Shift around the object_factory and add the symbol rebaser.

The object_factory is now a separate function, but to ease the
transition the object_factory method in Context has been left.
I'll most likely deprecate it before the full release, but I'm open the
idea of leaving it if someone can convince me it's a better decision.
This commit is contained in:
Mike Auty
2017-03-24 01:50:16 +00:00
parent 1db4922033
commit dcc558717c
3 changed files with 54 additions and 14 deletions
+2 -1
View File
@@ -1,6 +1,7 @@
import volatility.framework.interfaces.plugins as plugins
from volatility.framework.configuration import requirements
from volatility.framework.renderers import TreeGrid
from volatility.framework.utility import adapters
class PsList(plugins.PluginInterface):
@@ -30,7 +31,7 @@ class PsList(plugins.PluginInterface):
layer_name = self.config['primary']
# We only use the object factory to demonstrate how to use one
object_factory = self.context.object_factory("ntkrnlmp")
object_factory = adapters.object_factory(self.context, "ntkrnlmp")
kvo = self.config['primary.kernel_virtual_offset']
ps_aph_offset = kvo + self.context.symbol_space.get_symbol("ntkrnlmp!PsActiveProcessHead").address