Allow enumeration dictionaries to be accessed through the SymbolSpace directly.

volatility/framework/interfaces/symbols.py

@@ -130,6 +130,10 @@ class BaseSymbolTableInterface(validity.ValidityRoutines):
         if closest_symbol.offset == offset:
             yield closest_symbol.name
 
+    def get_enumeration_choices(self, name):
+        """Returns a dictionary of enumeration choices based on a particular Enumeration name"""
+        raise NotImplementedError("Abstract method get_enumeration_choices not implemented yet")
+
 
 class SymbolTableInterface(BaseSymbolTableInterface, configuration.ConfigurableInterface):
     """Handles a table of symbols"""
@@ -155,3 +159,6 @@ class NativeTableInterface(BaseSymbolTableInterface):
     @property
     def symbols(self):
         return []
+
+    def get_enumeration_choices(self, name):
+        raise exceptions.SymbolError("NativeTables never hold enumerations")

volatility/framework/symbols/__init__.py

@@ -173,3 +173,13 @@ class SymbolSpace(collections.abc.Mapping):
     def get_symbol(self, symbol_name):
         """Look-up a symbol name across all the contained symbol spaces"""
         return self._weak_resolve(SymbolType.SYMBOL, symbol_name)
+
+    def get_enumeration_choices(self, name):
+        """Look-up a set of enumeration choices from a specific symbol table"""
+        namearr = name.split(constants.BANG)
+        if len(namearr) != 2:
+            raise exceptions.SymbolError("Malformed enumeration name: {}".format(name))
+        table, enum = namearr
+        if table not in self._dict:
+            raise exceptions.SymbolError("Unresolvable enumeration requested: {}".format(name))
+        return self._dict[table].get_enumeration_choices(enum)

volatility/framework/symbols/intermed.py

@@ -96,6 +96,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface):
     get_type_class = _construct_delegate_function('get_type_class')
     set_type_class = _construct_delegate_function('set_type_class')
     del_type_class = _construct_delegate_function('del_type_class')
+    get_enumeration_choices = _construct_delegate_function('get_enumeration_choices')
 
 
 class ISFormatTable(interfaces.symbols.SymbolTableInterface):
@@ -225,6 +226,10 @@ class Version1Format(ISFormatTable):
                   "base_type": self.natives.get_type(lookup['base'])}
         return result
 
+    def get_enumeration_choices(self, name):
+        """Returns the dictionary of choices for the enumeration"""
+        return self._lookup_enum(name)['choices']
+
     def get_type(self, type_name):
         """Resolves an individual symbol"""
         if constants.BANG in type_name: