diff --git a/volatility/framework/interfaces/symbols.py b/volatility/framework/interfaces/symbols.py index 27cf916cc..47ed44302 100644 --- a/volatility/framework/interfaces/symbols.py +++ b/volatility/framework/interfaces/symbols.py @@ -130,6 +130,10 @@ class BaseSymbolTableInterface(validity.ValidityRoutines): if closest_symbol.offset == offset: yield closest_symbol.name + def get_enumeration_choices(self, name): + """Returns a dictionary of enumeration choices based on a particular Enumeration name""" + raise NotImplementedError("Abstract method get_enumeration_choices not implemented yet") + class SymbolTableInterface(BaseSymbolTableInterface, configuration.ConfigurableInterface): """Handles a table of symbols""" @@ -155,3 +159,6 @@ class NativeTableInterface(BaseSymbolTableInterface): @property def symbols(self): return [] + + def get_enumeration_choices(self, name): + raise exceptions.SymbolError("NativeTables never hold enumerations") diff --git a/volatility/framework/symbols/__init__.py b/volatility/framework/symbols/__init__.py index 8f59cdded..30cd80b47 100644 --- a/volatility/framework/symbols/__init__.py +++ b/volatility/framework/symbols/__init__.py @@ -173,3 +173,13 @@ class SymbolSpace(collections.abc.Mapping): def get_symbol(self, symbol_name): """Look-up a symbol name across all the contained symbol spaces""" return self._weak_resolve(SymbolType.SYMBOL, symbol_name) + + def get_enumeration_choices(self, name): + """Look-up a set of enumeration choices from a specific symbol table""" + namearr = name.split(constants.BANG) + if len(namearr) != 2: + raise exceptions.SymbolError("Malformed enumeration name: {}".format(name)) + table, enum = namearr + if table not in self._dict: + raise exceptions.SymbolError("Unresolvable enumeration requested: {}".format(name)) + return self._dict[table].get_enumeration_choices(enum) diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 4ea5dfec7..bd2591cae 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -96,6 +96,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): get_type_class = _construct_delegate_function('get_type_class') set_type_class = _construct_delegate_function('set_type_class') del_type_class = _construct_delegate_function('del_type_class') + get_enumeration_choices = _construct_delegate_function('get_enumeration_choices') class ISFormatTable(interfaces.symbols.SymbolTableInterface): @@ -225,6 +226,10 @@ class Version1Format(ISFormatTable): "base_type": self.natives.get_type(lookup['base'])} return result + def get_enumeration_choices(self, name): + """Returns the dictionary of choices for the enumeration""" + return self._lookup_enum(name)['choices'] + def get_type(self, type_name): """Resolves an individual symbol""" if constants.BANG in type_name: