diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index c800038b6..0464f9a03 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -85,6 +85,8 @@ class CommandLine(interfaces.plugins.FileConsumerInterface): action = 'append') parser.add_argument("-p", "--plugin-dirs", help = "Semi-colon separated list of paths to find plugins", default = "", type = str) + parser.add_argument("-s", "--symbol-dirs", help = "Semi-colon separated list of paths to find symbols", + default = "", type = str) parser.add_argument("-v", "--verbosity", help = "Increase output verbosity", default = 0, action = "count") parser.add_argument("-o", "--output-dir", help = "Directory in which to output any generated files", default = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..')), type = str) @@ -104,6 +106,9 @@ class CommandLine(interfaces.plugins.FileConsumerInterface): if partial_args.plugin_dirs: volatility.plugins.__path__ = partial_args.plugin_dirs.split(";") + constants.PLUGINS_PATH + if partial_args.symbol_dirs: + volatility.symbols.__path__ = partial_args.symbol_dirs.split(";") + constants.SYMBOL_BASEPATHS + if partial_args.log: file_logger = logging.FileHandler(partial_args.log) file_logger.setLevel(0) diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 1f9db6d98..73e2cc2f0 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -9,7 +9,8 @@ import typing import zipfile from abc import ABCMeta -from volatility import schemas +import volatility +from volatility import schemas, symbols from volatility.framework import class_subclasses, constants, exceptions, interfaces, objects, layers from volatility.framework.symbols import native @@ -138,7 +139,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): if filename is None: filename = "*" # Check user symbol directory first, then fallback to the framework's library to allow for overloading - for path in constants.SYMBOL_BASEPATHS: + for path in volatility.symbols.__path__: if not os.path.isabs(path): path = os.path.abspath(os.path.join(__file__, path)) for extension in extensions: @@ -170,7 +171,16 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): table_mapping: typing.Optional[typing.Dict[str, str]] = None) -> str: """Takes a context and loads an intermediate symbol table based on a filename. - Returns the name of the added symbol table""" + Args: + context: The context that the current plugin is being run within + config_path: The configuration path for reading/storing configuration information this symbol table may use + sub_path: The path under a suitable symbol path (defaults to volatility/symbols and volatility/framework/symbols) to check + filename: Basename of the file to find under the sub_path + native_types: Set of native types, defaults to native types read from the intermediate symbol format file + table_mapping: a dictionary of table names mentioned within the ISF file, and the tables within the context which they map to + + Returns: + the name of the added symbol table""" urls = list(cls.file_symbol_url(sub_path, filename)) if not urls: raise ValueError("No symbol files found at provided filename: {}", filename) diff --git a/volatility/symbols/__init__.py b/volatility/symbols/__init__.py index e69de29bb..260e1af45 100644 --- a/volatility/symbols/__init__.py +++ b/volatility/symbols/__init__.py @@ -0,0 +1,8 @@ +"""Defines the symbols architecture + + This is the namespace for all volatility symbols, + and determines the path for loading symbol ISF files +""" +from volatility.framework import constants + +__path__ = constants.SYMBOL_BASEPATHS