From def6de51bd95e5a05d54d11683f8f1f4e3ad4c65 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 9 Nov 2017 23:11:05 +0000 Subject: [PATCH] Add in the ability to get a symbol table from a specific object (often self.get_symbol_table). --- volatility/framework/interfaces/objects.py | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/volatility/framework/interfaces/objects.py b/volatility/framework/interfaces/objects.py index b6f41b57e..28fb478ef 100644 --- a/volatility/framework/interfaces/objects.py +++ b/volatility/framework/interfaces/objects.py @@ -3,11 +3,14 @@ import collections import collections.abc +import logging from abc import ABCMeta, abstractmethod from volatility.framework import constants, validity from volatility.framework.interfaces import context as interfaces_context +vollog = logging.getLogger(__name__) + class ReadOnlyMapping(validity.ValidityRoutines, collections.abc.Mapping): """A read-only mapping of various values that offer attribute access as well @@ -98,6 +101,19 @@ class ObjectInterface(validity.ValidityRoutines, metaclass = ABCMeta): Raises InvalidDataException on failure to validate the data correctly. """ + def get_symbol_table(self): + """Returns the symbol table for this particular object + + Returns none if the symbol table cannot be identified. + """ + if constants.BANG not in self.vol.type_name: + vollog.debug("Unable to determine table for symbol: {}".format(self.vol.type_name)) + return None + table_name = self.vol.type_name[:self.vol.type_name.index(constants.BANG)] + if table_name not in self._context.symbol_space: + vollog.debug("Symbol table not found in context's symbol_space for symbol: {}".format(self.vol.type_name)) + return self._context.symbol_space[table_name] + def cast(self, new_type_name, **additional): """Returns a new object at the offset and from the layer that the current object inhabits