/symbols/windows/pdbconv.py
+21 -21
View File
@@ -353,7 +353,7 @@ class PdbReader:
if not tpi_layer:
raise ValueError("No TPI stream available")
module = self._context.module(module_name = tpi_layer.pdb_symbol_table, layer_name = tpi_layer.name, offset = 0)
header = module.object(symbol = "TPI_HEADER", offset = 0)
header = module.object(object_type = "TPI_HEADER", offset = 0)
# Check the header
if not (56 <= header.header_size < 1024):
@@ -375,7 +375,7 @@ class PdbReader:
type_index = 1
while tpi_layer.maximum_address - offset > 0:
self._progress_callback(offset * 100 / tpi_layer.maximum_address, "Reading TPI layer")
length = module.object(symbol = length_type, offset = offset)
length = module.object(object_type = length_type, offset = offset)
if not isinstance(length, int):
raise ValueError("Non-integer length provided")
offset += length_len
@@ -401,7 +401,7 @@ class PdbReader:
if not dbi_layer:
raise ValueError("No DBI stream available")
module = self._context.module(module_name = dbi_layer.pdb_symbol_table, layer_name = dbi_layer.name, offset = 0)
self._dbiheader = module.object(symbol = "DBI_HEADER", offset = 0)
self._dbiheader = module.object(object_type = "DBI_HEADER", offset = 0)
if not self._dbiheader:
raise ValueError("DBI Header could not be read")
@@ -410,7 +410,7 @@ class PdbReader:
dbg_hdr_offset = (self._dbiheader.vol.size + self._dbiheader.module_size + self._dbiheader.secconSize +
self._dbiheader.secmapSize + self._dbiheader.filinfSize + self._dbiheader.tsmapSize +
self._dbiheader.ecinfoSize)
self._dbidbgheader = module.object(symbol = "DBI_DBG_HEADER", offset = dbg_hdr_offset)
self._dbidbgheader = module.object(object_type = "DBI_DBG_HEADER", offset = dbg_hdr_offset)
self._sections = []
self._omap_mapping = []
@@ -465,8 +465,8 @@ class PdbReader:
while offset < max_address:
self._progress_callback(offset * 100 / max_address, "Reading Symbol layer")
sym = module.object(symbol = "GLOBAL_SYMBOL", offset = offset)
leaf_type = module.object(symbol = "unsigned short", offset = sym.leaf_type.vol.offset)
sym = module.object(object_type = "GLOBAL_SYMBOL", offset = offset)
leaf_type = module.object(object_type = "unsigned short", offset = sym.leaf_type.vol.offset)
name = None
address = None
if sym.segment < len(self._sections):
@@ -500,7 +500,7 @@ class PdbReader:
raise ValueError("No PDB Info Stream available")
module = self._context.module(
module_name = pdb_info_layer.pdb_symbol_table, layer_name = pdb_info_layer.name, offset = 0)
pdb_info = module.object(symbol = "PDB_INFORMATION", offset = 0)
pdb_info = module.object(object_type = "PDB_INFORMATION", offset = 0)
self.metadata['windows']['pdb'] = {
"GUID": self.convert_bytes_to_guid(pdb_info.GUID),
@@ -726,7 +726,7 @@ class PdbReader:
leaf_type.LF_CLASS, leaf_type.LF_CLASS_ST, leaf_type.LF_STRUCTURE, leaf_type.LF_STRUCTURE_ST,
leaf_type.LF_INTERFACE
]:
structure = module.object(symbol = "LF_STRUCTURE", offset = offset + consumed)
structure = module.object(object_type = "LF_STRUCTURE", offset = offset + consumed)
name_offset = structure.name.vol.offset - structure.vol.offset
name, value, excess = self.determine_extended_value(leaf_type, structure.size, module,
remaining - name_offset)
@@ -735,7 +735,7 @@ class PdbReader:
consumed += remaining
result = leaf_type, name, structure
elif leaf_type in [leaf_type.LF_MEMBER, leaf_type.LF_MEMBER_ST]:
member = module.object(symbol = "LF_MEMBER", offset = offset + consumed)
member = module.object(object_type = "LF_MEMBER", offset = offset + consumed)
name_offset = member.name.vol.offset - member.vol.offset
name, value, excess = self.determine_extended_value(leaf_type, member.offset, module,
remaining - name_offset)
@@ -744,7 +744,7 @@ class PdbReader:
result = leaf_type, name, member
consumed += member.vol.size + len(name) + 1 + excess
elif leaf_type in [leaf_type.LF_ARRAY, leaf_type.LF_ARRAY_ST, leaf_type.LF_STRIDED_ARRAY]:
array = module.object(symbol = "LF_ARRAY", offset = offset + consumed)
array = module.object(object_type = "LF_ARRAY", offset = offset + consumed)
name_offset = array.name.vol.offset - array.vol.offset
name, value, excess = self.determine_extended_value(leaf_type, array.size, module, remaining - name_offset)
array.size = value
@@ -752,7 +752,7 @@ class PdbReader:
result = leaf_type, name, array
consumed += remaining
elif leaf_type in [leaf_type.LF_ENUMERATE]:
enum = module.object(symbol = 'LF_ENUMERATE', offset = offset + consumed)
enum = module.object(object_type = 'LF_ENUMERATE', offset = offset + consumed)
name_offset = enum.name.vol.offset - enum.vol.offset
name, value, excess = self.determine_extended_value(leaf_type, enum.value, module, remaining - name_offset)
enum.value = value
@@ -760,20 +760,20 @@ class PdbReader:
result = leaf_type, name, enum
consumed += enum.vol.size + len(name) + 1 + excess
elif leaf_type in [leaf_type.LF_ARGLIST, leaf_type.LF_ENUM]:
enum = module.object(symbol = "LF_ENUM", offset = offset + consumed)
enum = module.object(object_type = "LF_ENUM", offset = offset + consumed)
name_offset = enum.name.vol.offset - enum.vol.offset
name = self.parse_string(enum.name, leaf_type < leaf_type.LF_ST_MAX, size = remaining - name_offset)
enum.name = name
result = leaf_type, name, enum
consumed += remaining
elif leaf_type in [leaf_type.LF_UNION]:
union = module.object(symbol = "LF_UNION", offset = offset + consumed)
union = module.object(object_type = "LF_UNION", offset = offset + consumed)
name_offset = union.name.vol.offset - union.vol.offset
name = self.parse_string(union.name, leaf_type < leaf_type.LF_ST_MAX, size = remaining - name_offset)
result = leaf_type, name, union
consumed += remaining
elif leaf_type in [leaf_type.LF_MODIFIER, leaf_type.LF_POINTER, leaf_type.LF_PROCEDURE]:
obj = module.object(symbol = leaf_type.lookup(), offset = offset + consumed)
obj = module.object(object_type = leaf_type.lookup(), offset = offset + consumed)
result = leaf_type, None, obj
consumed += remaining
elif leaf_type in [leaf_type.LF_FIELDLIST]:
@@ -789,7 +789,7 @@ class PdbReader:
fields.append(subfield)
result = leaf_type, None, fields
elif leaf_type in [leaf_type.LF_BITFIELD]:
bitfield = module.object(symbol = "LF_BITFIELD", offset = offset + consumed)
bitfield = module.object(object_type = "LF_BITFIELD", offset = offset + consumed)
result = leaf_type, None, bitfield
consumed += remaining
else:
@@ -873,20 +873,20 @@ class PdbReader:
# Set the offset at just after the previous size type
offset = value.vol.offset + value.vol.data_format.length
if sub_leaf_type in [leaf_type.LF_CHAR]:
value = module.object(symbol = 'char', offset = offset)
value = module.object(object_type = 'char', offset = offset)
elif sub_leaf_type in [leaf_type.LF_SHORT]:
value = module.object(symbol = 'short', offset = offset)
value = module.object(object_type = 'short', offset = offset)
elif sub_leaf_type in [leaf_type.LF_USHORT]:
value = module.object(symbol = 'unsigned short', offset = offset)
value = module.object(object_type = 'unsigned short', offset = offset)
elif sub_leaf_type in [leaf_type.LF_LONG]:
value = module.object(symbol = 'long', offset = offset)
value = module.object(object_type = 'long', offset = offset)
elif sub_leaf_type in [leaf_type.LF_ULONG]:
value = module.object(symbol = 'unsigned long', offset = offset)
value = module.object(object_type = 'unsigned long', offset = offset)
else:
raise TypeError("Unexpected extended value type")
excess = value.vol.data_format.length
# Updated the consume/offset counters
name = module.object(symbol = "string", offset = value.vol.offset + value.vol.data_format.length)
name = module.object(object_type = "string", offset = value.vol.offset + value.vol.data_format.length)
name_str = self.parse_string(name, leaf_type < leaf_type.LF_ST_MAX, size = length - excess)
return name_str, value, excess