diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index 4ce58664d..ae6302bb4 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -77,6 +77,10 @@ class Float(PrimitiveObject, float): """Primitive Object that handles double or floating point numbers""" _struct_type = float +class Char(PrimitiveObject, str): + """Primitive Object that handles characters""" + _struct_type = str + class Bytes(PrimitiveObject, bytes): """Primitive Object that handles specific series of bytes""" diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index e0ddbe940..de7c26acf 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -367,16 +367,16 @@ class Version4Format(Version3Format): age = 0 version = (current - age, age, revision) - format_str_mapping = {'int': {1: 'b', - 2: 'h', - 4: 'i', - 8: 'q'}, - 'float': {2: 'e', - 4: 'f', - 8: 'd'}, - 'void': {4: 'i'}, - 'bool': {1: '?'}, - 'char': {1: 'c'}} + format_str_mapping = {'int': ({1: 'b', + 2: 'h', + 4: 'i', + 8: 'q'}, objects.Integer), + 'float': ({2: 'e', + 4: 'f', + 8: 'd'}, objects.Float), + 'void': ({4: 'i'}, objects.Integer), + 'bool': ({1: '?'}, objects.Integer), + 'char': ({1: 'c'}, objects.Char)} def _get_natives(self): """Determines the appropriate native_types to use from the JSON data""" @@ -386,11 +386,13 @@ class Version4Format(Version3Format): # Void are ignored because voids are not a volatility primitive, they are a specific Volatility object if base_type != 'void': current = base_types[base_type] - size_map = self.format_str_mapping.get(current['kind'], {}) + size_map, object_type = self.format_str_mapping.get(current['kind'], ({}, None)) format_str = size_map.get(current['size'], None) - if format_str is None: + if format_str is None or object_type is None: raise ValueError("Unsupported kind/size combination in base_type {}".format(base_type)) format_str = format_str.lower() if current['signed'] or current['kind'] != 'int' else format_str.upper() format_str = ('<' if current['endian'] == 'little' else '>') + format_str - native_dict[base_type] = (objects.Integer, format_str) + if base_type == 'pointer': + object_type = objects.Pointer + native_dict[base_type] = (object_type, format_str) return native.NativeTable(name = "native", native_dictionary = native_dict) diff --git a/volatility/framework/symbols/native.py b/volatility/framework/symbols/native.py index 6cdda8f2e..3cbaa02cf 100644 --- a/volatility/framework/symbols/native.py +++ b/volatility/framework/symbols/native.py @@ -18,7 +18,7 @@ class NativeTable(interfaces.symbols.NativeTableInterface): {'enum', 'array', 'bitfield', 'void', 'pointer', 'string', 'bytes', 'function'}) def get_type_class(self, name): - ntype, fmt = native_types.get(name, (objects.Integer, '')) + ntype, fmt = self._native_dictionary.get(name, (objects.Integer, '')) return ntype @property