diff --git a/volatility/framework/interfaces/symbols.py b/volatility/framework/interfaces/symbols.py index 946b1ec8b..ba5f4caf0 100644 --- a/volatility/framework/interfaces/symbols.py +++ b/volatility/framework/interfaces/symbols.py @@ -208,6 +208,9 @@ class BaseSymbolTableInterface: yield sort_symbols[result][1] result += 1 + def clone(self, new_name: str): + """Constructs a new copy of the symbol_table under a different name""" + class SymbolSpaceInterface(collections.abc.Mapping): """An interface for the container that holds all the symbol-containing diff --git a/volatility/framework/symbols/__init__.py b/volatility/framework/symbols/__init__.py index 07f63ada9..7b21abcf3 100644 --- a/volatility/framework/symbols/__init__.py +++ b/volatility/framework/symbols/__init__.py @@ -4,7 +4,6 @@ import collections import collections.abc -import copy import enum import functools import logging @@ -254,15 +253,16 @@ def mask_symbol_table(context: interfaces.context.ContextInterface, """Alters a symbol table, such that all symbols returned have their address masked by the address mask.""" original_table = context.symbol_space[symbol_table_name] - new_table = copy.deepcopy(original_table) - new_table.name = context.symbol_space.free_table_name(original_table.name + '_masked'.format()) + new_table_name = context.symbol_space.free_table_name(original_table.name + '_masked'.format()) + new_table = original_table.clone(new_table_name) context.symbol_space.append(new_table) + new_table_get_symbol = new_table.get_symbol cached_symbols = {} # type: Dict[interfaces.symbols.SymbolInterface, interfaces.symbols.SymbolInterface] - @functools.wraps(original_table.get_symbol) + @functools.wraps(new_table_get_symbol) def address_masked_get_symbol(*args, **kwargs): - symbol = original_table.get_symbol(*args, **kwargs) + symbol = new_table_get_symbol(*args, **kwargs) # This is speedy, but may not be very efficient from a memory perspective if symbol in cached_symbols: return cached_symbols[symbol] diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index f08881b90..b442f9b1a 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -100,8 +100,9 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): """ # Check there are no obvious errors # Open the file and test the version + self._isf_url = isf_url self._versions = dict([(x.version, x) for x in class_subclasses(ISFormatTable)]) - fp = volatility.framework.layers.resources.ResourceAccessor().open(isf_url) + fp = volatility.framework.layers.resources.ResourceAccessor().open(self._isf_url) reader = codecs.getreader("utf-8") json_object = json.load(reader(fp)) # type: ignore fp.close() @@ -243,6 +244,18 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): "isf_url", description = "JSON file containing the symbols encoded in the Intermediate Symbol Format") ] + def clone(self, new_name: str): + print(self._delegate._overrides) + import pdb + pdb.set_trace() + return IntermediateSymbolTable(self._context, + self.config_path, + new_name, + isf_url = self._isf_url, + native_types = self._native_types, + table_mapping = self.table_mapping, + class_types = self._delegate._overrides) + class ISFormatTable(interfaces.symbols.SymbolTableInterface, metaclass = ABCMeta): """Provide a base class to identify all subclasses."""