Add in support for specific symbol directories.

volatility/cli/__init__.py

@@ -85,6 +85,8 @@ class CommandLine(interfaces.plugins.FileConsumerInterface):
                             action = 'append')
         parser.add_argument("-p", "--plugin-dirs", help = "Semi-colon separated list of paths to find plugins",
                             default = "", type = str)
+        parser.add_argument("-s", "--symbol-dirs", help = "Semi-colon separated list of paths to find symbols",
+                            default = "", type = str)
         parser.add_argument("-v", "--verbosity", help = "Increase output verbosity", default = 0, action = "count")
         parser.add_argument("-o", "--output-dir", help = "Directory in which to output any generated files",
                             default = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..')), type = str)
@@ -104,6 +106,9 @@ class CommandLine(interfaces.plugins.FileConsumerInterface):
         if partial_args.plugin_dirs:
             volatility.plugins.__path__ = partial_args.plugin_dirs.split(";") + constants.PLUGINS_PATH
 
+        if partial_args.symbol_dirs:
+            volatility.symbols.__path__ = partial_args.symbol_dirs.split(";") + constants.SYMBOL_BASEPATHS
+
         if partial_args.log:
             file_logger = logging.FileHandler(partial_args.log)
             file_logger.setLevel(0)

volatility/framework/symbols/intermed.py

@@ -9,7 +9,8 @@ import typing
 import zipfile
 from abc import ABCMeta
 
-from volatility import schemas
+import volatility
+from volatility import schemas, symbols
 from volatility.framework import class_subclasses, constants, exceptions, interfaces, objects, layers
 from volatility.framework.symbols import native
 
@@ -138,7 +139,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface):
         if filename is None:
             filename = "*"
         # Check user symbol directory first, then fallback to the framework's library to allow for overloading
-        for path in constants.SYMBOL_BASEPATHS:
+        for path in volatility.symbols.__path__:
             if not os.path.isabs(path):
                 path = os.path.abspath(os.path.join(__file__, path))
             for extension in extensions:
@@ -170,7 +171,16 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface):
                table_mapping: typing.Optional[typing.Dict[str, str]] = None) -> str:
         """Takes a context and loads an intermediate symbol table based on a filename.
 
-        Returns the name of the added symbol table"""
+        Args:
+            context: The context that the current plugin is being run within
+            config_path: The configuration path for reading/storing configuration information this symbol table may use
+            sub_path: The path under a suitable symbol path (defaults to volatility/symbols and volatility/framework/symbols) to check
+            filename: Basename of the file to find under the sub_path
+            native_types: Set of native types, defaults to native types read from the intermediate symbol format file
+            table_mapping: a dictionary of table names mentioned within the ISF file, and the tables within the context which they map to
+
+        Returns:
+             the name of the added symbol table"""
         urls = list(cls.file_symbol_url(sub_path, filename))
         if not urls:
             raise ValueError("No symbol files found at provided filename: {}", filename)

volatility/symbols/__init__.py

@@ -0,0 +1,8 @@
+"""Defines the symbols architecture
+
+   This is the namespace for all volatility symbols,
+   and determines the path for loading symbol ISF files
+"""
+from volatility.framework import constants
+
+__path__ = constants.SYMBOL_BASEPATHS