From dcc558717c5bbda87a529f7f11febe9cd73b3777 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 24 Mar 2017 01:50:16 +0000 Subject: [PATCH] Shift around the object_factory and add the symbol rebaser. The object_factory is now a separate function, but to ease the transition the object_factory method in Context has been left. I'll most likely deprecate it before the full release, but I'm open the idea of leaving it if someone can convince me it's a better decision. --- volatility/framework/contexts/__init__.py | 18 +++------ volatility/framework/utility/adapters.py | 47 +++++++++++++++++++++++ volatility/plugins/windows/pslist.py | 3 +- 3 files changed, 54 insertions(+), 14 deletions(-) create mode 100644 volatility/framework/utility/adapters.py diff --git a/volatility/framework/contexts/__init__.py b/volatility/framework/contexts/__init__.py index 6987c7429..dbe66290d 100644 --- a/volatility/framework/contexts/__init__.py +++ b/volatility/framework/contexts/__init__.py @@ -4,8 +4,9 @@ This has been made an object to allow quick swapping and changing of contexts, t to act on multiple different contexts without them interfering eith each other. """ -from volatility.framework import constants, interfaces, symbols +from volatility.framework import interfaces, symbols from volatility.framework.interfaces.configuration import HierarchicalDict +from volatility.framework.utility import adapters __author__ = 'mike' @@ -97,17 +98,8 @@ class Context(interfaces.context.ContextInterface): offset = offset)) def object_factory(self, symbol_table): - """Allow a specific symbol_table to be used repeatedly for constructing objects + """This method is DEPRECATED and provided only as a convenience. - :param symbol_table: The name of the symbol table that the object factory will construct objects on - :type sybmol_table: str - :return: A function that takes the same arguments as :func:`object` + It will be removed in volatility 3.0.0 final release. """ - - def callable(symbol, layer_name, offset, **arguments): - """Function to apply a specific symbol_table name to any unadored""" - if constants.BANG not in symbol: - symbol = symbol_table + constants.BANG + symbol - return self.object(symbol, layer_name, offset, **arguments) - - return callable + return adapters.object_factory(self, symbol_table) diff --git a/volatility/framework/utility/adapters.py b/volatility/framework/utility/adapters.py new file mode 100644 index 000000000..d2da338d5 --- /dev/null +++ b/volatility/framework/utility/adapters.py @@ -0,0 +1,47 @@ +from volatility.framework import constants +from volatility.framework import interfaces + + +def object_factory(context, symbol_table): + """Allow a specific symbol_table to be used repeatedly for constructing objects + + :param symbol_table: The name of the symbol table that the object factory will construct objects on + :type sybmol_table: str + :return: A function that takes the same arguments as :func:`object` + """ + + def callable(symbol, layer_name, offset, **arguments): + """Function to apply a specific symbol_table name to any unadorned symbol creation""" + if constants.BANG not in symbol: + symbol = symbol_table + constants.BANG + symbol + return context.object(symbol, layer_name, offset, **arguments) + + return callable + + +def get_symbol_rebase(symbol_space, offset, symbol_table = None): + """Construct a get_symbol function based on a symbol_space to return symbols whose addresses are all + increased by a specific offset. + + :param symbol_space: The symbol_space object to use for symbol lookups + :type symbol_space: str + :param offset: The amount by which all symbol addresses are to be adjusted + :param offset: int + :param symbol_table: The (optional) name of the symbol table that get_symbol will search when no table name is provided as part of the symbol + :type sybmol_table: str + :return: A function that takes the same arguments as :func:`object` + """ + if not (symbol_table is None or isinstance(symbol_table, str)): + raise ValueError("symbol_table must be None or a string") + + def callable(symbol_name): + """Function to apply a specific offset increase to returned symbols""" + if constants.BANG not in symbol_name and symbol_table: + symbol_name = symbol_table + constants.BANG + symbol_name + symbol = symbol_space.get_symbol(symbol_name) + new_symbol = interfaces.symbols.Symbol(name = symbol.name, + address = symbol.address + offset, + type = symbol.type) + return new_symbol + + return callable diff --git a/volatility/plugins/windows/pslist.py b/volatility/plugins/windows/pslist.py index d6d044e97..769f483e4 100644 --- a/volatility/plugins/windows/pslist.py +++ b/volatility/plugins/windows/pslist.py @@ -1,6 +1,7 @@ import volatility.framework.interfaces.plugins as plugins from volatility.framework.configuration import requirements from volatility.framework.renderers import TreeGrid +from volatility.framework.utility import adapters class PsList(plugins.PluginInterface): @@ -30,7 +31,7 @@ class PsList(plugins.PluginInterface): layer_name = self.config['primary'] # We only use the object factory to demonstrate how to use one - object_factory = self.context.object_factory("ntkrnlmp") + object_factory = adapters.object_factory(self.context, "ntkrnlmp") kvo = self.config['primary.kernel_virtual_offset'] ps_aph_offset = kvo + self.context.symbol_space.get_symbol("ntkrnlmp!PsActiveProcessHead").address