mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-25 23:52:23 +02:00
Mike Auty
ed716ca12a
This allows SymbolTables to hold actual requirements (which IntermedSymbolTable already did, but without pulling in the right interface). It means that values like kernel_virtual_offset get saved. We still need to figure out how to allow plugins to demand optional configuration values in other places (such as the kvo) but for now the plugin will barf if it doesn't get it.
21 lines
812 B
Python
21 lines
812 B
Python
from volatility.framework.configuration import requirements
|
|
from volatility.framework.symbols import intermed
|
|
from volatility.framework.symbols.windows import extensions
|
|
|
|
__author__ = 'mike'
|
|
|
|
|
|
class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable):
|
|
provides = {"type": "interface"}
|
|
|
|
def __init__(self, context, config_path, name, idd_filepath):
|
|
super().__init__(context = context, config_path = config_path, name = name, idd_filepath = idd_filepath)
|
|
|
|
# Set-up windows specific types
|
|
self.set_type_class('_ETHREAD', extensions._ETHREAD)
|
|
self.set_type_class('_LIST_ENTRY', extensions._LIST_ENTRY)
|
|
|
|
@classmethod
|
|
def get_requirements(cls):
|
|
return [requirements.StringRequirement("idd_filepath", description = "JSON file containnig the symbols")]
|