Refactor symbol to object_type (so it doesn't shadow builtin type).

volatility/framework/plugins/windows/handles.py

@@ -162,7 +162,7 @@ class Handles(interfaces_plugins.PluginInterface):
             table_addr = ntkrnlmp.get_symbol("ObpObjectTypes").address
 
         ptrs = ntkrnlmp.object(
-            symbol = "array", offset = table_addr, subtype = ntkrnlmp.get_type("pointer"), count = 100)
+            object_type = "array", offset = table_addr, subtype = ntkrnlmp.get_type("pointer"), count = 100)
 
         for i, ptr in enumerate(ptrs):  #type: ignore
             # the first entry in the table is always null. break the
@@ -214,7 +214,7 @@ class Handles(interfaces_plugins.PluginInterface):
         if not self.context.layers[virtual].is_valid(offset):
             return
 
-        table = ntkrnlmp.object(symbol = "array", offset = offset, subtype = subtype, count = int(count))
+        table = ntkrnlmp.object(object_type = "array", offset = offset, subtype = subtype, count = int(count))
 
         layer_object = self.context.layers[virtual]
         masked_offset = (offset & layer_object.maximum_address)

volatility/framework/plugins/windows/info.py

@@ -105,7 +105,8 @@ class Info(plugins.PluginInterface):
 
         vers_offset = ntkrnlmp.get_symbol("KdVersionBlock").address
 
-        vers = ntkrnlmp.object(symbol = "_DBGKD_GET_VERSION64", layer_name = virtual_layer_name, offset = vers_offset)
+        vers = ntkrnlmp.object(
+            object_type = "_DBGKD_GET_VERSION64", layer_name = virtual_layer_name, offset = vers_offset)
 
         yield (0, ("KdVersionBlock", hex(vers.vol.offset)))
         yield (0, ("Major/Minor", "{0}.{1}".format(vers.MajorVersion, vers.MinorVersion)))
@@ -113,7 +114,8 @@ class Info(plugins.PluginInterface):
 
         cpu_count_offset = ntkrnlmp.get_symbol("KeNumberProcessors").address
 
-        cpu_count = ntkrnlmp.object(symbol = "unsigned int", layer_name = virtual_layer_name, offset = cpu_count_offset)
+        cpu_count = ntkrnlmp.object(
+            object_type = "unsigned int", layer_name = virtual_layer_name, offset = cpu_count_offset)
 
         yield (0, ("KeNumberProcessors", str(cpu_count)))
 
@@ -124,7 +126,7 @@ class Info(plugins.PluginInterface):
             kuser_addr = 0xFFFFF78000000000
 
         kuser = ntkrnlmp.object(
-            symbol = "_KUSER_SHARED_DATA", layer_name = virtual_layer_name, offset = kuser_addr, absolute = True)
+            object_type = "_KUSER_SHARED_DATA", layer_name = virtual_layer_name, offset = kuser_addr, absolute = True)
 
         yield (0, ("SystemTime", str(kuser.SystemTime.get_time())))
         yield (0, ("NtSystemRoot",

volatility/framework/plugins/windows/modules.py

@@ -75,9 +75,9 @@ class Modules(interfaces.plugins.PluginInterface):
         type_name = ldr_entry_type.type_name.split(constants.BANG)[1]
 
         list_head = ntkrnlmp.get_symbol("PsLoadedModuleList").address
-        list_entry = ntkrnlmp.object(symbol = "_LIST_ENTRY", offset = list_head)
+        list_entry = ntkrnlmp.object(object_type = "_LIST_ENTRY", offset = list_head)
         reloff = ldr_entry_type.relative_child_offset("InLoadOrderLinks")
-        module = ntkrnlmp.object(symbol = type_name, offset = list_entry.vol.offset - reloff, absolute = True)
+        module = ntkrnlmp.object(object_type = type_name, offset = list_entry.vol.offset - reloff, absolute = True)
 
         for mod in module.InLoadOrderLinks:
             yield mod

volatility/framework/plugins/windows/poolscanner.py

@@ -88,7 +88,7 @@ class PoolHeaderScanner(interfaces.layers.ScannerInterface):
     def __call__(self, data: bytes, data_offset: int):
         for offset, pattern in self._subscanner(data, data_offset):
             header = self._module.object(
-                symbol = "_POOL_HEADER", offset = offset - self._header_offset, absolute = True)
+                object_type = "_POOL_HEADER", offset = offset - self._header_offset, absolute = True)
             constraint = self._constraint_lookup[pattern]
             try:
                 # Size check

volatility/framework/plugins/windows/pslist.py

@@ -87,7 +87,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
         ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo)
 
         ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address
-        list_entry = ntkrnlmp.object(symbol = "_LIST_ENTRY", offset = ps_aph_offset)
+        list_entry = ntkrnlmp.object(object_type = "_LIST_ENTRY", offset = ps_aph_offset)
 
         # This is example code to demonstrate how to use symbol_space directly, rather than through a module:
         #
@@ -101,7 +101,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
         # having been present.  Strictly, the value of the requirement should be joined with the BANG character
         # defined in the constants file
         reloff = ntkrnlmp.get_type("_EPROCESS").relative_child_offset("ActiveProcessLinks")
-        eproc = ntkrnlmp.object(symbol = "_EPROCESS", offset = list_entry.vol.offset - reloff, absolute = True)
+        eproc = ntkrnlmp.object(object_type = "_EPROCESS", offset = list_entry.vol.offset - reloff, absolute = True)
 
         for proc in eproc.ActiveProcessLinks:
             if not filter_func(proc):

volatility/framework/plugins/windows/registry/hivelist.py

@@ -63,9 +63,9 @@ class HiveList(plugins.PluginInterface):
         ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo)
 
         list_head = ntkrnlmp.get_symbol("CmpHiveListHead").address
-        list_entry = ntkrnlmp.object(symbol = "_LIST_ENTRY", offset = list_head)
+        list_entry = ntkrnlmp.object(object_type = "_LIST_ENTRY", offset = list_head)
         reloff = ntkrnlmp.get_type("_CMHIVE").relative_child_offset("HiveList")
-        cmhive = ntkrnlmp.object(symbol = "_CMHIVE", offset = list_entry.vol.offset - reloff, absolute = True)
+        cmhive = ntkrnlmp.object(object_type = "_CMHIVE", offset = list_entry.vol.offset - reloff, absolute = True)
 
         # Run through the list fowards
         seen = set()

volatility/framework/plugins/windows/registry/userassist.py

@@ -86,7 +86,7 @@ class UserAssist(interfaces.plugins.PluginInterface):
         buffer = BufferDataLayer(self.context, self._config_path, userassist_layer_name, userassist_data)
         self.context.add_layer(buffer)
         userassist_obj = self.context.object(
-            symbol = self._reg_table_name + constants.BANG + self._userassist_type_name,
+            object_type = self._reg_table_name + constants.BANG + self._userassist_type_name,
             layer_name = userassist_layer_name,
             offset = 0)
 

volatility/framework/plugins/windows/ssdt.py

@@ -85,7 +85,7 @@ class SSDT(plugins.PluginInterface):
         ## we could also find nt!KeServiceDescriptorTable (NT) and KeServiceDescriptorTableShadow (NT, Win32K)
         service_table_address = ntkrnlmp.get_symbol("KiServiceTable").address
         service_limit_address = ntkrnlmp.get_symbol("KiServiceLimit").address
-        service_limit = ntkrnlmp.object(symbol = "int", offset = service_limit_address)
+        service_limit = ntkrnlmp.object(object_type = "int", offset = service_limit_address)
 
         # on 32-bit systems the table indexes are 32-bits and contain pointers (unsigned)
         # on 64-bit systems the indexes are also 32-bits but they're offsets from the
@@ -107,7 +107,7 @@ class SSDT(plugins.PluginInterface):
             find_address = passthrough
 
         functions = ntkrnlmp.object(
-            symbol = "array",
+            object_type = "array",
             offset = service_table_address,
             subtype = ntkrnlmp.get_type(array_subtype),
             count = service_limit)

volatility/framework/plugins/windows/vadinfo.py

@@ -78,7 +78,7 @@ class VadInfo(interfaces.plugins.PluginInterface):
         kvo = context.layers[virtual_layer].config["kernel_virtual_offset"]
         ntkrnlmp = context.module(nt_symbols, layer_name = virtual_layer, offset = kvo)
         addr = ntkrnlmp.get_symbol("MmProtectToValue").address
-        values = ntkrnlmp.object(symbol = "array", offset = addr, subtype = ntkrnlmp.get_type("int"), count = 32)
+        values = ntkrnlmp.object(object_type = "array", offset = addr, subtype = ntkrnlmp.get_type("int"), count = 32)
         return values  # type: ignore
 
     @classmethod