Shift around the object_factory and add the symbol rebaser.

The object_factory is now a separate function, but to ease the
transition the object_factory method in Context has been left.
I'll most likely deprecate it before the full release, but I'm open the
idea of leaving it if someone can convince me it's a better decision.

volatility/framework/contexts/__init__.py

@@ -4,8 +4,9 @@ This has been made an object to allow quick swapping and changing of contexts, t
 to act on multiple different contexts without them interfering eith each other.
 """
 
-from volatility.framework import constants, interfaces, symbols
+from volatility.framework import interfaces, symbols
 from volatility.framework.interfaces.configuration import HierarchicalDict
+from volatility.framework.utility import adapters
 
 __author__ = 'mike'
 
@@ -97,17 +98,8 @@ class Context(interfaces.context.ContextInterface):
                                                                                   offset = offset))
 
     def object_factory(self, symbol_table):
-        """Allow a specific symbol_table to be used repeatedly for constructing objects
+        """This method is DEPRECATED and provided only as a convenience.
 
-        :param symbol_table: The name of the symbol table that the object factory will construct objects on
-        :type sybmol_table: str
-        :return: A function that takes the same arguments as :func:`object`
+        It will be removed in volatility 3.0.0 final release.
         """
-
-        def callable(symbol, layer_name, offset, **arguments):
-            """Function to apply a specific symbol_table name to any unadored"""
-            if constants.BANG not in symbol:
-                symbol = symbol_table + constants.BANG + symbol
-            return self.object(symbol, layer_name, offset, **arguments)
-
-        return callable
+        return adapters.object_factory(self, symbol_table)

volatility/framework/utility/adapters.py

@@ -0,0 +1,47 @@
+from volatility.framework import constants
+from volatility.framework import interfaces
+
+
+def object_factory(context, symbol_table):
+    """Allow a specific symbol_table to be used repeatedly for constructing objects
+
+    :param symbol_table: The name of the symbol table that the object factory will construct objects on
+    :type sybmol_table: str
+    :return: A function that takes the same arguments as :func:`object`
+    """
+
+    def callable(symbol, layer_name, offset, **arguments):
+        """Function to apply a specific symbol_table name to any unadorned symbol creation"""
+        if constants.BANG not in symbol:
+            symbol = symbol_table + constants.BANG + symbol
+        return context.object(symbol, layer_name, offset, **arguments)
+
+    return callable
+
+
+def get_symbol_rebase(symbol_space, offset, symbol_table = None):
+    """Construct a get_symbol function based on a symbol_space to return symbols whose addresses are all
+     increased by a specific offset.
+
+    :param symbol_space: The symbol_space object to use for symbol lookups
+    :type symbol_space: str
+    :param offset: The amount by which all symbol addresses are to be adjusted
+    :param offset: int
+    :param symbol_table: The (optional) name of the symbol table that get_symbol will search when no table name is provided as part of the symbol
+    :type sybmol_table: str
+    :return: A function that takes the same arguments as :func:`object`
+    """
+    if not (symbol_table is None or isinstance(symbol_table, str)):
+        raise ValueError("symbol_table must be None or a string")
+
+    def callable(symbol_name):
+        """Function to apply a specific offset increase to returned symbols"""
+        if constants.BANG not in symbol_name and symbol_table:
+            symbol_name = symbol_table + constants.BANG + symbol_name
+        symbol = symbol_space.get_symbol(symbol_name)
+        new_symbol = interfaces.symbols.Symbol(name = symbol.name,
+                                               address = symbol.address + offset,
+                                               type = symbol.type)
+        return new_symbol
+
+    return callable

volatility/plugins/windows/pslist.py

@@ -1,6 +1,7 @@
 import volatility.framework.interfaces.plugins as plugins
 from volatility.framework.configuration import requirements
 from volatility.framework.renderers import TreeGrid
+from volatility.framework.utility import adapters
 
 
 class PsList(plugins.PluginInterface):
@@ -30,7 +31,7 @@ class PsList(plugins.PluginInterface):
         layer_name = self.config['primary']
 
         # We only use the object factory to demonstrate how to use one
-        object_factory = self.context.object_factory("ntkrnlmp")
+        object_factory = adapters.object_factory(self.context, "ntkrnlmp")
 
         kvo = self.config['primary.kernel_virtual_offset']
         ps_aph_offset = kvo + self.context.symbol_space.get_symbol("ntkrnlmp!PsActiveProcessHead").address