From efd9dffdfe7370071467b6f602f55abd7182ef68 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 16 Sep 2018 14:33:24 +0100 Subject: [PATCH] Fix up the passing of native_layer_name to object constructors. --- volatility/framework/contexts/__init__.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/volatility/framework/contexts/__init__.py b/volatility/framework/contexts/__init__.py index 22381bff3..c058ed3ff 100644 --- a/volatility/framework/contexts/__init__.py +++ b/volatility/framework/contexts/__init__.py @@ -74,6 +74,7 @@ class Context(interfaces.context.ContextInterface): symbol: typing.Union[str, interfaces.objects.Template], layer_name: str, offset: int, + native_layer_name: typing.Optional[str] = None, **arguments) -> interfaces.objects.ObjectInterface: """Object factory, takes a context, symbol, offset and optional layername @@ -99,7 +100,8 @@ class Context(interfaces.context.ContextInterface): object_template.update_vol(**arguments) return object_template(context = self, object_info = interfaces.objects.ObjectInformation(layer_name = layer_name, - offset = offset)) + offset = offset, + native_layer_name = native_layer_name)) @functools.lru_cache() def module(self, # type: ignore # FIXME: mypy #5107 @@ -130,6 +132,7 @@ class Module(interfaces.context.ModuleInterface): symbol_name: typing.Optional[str] = None, type_name: typing.Optional[str] = None, offset: typing.Optional[int] = None, + native_layer_name: typing.Optional[str] = None, **kwargs) -> interfaces.objects.ObjectInterface: """Returns an object created using the symbol_table_name and layer_name of the Module @@ -161,7 +164,7 @@ class Module(interfaces.context.ModuleInterface): # Ensure we don't use a layer_name other than the module's, why would anyone do that? if 'layer_name' in kwargs: del kwargs['layer_name'] - return self._context.object(type_arg, self._layer_name, offset, **kwargs) + return self._context.object(type_arg, self._layer_name, offset, native_layer_name, **kwargs) get_symbol = get_module_wrapper('get_symbol') get_type = get_module_wrapper('get_type')