diff --git a/volatility/framework/interfaces/symbols.py b/volatility/framework/interfaces/symbols.py index 454b7e474..27cf916cc 100644 --- a/volatility/framework/interfaces/symbols.py +++ b/volatility/framework/interfaces/symbols.py @@ -6,6 +6,7 @@ Created on 4 May 2013 import bisect from volatility.framework import constants, exceptions, validity +from volatility.framework.interfaces import configuration class Symbol(validity.ValidityRoutines): @@ -36,9 +37,7 @@ class Symbol(validity.ValidityRoutines): return self._address -class SymbolTableInterface(validity.ValidityRoutines): - """Handles a table of symbols""" - +class BaseSymbolTableInterface(validity.ValidityRoutines): def __init__(self, name, native_types = None): self._check_type(native_types, NativeTableInterface) if name: @@ -132,7 +131,22 @@ class SymbolTableInterface(validity.ValidityRoutines): yield closest_symbol.name -class NativeTableInterface(SymbolTableInterface): +class SymbolTableInterface(BaseSymbolTableInterface, configuration.ConfigurableInterface): + """Handles a table of symbols""" + + def __init__(self, context, config_path, name, native_types = None): + configuration.ConfigurableInterface.__init__(self, context, config_path) + BaseSymbolTableInterface.__init__(self, name, native_types) + + def build_configuration(self): + config = super().build_configuration() + + # Translation Layers are constructable, and therefore require a class configuration variable + config["class"] = self.__class__.__module__ + "." + self.__class__.__name__ + return config + + +class NativeTableInterface(BaseSymbolTableInterface): """Class to distinguish NativeSymbolLists from other symbol lists""" def get_symbol(self, name): diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 0b9a6c078..864dc44d7 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -24,7 +24,7 @@ def _construct_delegate_function(name, is_property = False): class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): - def __init__(self, name, idd_filepath, native_types = None): + def __init__(self, context, config_path, name, idd_filepath, native_types = None): # Check there are no obvious errors url = urllib.parse.urlparse(idd_filepath) if url.scheme != 'file': @@ -47,11 +47,14 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): metadata = json_object.get('metadata', None) # Determine the delegate or throw an exception - self._delegate = self._closest_version(metadata.get('format', "0.0.0"), self._versions)(name, json_object, + self._delegate = self._closest_version(metadata.get('format', "0.0.0"), self._versions)(context, + config_path, + name, + json_object, native_types) # Inherit - super().__init__(name, native_types or self._delegate.natives) + super().__init__(context, config_path, name, native_types or self._delegate.natives) def _closest_version(self, version, versions): """Determines the highest suitable handler for specified version format""" @@ -83,11 +86,11 @@ class Version1Format(ISFormatTable): age = 1 version = (current - age, age, revision) - def __init__(self, name, json_object, native_types = None): + def __init__(self, context, config_path, name, json_object, native_types = None): self._json_object = json_object self._validate_json() nt = native_types or self._get_natives() - super().__init__(name, nt) + super().__init__(context, config_path, name, nt) self._overrides = {} self._symbol_cache = None diff --git a/volatility/framework/symbols/windows/__init__.py b/volatility/framework/symbols/windows/__init__.py index 5d043121c..c54c23d78 100644 --- a/volatility/framework/symbols/windows/__init__.py +++ b/volatility/framework/symbols/windows/__init__.py @@ -9,7 +9,7 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): provides = {"type": "interface"} def __init__(self, context, config_path, name, idd_filepath): - super().__init__(name = name, idd_filepath = idd_filepath) + super().__init__(context = context, config_path = config_path, name = name, idd_filepath = idd_filepath) # Set-up windows specific types self.set_type_class('_ETHREAD', extensions._ETHREAD)