From ed716ca12aa032a4223a72cff510dd96914a0a7e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 12 Dec 2016 02:08:32 +0000 Subject: [PATCH] Convert SymbolTableInterfaces to descend from ConfigurableInterface This allows SymbolTables to hold actual requirements (which IntermedSymbolTable already did, but without pulling in the right interface). It means that values like kernel_virtual_offset get saved. We still need to figure out how to allow plugins to demand optional configuration values in other places (such as the kvo) but for now the plugin will barf if it doesn't get it. --- volatility/framework/interfaces/symbols.py | 22 +++++++++++++++---- volatility/framework/symbols/intermed.py | 13 ++++++----- .../framework/symbols/windows/__init__.py | 2 +- 3 files changed, 27 insertions(+), 10 deletions(-) diff --git a/volatility/framework/interfaces/symbols.py b/volatility/framework/interfaces/symbols.py index 454b7e474..27cf916cc 100644 --- a/volatility/framework/interfaces/symbols.py +++ b/volatility/framework/interfaces/symbols.py @@ -6,6 +6,7 @@ Created on 4 May 2013 import bisect from volatility.framework import constants, exceptions, validity +from volatility.framework.interfaces import configuration class Symbol(validity.ValidityRoutines): @@ -36,9 +37,7 @@ class Symbol(validity.ValidityRoutines): return self._address -class SymbolTableInterface(validity.ValidityRoutines): - """Handles a table of symbols""" - +class BaseSymbolTableInterface(validity.ValidityRoutines): def __init__(self, name, native_types = None): self._check_type(native_types, NativeTableInterface) if name: @@ -132,7 +131,22 @@ class SymbolTableInterface(validity.ValidityRoutines): yield closest_symbol.name -class NativeTableInterface(SymbolTableInterface): +class SymbolTableInterface(BaseSymbolTableInterface, configuration.ConfigurableInterface): + """Handles a table of symbols""" + + def __init__(self, context, config_path, name, native_types = None): + configuration.ConfigurableInterface.__init__(self, context, config_path) + BaseSymbolTableInterface.__init__(self, name, native_types) + + def build_configuration(self): + config = super().build_configuration() + + # Translation Layers are constructable, and therefore require a class configuration variable + config["class"] = self.__class__.__module__ + "." + self.__class__.__name__ + return config + + +class NativeTableInterface(BaseSymbolTableInterface): """Class to distinguish NativeSymbolLists from other symbol lists""" def get_symbol(self, name): diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 0b9a6c078..864dc44d7 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -24,7 +24,7 @@ def _construct_delegate_function(name, is_property = False): class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): - def __init__(self, name, idd_filepath, native_types = None): + def __init__(self, context, config_path, name, idd_filepath, native_types = None): # Check there are no obvious errors url = urllib.parse.urlparse(idd_filepath) if url.scheme != 'file': @@ -47,11 +47,14 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): metadata = json_object.get('metadata', None) # Determine the delegate or throw an exception - self._delegate = self._closest_version(metadata.get('format', "0.0.0"), self._versions)(name, json_object, + self._delegate = self._closest_version(metadata.get('format', "0.0.0"), self._versions)(context, + config_path, + name, + json_object, native_types) # Inherit - super().__init__(name, native_types or self._delegate.natives) + super().__init__(context, config_path, name, native_types or self._delegate.natives) def _closest_version(self, version, versions): """Determines the highest suitable handler for specified version format""" @@ -83,11 +86,11 @@ class Version1Format(ISFormatTable): age = 1 version = (current - age, age, revision) - def __init__(self, name, json_object, native_types = None): + def __init__(self, context, config_path, name, json_object, native_types = None): self._json_object = json_object self._validate_json() nt = native_types or self._get_natives() - super().__init__(name, nt) + super().__init__(context, config_path, name, nt) self._overrides = {} self._symbol_cache = None diff --git a/volatility/framework/symbols/windows/__init__.py b/volatility/framework/symbols/windows/__init__.py index 5d043121c..c54c23d78 100644 --- a/volatility/framework/symbols/windows/__init__.py +++ b/volatility/framework/symbols/windows/__init__.py @@ -9,7 +9,7 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): provides = {"type": "interface"} def __init__(self, context, config_path, name, idd_filepath): - super().__init__(name = name, idd_filepath = idd_filepath) + super().__init__(context = context, config_path = config_path, name = name, idd_filepath = idd_filepath) # Set-up windows specific types self.set_type_class('_ETHREAD', extensions._ETHREAD)