import collections.abc from volatility.framework import objects # Keep these in a basic module, to prevent import cycles when symbol providers require them class list_head(objects.Struct, collections.abc.Iterable): def to_list(self, symbol_type, member, forward = True, sentinel = True, layer = None): """Returns an iterator of the entries in the list""" if layer is None: layer = self.vol.layer_name relative_offset = self._context.symbol_space.get_type(symbol_type).relative_child_offset(member) direction = 'prev' if forward: direction = 'next' link = getattr(self, direction).dereference() if not sentinel: yield self._context.object(symbol_type, layer, offset = self.vol.offset - relative_offset) seen = {self.vol.offset} while link.vol.offset not in seen: obj = self._context.object(symbol_type, layer, offset = link.vol.offset - relative_offset) yield obj seen.add(link.vol.offset) link = getattr(link, direction).dereference() def __iter__(self): return self.to_list(self.vol.parent.vol.type_name, self.vol.member_name)