Refactor symbol to object_type (so it doesn't shadow builtin type).

volatility/framework/plugins/linux/check_afinfo.py

@@ -98,7 +98,7 @@ class Check_afinfo(plugins.PluginInterface):
                 except exceptions.SymbolError:
                     continue
 
-                global_var = vmlinux.object(symbol = struct_type, offset = global_var.address)
+                global_var = vmlinux.object(object_type = struct_type, offset = global_var.address)
 
                 for name, member, address in self._check_afinfo(global_var_name, global_var, op_members, seq_members):
                     yield 0, (name, member, format_hints.Hex(address))

volatility/framework/plugins/linux/check_syscall.py

@@ -176,7 +176,7 @@ class Check_syscall(plugins.PluginInterface):
 
         for (table_name, (tableaddr, tblsz)) in tables:
             table = vmlinux.object(
-                symbol = "array", subtype = vmlinux.get_type("pointer"), offset = tableaddr, count = tblsz)
+                object_type = "array", subtype = vmlinux.get_type("pointer"), offset = tableaddr, count = tblsz)
 
             for (i, call_addr) in enumerate(table):
                 if not call_addr:

volatility/framework/plugins/linux/lsmod.py

@@ -50,7 +50,7 @@ class Lsmod(plugins.PluginInterface):
 
         vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0)
 
-        modules = vmlinux.object_from_symbol(symbol = "modules").cast("list_head")
+        modules = vmlinux.object_from_symbol(object_type = "modules").cast("list_head")
 
         table_name = modules.vol.type_name.split(constants.BANG)[0]
 

volatility/framework/plugins/linux/pslist.py

@@ -77,7 +77,7 @@ class PsList(interfaces_plugins.PluginInterface):
 
         vmlinux = contexts.Module(context, vmlinux_symbols, layer_name, 0)
 
-        init_task = vmlinux.object_from_symbol(symbol = "init_task")
+        init_task = vmlinux.object_from_symbol(object_type = "init_task")
 
         for task in init_task.tasks:
             if not filter_func(task):

volatility/framework/plugins/mac/check_syscall.py

@@ -27,8 +27,8 @@ class Check_syscall(plugins.PluginInterface):
 
         kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
 
-        nsysent = kernel.object_from_symbol(symbol = "nsysent")
-        table = kernel.object_from_symbol(symbol = "sysent")
+        nsysent = kernel.object_from_symbol(object_type = "nsysent")
+        table = kernel.object_from_symbol(object_type = "sysent")
 
         # smear help
         num_ents = min(nsysent, table.count)

volatility/framework/plugins/mac/check_sysctl.py

@@ -36,7 +36,7 @@ class Check_sysctl(plugins.PluginInterface):
             var_name = known_sysctls[name]
 
             try:
-                var_array = kernel.object(symbol = var_name)
+                var_array = kernel.object(object_type = var_name)
             except exceptions.SymbolError:
                 var_array = None
 
@@ -110,7 +110,7 @@ class Check_sysctl(plugins.PluginInterface):
 
         kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
 
-        sysctl_list = kernel.object_from_symbol(symbol = "sysctl__children")
+        sysctl_list = kernel.object_from_symbol(object_type = "sysctl__children")
 
         for sysctl, name, val in self._process_sysctl_list(kernel, sysctl_list):
             check_addr = sysctl.oid_handler

volatility/framework/plugins/mac/check_trap_table.py

@@ -27,7 +27,7 @@ class Check_trap_table(plugins.PluginInterface):
 
         kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
 
-        table = kernel.object_from_symbol(symbol = "mach_trap_table")
+        table = kernel.object_from_symbol(object_type = "mach_trap_table")
 
         for i, ent in enumerate(table):
             try:

volatility/framework/plugins/mac/lsmod.py

@@ -47,7 +47,7 @@ class Lsmod(plugins.PluginInterface):
 
         kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
 
-        kmod_ptr = kernel.object_from_symbol(symbol = "kmod")
+        kmod_ptr = kernel.object_from_symbol(object_type = "kmod")
 
         # TODO - use smear-proof list walking API after dev release
         kmod = kmod_ptr.dereference().cast("kmod_info")

volatility/framework/plugins/mac/pslist.py

@@ -80,7 +80,7 @@ class PsList(interfaces_plugins.PluginInterface):
 
         kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
 
-        proc = kernel.object_from_symbol(symbol = "allproc").lh_first
+        proc = kernel.object_from_symbol(object_type = "allproc").lh_first
 
         seen = {}
         while proc is not None and proc.vol.offset != 0:

volatility/framework/plugins/mac/trustedbsd.py

@@ -49,10 +49,10 @@ class Check_syscall(plugins.PluginInterface):
 
         kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
 
-        policy_list = kernel.object_from_symbol(symbol = "_mac_policy_list").cast("mac_policy_list")
+        policy_list = kernel.object_from_symbol(object_type = "_mac_policy_list").cast("mac_policy_list")
 
         entries = kernel.object(
-            symbol = "array",
+            object_type = "array",
             offset = policy_list.entries.dereference().vol.offset,
             subtype = kernel.get_type('mac_policy_list_element'),
             count = policy_list.staticmax + 1)

volatility/framework/plugins/windows/handles.py

@@ -162,7 +162,7 @@ class Handles(interfaces_plugins.PluginInterface):
             table_addr = ntkrnlmp.get_symbol("ObpObjectTypes").address
 
         ptrs = ntkrnlmp.object(
-            symbol = "array", offset = table_addr, subtype = ntkrnlmp.get_type("pointer"), count = 100)
+            object_type = "array", offset = table_addr, subtype = ntkrnlmp.get_type("pointer"), count = 100)
 
         for i, ptr in enumerate(ptrs):  #type: ignore
             # the first entry in the table is always null. break the
@@ -214,7 +214,7 @@ class Handles(interfaces_plugins.PluginInterface):
         if not self.context.layers[virtual].is_valid(offset):
             return
 
-        table = ntkrnlmp.object(symbol = "array", offset = offset, subtype = subtype, count = int(count))
+        table = ntkrnlmp.object(object_type = "array", offset = offset, subtype = subtype, count = int(count))
 
         layer_object = self.context.layers[virtual]
         masked_offset = (offset & layer_object.maximum_address)

volatility/framework/plugins/windows/info.py

@@ -105,7 +105,8 @@ class Info(plugins.PluginInterface):
 
         vers_offset = ntkrnlmp.get_symbol("KdVersionBlock").address
 
-        vers = ntkrnlmp.object(symbol = "_DBGKD_GET_VERSION64", layer_name = virtual_layer_name, offset = vers_offset)
+        vers = ntkrnlmp.object(
+            object_type = "_DBGKD_GET_VERSION64", layer_name = virtual_layer_name, offset = vers_offset)
 
         yield (0, ("KdVersionBlock", hex(vers.vol.offset)))
         yield (0, ("Major/Minor", "{0}.{1}".format(vers.MajorVersion, vers.MinorVersion)))
@@ -113,7 +114,8 @@ class Info(plugins.PluginInterface):
 
         cpu_count_offset = ntkrnlmp.get_symbol("KeNumberProcessors").address
 
-        cpu_count = ntkrnlmp.object(symbol = "unsigned int", layer_name = virtual_layer_name, offset = cpu_count_offset)
+        cpu_count = ntkrnlmp.object(
+            object_type = "unsigned int", layer_name = virtual_layer_name, offset = cpu_count_offset)
 
         yield (0, ("KeNumberProcessors", str(cpu_count)))
 
@@ -124,7 +126,7 @@ class Info(plugins.PluginInterface):
             kuser_addr = 0xFFFFF78000000000
 
         kuser = ntkrnlmp.object(
-            symbol = "_KUSER_SHARED_DATA", layer_name = virtual_layer_name, offset = kuser_addr, absolute = True)
+            object_type = "_KUSER_SHARED_DATA", layer_name = virtual_layer_name, offset = kuser_addr, absolute = True)
 
         yield (0, ("SystemTime", str(kuser.SystemTime.get_time())))
         yield (0, ("NtSystemRoot",

volatility/framework/plugins/windows/modules.py

@@ -75,9 +75,9 @@ class Modules(interfaces.plugins.PluginInterface):
         type_name = ldr_entry_type.type_name.split(constants.BANG)[1]
 
         list_head = ntkrnlmp.get_symbol("PsLoadedModuleList").address
-        list_entry = ntkrnlmp.object(symbol = "_LIST_ENTRY", offset = list_head)
+        list_entry = ntkrnlmp.object(object_type = "_LIST_ENTRY", offset = list_head)
         reloff = ldr_entry_type.relative_child_offset("InLoadOrderLinks")
-        module = ntkrnlmp.object(symbol = type_name, offset = list_entry.vol.offset - reloff, absolute = True)
+        module = ntkrnlmp.object(object_type = type_name, offset = list_entry.vol.offset - reloff, absolute = True)
 
         for mod in module.InLoadOrderLinks:
             yield mod

volatility/framework/plugins/windows/poolscanner.py

@@ -88,7 +88,7 @@ class PoolHeaderScanner(interfaces.layers.ScannerInterface):
     def __call__(self, data: bytes, data_offset: int):
         for offset, pattern in self._subscanner(data, data_offset):
             header = self._module.object(
-                symbol = "_POOL_HEADER", offset = offset - self._header_offset, absolute = True)
+                object_type = "_POOL_HEADER", offset = offset - self._header_offset, absolute = True)
             constraint = self._constraint_lookup[pattern]
             try:
                 # Size check

volatility/framework/plugins/windows/pslist.py

@@ -87,7 +87,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
         ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo)
 
         ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address
-        list_entry = ntkrnlmp.object(symbol = "_LIST_ENTRY", offset = ps_aph_offset)
+        list_entry = ntkrnlmp.object(object_type = "_LIST_ENTRY", offset = ps_aph_offset)
 
         # This is example code to demonstrate how to use symbol_space directly, rather than through a module:
         #
@@ -101,7 +101,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
         # having been present.  Strictly, the value of the requirement should be joined with the BANG character
         # defined in the constants file
         reloff = ntkrnlmp.get_type("_EPROCESS").relative_child_offset("ActiveProcessLinks")
-        eproc = ntkrnlmp.object(symbol = "_EPROCESS", offset = list_entry.vol.offset - reloff, absolute = True)
+        eproc = ntkrnlmp.object(object_type = "_EPROCESS", offset = list_entry.vol.offset - reloff, absolute = True)
 
         for proc in eproc.ActiveProcessLinks:
             if not filter_func(proc):

volatility/framework/plugins/windows/registry/hivelist.py

@@ -63,9 +63,9 @@ class HiveList(plugins.PluginInterface):
         ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo)
 
         list_head = ntkrnlmp.get_symbol("CmpHiveListHead").address
-        list_entry = ntkrnlmp.object(symbol = "_LIST_ENTRY", offset = list_head)
+        list_entry = ntkrnlmp.object(object_type = "_LIST_ENTRY", offset = list_head)
         reloff = ntkrnlmp.get_type("_CMHIVE").relative_child_offset("HiveList")
-        cmhive = ntkrnlmp.object(symbol = "_CMHIVE", offset = list_entry.vol.offset - reloff, absolute = True)
+        cmhive = ntkrnlmp.object(object_type = "_CMHIVE", offset = list_entry.vol.offset - reloff, absolute = True)
 
         # Run through the list fowards
         seen = set()

volatility/framework/plugins/windows/registry/userassist.py

@@ -86,7 +86,7 @@ class UserAssist(interfaces.plugins.PluginInterface):
         buffer = BufferDataLayer(self.context, self._config_path, userassist_layer_name, userassist_data)
         self.context.add_layer(buffer)
         userassist_obj = self.context.object(
-            symbol = self._reg_table_name + constants.BANG + self._userassist_type_name,
+            object_type = self._reg_table_name + constants.BANG + self._userassist_type_name,
             layer_name = userassist_layer_name,
             offset = 0)
 

volatility/framework/plugins/windows/ssdt.py

@@ -85,7 +85,7 @@ class SSDT(plugins.PluginInterface):
         ## we could also find nt!KeServiceDescriptorTable (NT) and KeServiceDescriptorTableShadow (NT, Win32K)
         service_table_address = ntkrnlmp.get_symbol("KiServiceTable").address
         service_limit_address = ntkrnlmp.get_symbol("KiServiceLimit").address
-        service_limit = ntkrnlmp.object(symbol = "int", offset = service_limit_address)
+        service_limit = ntkrnlmp.object(object_type = "int", offset = service_limit_address)
 
         # on 32-bit systems the table indexes are 32-bits and contain pointers (unsigned)
         # on 64-bit systems the indexes are also 32-bits but they're offsets from the
@@ -107,7 +107,7 @@ class SSDT(plugins.PluginInterface):
             find_address = passthrough
 
         functions = ntkrnlmp.object(
-            symbol = "array",
+            object_type = "array",
             offset = service_table_address,
             subtype = ntkrnlmp.get_type(array_subtype),
             count = service_limit)

volatility/framework/plugins/windows/vadinfo.py

@@ -78,7 +78,7 @@ class VadInfo(interfaces.plugins.PluginInterface):
         kvo = context.layers[virtual_layer].config["kernel_virtual_offset"]
         ntkrnlmp = context.module(nt_symbols, layer_name = virtual_layer, offset = kvo)
         addr = ntkrnlmp.get_symbol("MmProtectToValue").address
-        values = ntkrnlmp.object(symbol = "array", offset = addr, subtype = ntkrnlmp.get_type("int"), count = 32)
+        values = ntkrnlmp.object(object_type = "array", offset = addr, subtype = ntkrnlmp.get_type("int"), count = 32)
         return values  # type: ignore
 
     @classmethod