diff --git a/volatility/cli/volshell/generic.py b/volatility/cli/volshell/generic.py index 4d55fd9a0..37ee7b080 100644 --- a/volatility/cli/volshell/generic.py +++ b/volatility/cli/volshell/generic.py @@ -202,14 +202,20 @@ class Volshell(interfaces.plugins.PluginInterface): for i in disasm_types[architecture].disasm(remaining_data, offset): print("0x%x:\t%s\t%s" % (i.address, i.mnemonic, i.op_str)) - def display_type(self, object: Union[str, interfaces.objects.ObjectInterface, interfaces.objects.Template]): + def display_type(self, + object: Union[str, interfaces.objects.ObjectInterface, interfaces.objects.Template], + offset: int = None): """Display Type describes the members of a particular object in alphabetical order""" if not isinstance(object, (str, interfaces.objects.ObjectInterface, interfaces.objects.Template)): print("Cannot display information about non-type object") return - if isinstance(object, str): + if isinstance(object, str) and offset is None: object = self.context.symbol_space.get_type(object) + elif isinstance(object, str) and offset is not None: + object = self.context.object(object, layer_name = self.current_layer, offset = offset) + elif offset is not None: + object = self.context.object(object.vol.type_name, layer_name = self.current_layer, offset = offset) if hasattr(object.vol, 'size'): print("{} ({} bytes)".format(object.vol.type_name, object.vol.size)) diff --git a/volatility/cli/volshell/linux.py b/volatility/cli/volshell/linux.py index 316d97bdc..17c549232 100644 --- a/volatility/cli/volshell/linux.py +++ b/volatility/cli/volshell/linux.py @@ -50,12 +50,12 @@ class Volshell(generic.Volshell): self.change_task(self.config['pid']) return result - def display_type(self, object: Union[str, interfaces.objects.ObjectInterface]): + def display_type(self, object: Union[str, interfaces.objects.ObjectInterface], offset: int = None): """Display Type describes the members of a particular object in alphabetical order""" if isinstance(object, str): if constants.BANG not in object: object = self.config['vmlinux'] + constants.BANG + object - return super().display_type(object) + return super().display_type(object, offset) def display_symbols(self, symbol_table: str = None): """Prints an alphabetical list of symbols for a symbol table""" diff --git a/volatility/cli/volshell/mac.py b/volatility/cli/volshell/mac.py index 48fb52f94..55de027e8 100644 --- a/volatility/cli/volshell/mac.py +++ b/volatility/cli/volshell/mac.py @@ -50,12 +50,12 @@ class Volshell(generic.Volshell): self.change_task(self.config['pid']) return result - def display_type(self, object: Union[str, interfaces.objects.ObjectInterface]): + def display_type(self, object: Union[str, interfaces.objects.ObjectInterface], offset: int = None): """Display Type describes the members of a particular object in alphabetical order""" if isinstance(object, str): if constants.BANG not in object: object = self.config['darwin'] + constants.BANG + object - return super().display_type(object) + return super().display_type(object, offset) def display_symbols(self, symbol_table: str = None): """Prints an alphabetical list of symbols for a symbol table""" diff --git a/volatility/cli/volshell/windows.py b/volatility/cli/volshell/windows.py index 643e95250..4ba7b0a22 100644 --- a/volatility/cli/volshell/windows.py +++ b/volatility/cli/volshell/windows.py @@ -47,12 +47,12 @@ class Volshell(generic.Volshell): self.change_process(self.config['pid']) return result - def display_type(self, object: Union[str, interfaces.objects.ObjectInterface]): + def display_type(self, object: Union[str, interfaces.objects.ObjectInterface], offset: int = None): """Display Type describes the members of a particular object in alphabetical order""" if isinstance(object, str): if constants.BANG not in object: object = self.config['nt_symbols'] + constants.BANG + object - return super().display_type(object) + return super().display_type(object, offset) def display_symbols(self, symbol_table: str = None): """Prints an alphabetical list of symbols for a symbol table"""