mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-01 04:39:03 +02:00
Mike Auty
dcc558717c
The object_factory is now a separate function, but to ease the transition the object_factory method in Context has been left. I'll most likely deprecate it before the full release, but I'm open the idea of leaving it if someone can convince me it's a better decision.
48 lines
2.1 KiB
Python
48 lines
2.1 KiB
Python
from volatility.framework import constants
|
|
from volatility.framework import interfaces
|
|
|
|
|
|
def object_factory(context, symbol_table):
|
|
"""Allow a specific symbol_table to be used repeatedly for constructing objects
|
|
|
|
:param symbol_table: The name of the symbol table that the object factory will construct objects on
|
|
:type sybmol_table: str
|
|
:return: A function that takes the same arguments as :func:`object`
|
|
"""
|
|
|
|
def callable(symbol, layer_name, offset, **arguments):
|
|
"""Function to apply a specific symbol_table name to any unadorned symbol creation"""
|
|
if constants.BANG not in symbol:
|
|
symbol = symbol_table + constants.BANG + symbol
|
|
return context.object(symbol, layer_name, offset, **arguments)
|
|
|
|
return callable
|
|
|
|
|
|
def get_symbol_rebase(symbol_space, offset, symbol_table = None):
|
|
"""Construct a get_symbol function based on a symbol_space to return symbols whose addresses are all
|
|
increased by a specific offset.
|
|
|
|
:param symbol_space: The symbol_space object to use for symbol lookups
|
|
:type symbol_space: str
|
|
:param offset: The amount by which all symbol addresses are to be adjusted
|
|
:param offset: int
|
|
:param symbol_table: The (optional) name of the symbol table that get_symbol will search when no table name is provided as part of the symbol
|
|
:type sybmol_table: str
|
|
:return: A function that takes the same arguments as :func:`object`
|
|
"""
|
|
if not (symbol_table is None or isinstance(symbol_table, str)):
|
|
raise ValueError("symbol_table must be None or a string")
|
|
|
|
def callable(symbol_name):
|
|
"""Function to apply a specific offset increase to returned symbols"""
|
|
if constants.BANG not in symbol_name and symbol_table:
|
|
symbol_name = symbol_table + constants.BANG + symbol_name
|
|
symbol = symbol_space.get_symbol(symbol_name)
|
|
new_symbol = interfaces.symbols.Symbol(name = symbol.name,
|
|
address = symbol.address + offset,
|
|
type = symbol.type)
|
|
return new_symbol
|
|
|
|
return callable
|