mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-26 19:44:50 +02:00
Shift around the object_factory and add the symbol rebaser.
The object_factory is now a separate function, but to ease the transition the object_factory method in Context has been left. I'll most likely deprecate it before the full release, but I'm open the idea of leaving it if someone can convince me it's a better decision.
This commit is contained in:
@@ -1,6 +1,7 @@
|
||||
import volatility.framework.interfaces.plugins as plugins
|
||||
from volatility.framework.configuration import requirements
|
||||
from volatility.framework.renderers import TreeGrid
|
||||
from volatility.framework.utility import adapters
|
||||
|
||||
|
||||
class PsList(plugins.PluginInterface):
|
||||
@@ -30,7 +31,7 @@ class PsList(plugins.PluginInterface):
|
||||
layer_name = self.config['primary']
|
||||
|
||||
# We only use the object factory to demonstrate how to use one
|
||||
object_factory = self.context.object_factory("ntkrnlmp")
|
||||
object_factory = adapters.object_factory(self.context, "ntkrnlmp")
|
||||
|
||||
kvo = self.config['primary.kernel_virtual_offset']
|
||||
ps_aph_offset = kvo + self.context.symbol_space.get_symbol("ntkrnlmp!PsActiveProcessHead").address
|
||||
|
||||
Reference in New Issue
Block a user