mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-25 07:32:23 +02:00
Mike Auty
d1b58143fe
This template type allows objects that have not been able to be resolved to exist within the symbol system. It emits a debug message on creation so that intermediate format developers can identify potential issues, but does not raise an exception so as to allow partial tables to be used. If the UnresolvedTemplate is called (to create an object) before the symbol has been added to the symbolspace, it will fail with a SymbolError (as thrown by the individual SymbolTable). For this reason, the class has been made private to the SymbolSpace class to prevent unexpected use.
90 lines
3.1 KiB
Python
90 lines
3.1 KiB
Python
"""
|
|
Created on 1 Mar 2013
|
|
|
|
@author: mike
|
|
"""
|
|
import logging
|
|
|
|
from volatility.framework import interfaces, validity
|
|
from volatility.framework.exceptions import SymbolError
|
|
|
|
vollog = logging.getLogger(__name__)
|
|
|
|
|
|
class ObjectTemplate(interfaces.objects.Template, validity.ValidityRoutines):
|
|
"""Factory class that produces objects that adhere to the Object interface on demand
|
|
|
|
This is effectively a method of currying, but adds more structure to avoid abuse.
|
|
It also allows inspection of information that should already be known:
|
|
* Type size
|
|
* Members, etc
|
|
etc.
|
|
"""
|
|
|
|
def __init__(self, object_class = None, type_name = None, **arguments):
|
|
super().__init__(type_name = type_name, **arguments)
|
|
self._check_class(object_class, interfaces.objects.ObjectInterface)
|
|
self.update_vol(object_class = object_class)
|
|
|
|
@property
|
|
def size(self):
|
|
"""Returns the size of the template"""
|
|
return self.vol.object_class.VolTemplateProxy.size(self)
|
|
|
|
@property
|
|
def children(self):
|
|
"""A function that returns a list of child templates of a template
|
|
|
|
This is used to traverse the template tree
|
|
"""
|
|
return self.vol.object_class.VolTemplateProxy.children(self)
|
|
|
|
def relative_child_offset(self, child):
|
|
"""A function that returns the relative offset of a child from its parent offset
|
|
|
|
This may throw exceptions including ChildNotFoundException and NotImplementedError
|
|
"""
|
|
return self.vol.object_class.VolTemplateProxy.relative_child_offset(self, child)
|
|
|
|
def replace_child(self, old_child, new_child):
|
|
"""A function for replacing one child with another
|
|
"""
|
|
return self.vol.object_class.VolTemplateProxy.replace_child(self, old_child, new_child)
|
|
|
|
def __call__(self, context, object_info):
|
|
"""Constructs the object
|
|
|
|
Returns: an object adhereing to the Object interface
|
|
"""
|
|
arguments = {}
|
|
arguments.update(self.vol)
|
|
del arguments['object_class']
|
|
return self.vol.object_class(context = context,
|
|
object_info = object_info,
|
|
**arguments)
|
|
|
|
|
|
class ReferenceTemplate(interfaces.objects.Template):
|
|
"""Factory class that produces objects based on a delayed reference type
|
|
|
|
It should not return any attributes
|
|
"""
|
|
|
|
@property
|
|
def children(self):
|
|
return []
|
|
|
|
@property
|
|
def _unresolved(self, *args, **kwargs):
|
|
"""Referenced symbols must be appropriately resolved before they can provide information such as size
|
|
This is because the size request has no context within which to determine the actual symbol structure.
|
|
"""
|
|
raise SymbolError("Template {0} contains no information about its structure".format(self.vol.type_name))
|
|
|
|
size = property(_unresolved)
|
|
replace_child = relative_child_offset = _unresolved
|
|
|
|
def __call__(self, context, object_info):
|
|
template = context.symbol_space.get_type(self.vol.type_name)
|
|
return template(context = context, object_info = object_info)
|