WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 04:37:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add in the native_layer_name concept to ObjectInformation.

Browse Source
This commit is contained in:
Mike Auty
2018-09-12 22:45:34 +01:00
parent dd5edc395a
commit fa552aa3b0
2 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/interfaces/objects.py
+5 -3
View File
@@ -53,14 +53,15 @@ class ObjectInformation(ReadOnlyMapping):
in a single place. These values are based on the :class:`ReadOnlyMapping` class, to prevent their modification.
"""
def __init__(self, layer_name, offset, member_name = None, parent = None):
def __init__(self, layer_name, offset, member_name = None, parent = None, native_layer_name = None):
self._check_type(offset, int)
if parent:
self._check_type(parent, ObjectInterface)
super().__init__({'layer_name': layer_name,
'offset': offset,
'member_name': member_name,
'parent': parent})
'parent': parent,
'native_layer_name': native_layer_name or layer_name})
class ObjectInterface(validity.ValidityRoutines, metaclass = ABCMeta):
@@ -138,7 +139,8 @@ class ObjectInterface(validity.ValidityRoutines, metaclass = ABCMeta):
object_info = ObjectInformation(layer_name = self.vol.layer_name,
offset = self.vol.offset,
member_name = self.vol.member_name,
parent = self.vol.parent)
parent = self.vol.parent,
native_layer_name = self.vol.native_layer_name)
return object_template(context = self._context,
object_info = object_info)
volatility/framework/objects/__init__.py
+5 -3
View File
@@ -248,7 +248,7 @@ class Pointer(Integer):
Layer_name is identifies the appropriate layer within the context that the pointer points to.
If layer_name is None, it defaults to the same layer that the pointer is currently instantiated in.
"""
layer_name = layer_name or self.vol.layer_name
layer_name = layer_name or self.vol.native_layer_name
mask = self._context.memory[layer_name].address_mask
offset = self & mask
return self.vol.subtype(context = self._context,
@@ -519,7 +519,8 @@ class Array(interfaces.objects.ObjectInterface, abc.Sequence):
for index in series:
object_info = ObjectInformation(layer_name = self.vol.layer_name,
offset = mask & (self.vol.offset + (self.vol.subtype.size * index)),
parent = self)
parent = self,
native_layer_name = self.vol.native_layer_name)
result += [self.vol.subtype(context = self._context, object_info = object_info)]
if not return_list:
return result[0]
@@ -631,7 +632,8 @@ class Struct(interfaces.objects.ObjectInterface):
offset = mask & (
self.vol.offset + relative_offset),
member_name = attr,
parent = self))
parent = self,
native_layer_name = self.vol.native_layer_name))
self._concrete_members[attr] = member
return member
raise AttributeError("Struct has no attribute: {}.{}".format(self.vol.type_name, attr))