From d6741435ef2bcfada0089fe1e5390d79c7b55957 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 31 May 2020 01:56:14 +0100 Subject: [PATCH] SymbolTables: Clear out the clone method and tidy up inheritance --- volatility/framework/interfaces/symbols.py | 3 --- volatility/framework/symbols/intermed.py | 18 ++++++------------ volatility/framework/symbols/linux/__init__.py | 5 ++--- volatility/framework/symbols/mac/__init__.py | 5 ++--- .../framework/symbols/windows/__init__.py | 5 ++--- 5 files changed, 12 insertions(+), 24 deletions(-) diff --git a/volatility/framework/interfaces/symbols.py b/volatility/framework/interfaces/symbols.py index 5b04e3f02..d95b64d11 100644 --- a/volatility/framework/interfaces/symbols.py +++ b/volatility/framework/interfaces/symbols.py @@ -210,9 +210,6 @@ class BaseSymbolTableInterface: yield sort_symbols[result][1] result += 1 - def clone(self, new_name: str): - """Constructs a new copy of the symbol_table under a different name""" - class SymbolSpaceInterface(collections.abc.Mapping): """An interface for the container that holds all the symbol-containing diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 1c51efa4b..4dd4a51ae 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -83,7 +83,8 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): native_types: interfaces.symbols.NativeTableInterface = None, table_mapping: Optional[Dict[str, str]] = None, validate: bool = True, - class_types: Optional[Mapping[str, Type[interfaces.objects.ObjectInterface]]] = None) -> None: + class_types: Optional[Mapping[str, Type[interfaces.objects.ObjectInterface]]] = None, + symbol_shift: int = 0) -> None: """Instantiates a SymbolTable based on an IntermediateSymbolFormat JSON file. This is validated against the appropriate schema. The validation can be disabled by passing validate = False, but this should almost never be done. @@ -208,7 +209,8 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): filename: str, native_types: Optional[interfaces.symbols.NativeTableInterface] = None, table_mapping: Optional[Dict[str, str]] = None, - class_types: Optional[Mapping[str, Type[interfaces.objects.ObjectInterface]]] = None) -> str: + class_types: Optional[Mapping[str, Type[interfaces.objects.ObjectInterface]]] = None, + symbol_shift: int = 0) -> str: """Takes a context and loads an intermediate symbol table based on a filename. @@ -233,7 +235,8 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): isf_url = urls[0], native_types = native_types, table_mapping = table_mapping, - class_types = class_types) + class_types = class_types, + symbol_shift = symbol_shift) context.symbol_space.append(table) return table_name @@ -246,15 +249,6 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): name = 'symbol_shift', description = 'Symbol Shift', optional = True, default = 0) ] - def clone(self, new_name: str): - return IntermediateSymbolTable(self._context, - self.config_path, - new_name, - isf_url = self._isf_url, - native_types = self._native_types, - table_mapping = self.table_mapping, - class_types = self._delegate._overrides) - class ISFormatTable(interfaces.symbols.SymbolTableInterface, metaclass = ABCMeta): """Provide a base class to identify all subclasses.""" diff --git a/volatility/framework/symbols/linux/__init__.py b/volatility/framework/symbols/linux/__init__.py index f4d3a6ce7..352ac48c6 100644 --- a/volatility/framework/symbols/linux/__init__.py +++ b/volatility/framework/symbols/linux/__init__.py @@ -2,7 +2,6 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import interfaces from volatility.framework.symbols import intermed from volatility.framework.symbols.linux import extensions @@ -10,8 +9,8 @@ from volatility.framework.symbols.linux import extensions class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): provides = {"type": "interface"} - def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, isf_url: str) -> None: - super().__init__(context = context, config_path = config_path, name = name, isf_url = isf_url) + def __init__(self, *args, **kwargs) -> None: + super().__init__(*args, **kwargs) # Set-up Linux specific types self.set_type_class('file', extensions.struct_file) diff --git a/volatility/framework/symbols/mac/__init__.py b/volatility/framework/symbols/mac/__init__.py index 1842d7251..9a4283217 100644 --- a/volatility/framework/symbols/mac/__init__.py +++ b/volatility/framework/symbols/mac/__init__.py @@ -2,7 +2,6 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import interfaces from volatility.framework.symbols import intermed from volatility.framework.symbols.mac import extensions @@ -10,8 +9,8 @@ from volatility.framework.symbols.mac import extensions class MacKernelIntermedSymbols(intermed.IntermediateSymbolTable): provides = {"type": "interface"} - def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, isf_url: str) -> None: - super().__init__(context = context, config_path = config_path, name = name, isf_url = isf_url) + def __init__(self, *args, **kwargs) -> None: + super().__init__(*args, **kwargs) self.set_type_class('proc', extensions.proc) self.set_type_class('fileglob', extensions.fileglob) diff --git a/volatility/framework/symbols/windows/__init__.py b/volatility/framework/symbols/windows/__init__.py index a1af09f4c..1c376ac09 100644 --- a/volatility/framework/symbols/windows/__init__.py +++ b/volatility/framework/symbols/windows/__init__.py @@ -2,7 +2,6 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import volatility.framework.symbols.windows.extensions.pool -from volatility.framework import interfaces from volatility.framework.symbols import intermed from volatility.framework.symbols.windows import extensions from volatility.framework.symbols.windows.extensions import registry, pool @@ -10,8 +9,8 @@ from volatility.framework.symbols.windows.extensions import registry, pool class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): - def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, isf_url: str) -> None: - super().__init__(context = context, config_path = config_path, name = name, isf_url = isf_url) + def __init__(self, *args, **kwargs) -> None: + super().__init__(*args, **kwargs) # Set-up windows specific types self.set_type_class('_ETHREAD', extensions.ETHREAD)