WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 04:37:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Volshell: Add support for constructing objects at specific offsets.

Browse Source
This commit is contained in:
Mike Auty
2019-09-25 01:22:48 +01:00
parent 926288a7ac
commit c05b8dfd6a
4 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/cli/volshell/generic.py
+8 -2
View File
@@ -202,14 +202,20 @@ class Volshell(interfaces.plugins.PluginInterface):
for i in disasm_types[architecture].disasm(remaining_data, offset):
print("0x%x:\t%s\t%s" % (i.address, i.mnemonic, i.op_str))
def display_type(self, object: Union[str, interfaces.objects.ObjectInterface, interfaces.objects.Template]):
def display_type(self,
object: Union[str, interfaces.objects.ObjectInterface, interfaces.objects.Template],
offset: int = None):
"""Display Type describes the members of a particular object in alphabetical order"""
if not isinstance(object, (str, interfaces.objects.ObjectInterface, interfaces.objects.Template)):
print("Cannot display information about non-type object")
return
if isinstance(object, str):
if isinstance(object, str) and offset is None:
object = self.context.symbol_space.get_type(object)
elif isinstance(object, str) and offset is not None:
object = self.context.object(object, layer_name = self.current_layer, offset = offset)
elif offset is not None:
object = self.context.object(object.vol.type_name, layer_name = self.current_layer, offset = offset)
if hasattr(object.vol, 'size'):
print("{} ({} bytes)".format(object.vol.type_name, object.vol.size))
volatility/cli/volshell/linux.py
+2 -2
View File
@@ -50,12 +50,12 @@ class Volshell(generic.Volshell):
self.change_task(self.config['pid'])
return result
def display_type(self, object: Union[str, interfaces.objects.ObjectInterface]):
def display_type(self, object: Union[str, interfaces.objects.ObjectInterface], offset: int = None):
"""Display Type describes the members of a particular object in alphabetical order"""
if isinstance(object, str):
if constants.BANG not in object:
object = self.config['vmlinux'] + constants.BANG + object
return super().display_type(object)
return super().display_type(object, offset)
def display_symbols(self, symbol_table: str = None):
"""Prints an alphabetical list of symbols for a symbol table"""
volatility/cli/volshell/mac.py
+2 -2
View File
@@ -50,12 +50,12 @@ class Volshell(generic.Volshell):
self.change_task(self.config['pid'])
return result
def display_type(self, object: Union[str, interfaces.objects.ObjectInterface]):
def display_type(self, object: Union[str, interfaces.objects.ObjectInterface], offset: int = None):
"""Display Type describes the members of a particular object in alphabetical order"""
if isinstance(object, str):
if constants.BANG not in object:
object = self.config['darwin'] + constants.BANG + object
return super().display_type(object)
return super().display_type(object, offset)
def display_symbols(self, symbol_table: str = None):
"""Prints an alphabetical list of symbols for a symbol table"""
volatility/cli/volshell/windows.py
+2 -2
View File
@@ -47,12 +47,12 @@ class Volshell(generic.Volshell):
self.change_process(self.config['pid'])
return result
def display_type(self, object: Union[str, interfaces.objects.ObjectInterface]):
def display_type(self, object: Union[str, interfaces.objects.ObjectInterface], offset: int = None):
"""Display Type describes the members of a particular object in alphabetical order"""
if isinstance(object, str):
if constants.BANG not in object:
object = self.config['nt_symbols'] + constants.BANG + object
return super().display_type(object)
return super().display_type(object, offset)
def display_symbols(self, symbol_table: str = None):
"""Prints an alphabetical list of symbols for a symbol table"""