volatility3.framework.symbols.linux package¶
-
class
LinuxKernelIntermedSymbols
(*args, **kwargs)[source]¶ Bases:
volatility3.framework.symbols.intermed.IntermediateSymbolTable
Instantiates a SymbolTable based on an IntermediateSymbolFormat JSON file. This is validated against the appropriate schema. The validation can be disabled by passing validate = False, but this should almost never be done.
- Parameters
context – The volatility context for the symbol table
config_path – The configuration path for the symbol table
name – The name for the symbol table (this is used in symbols e.g. table!symbol )
isf_url – The URL pointing to the ISF file location
native_types – The NativeSymbolTable that contains the native types for this symbol table
table_mapping – A dictionary linking names referenced in the file with symbol tables in the context
validate – Determines whether the ISF file will be validated against the appropriate schema
class_types – A dictionary of type names and classes that override StructType when they are instantiated
symbol_shift – An offset by which to alter all returned symbols for this table
symbol_mask – An address mask used for all returned symbol offsets from this table (a mask of 0 disables masking)
-
build_configuration
()¶ Constructs a HierarchicalDictionary of all the options required to build this component in the current context.
Ensures that if the class has been created, it can be recreated using the configuration built Inheriting classes must override this to ensure any dependent classes update their configurations too
- Return type
-
clear_symbol_cache
(*args, **kwargs)¶ Clears the symbol cache of this symbol table.
-
property
config
¶ The Hierarchical configuration Dictionary for this Configurable object.
- Return type
-
property
context
¶ The context object that this configurable belongs to/configuration is stored in.
- Return type
-
classmethod
create
(context, config_path, sub_path, filename, native_types=None, table_mapping=None, class_types=None, symbol_shift=0, symbol_mask=0)¶ Takes a context and loads an intermediate symbol table based on a filename.
- Parameters
context (
ContextInterface
) – The context that the current plugin is being run withinconfig_path (
str
) – The configuration path for reading/storing configuration information this symbol table may usesub_path (
str
) – The path under a suitable symbol path (defaults to volatility3/symbols and volatility3/framework/symbols) to checkfilename (
str
) – Basename of the file to find under the sub_pathnative_types (
Optional
[NativeTableInterface
]) – Set of native types, defaults to native types read from the intermediate symbol format filetable_mapping (
Optional
[Dict
[str
,str
]]) – a dictionary of table names mentioned within the ISF file, and the tables within the context which they map tosymbol_shift (
int
) – An offset by which to alter all returned symbols for this tablesymbol_mask (
int
) – An address mask used for all returned symbol offsets from this table (a mask of 0 disables masking)
- Return type
- Returns
the name of the added symbol table
-
del_type_class
(*args, **kwargs)¶ Removes the associated class override for a specific Symbol type.
-
property
enumerations
¶ Returns an iterator of the Enumeration names.
-
classmethod
file_symbol_url
(sub_path, filename=None)¶ Returns an iterator of appropriate file-scheme symbol URLs that can be opened by a ResourceAccessor class.
Filter reduces the number of results returned to only those URLs containing that string
-
get_enumeration
(*args, **kwargs)¶
-
classmethod
get_requirements
()¶ Returns a list of RequirementInterface objects required by this object.
- Return type
-
get_symbol
(*args, **kwargs)¶ Resolves a symbol name into a symbol object.
If the symbol isn’t found, it raises a SymbolError exception
-
get_symbol_type
(name)¶ Resolves a symbol name into a symbol and then resolves the symbol’s type.
-
get_symbols_by_location
(offset, size=0)¶ Returns the name of all symbols in this table that live at a particular offset.
-
get_symbols_by_type
(type_name)¶ Returns the name of all symbols in this table that have type matching type_name.
-
get_type
(*args, **kwargs)¶ Resolves a symbol name into an object template.
If the symbol isn’t found it raises a SymbolError exception
-
get_type_class
(*args, **kwargs)¶ Returns the class associated with a Symbol type.
-
classmethod
make_subconfig
(context, base_config_path, **kwargs)¶ Convenience function to allow constructing a new randomly generated sub-configuration path, containing each element from kwargs.
- Parameters
context (
ContextInterface
) – The context in which to store the new configurationbase_config_path (
str
) – The base configuration path on which to build the new configurationkwargs – Keyword arguments that are used to populate the new configuration path
- Returns
The newly generated full configuration path
- Return type
-
property
metadata
¶
-
property
natives
¶ Returns None or a NativeTable for handling space specific native types.
- Return type
-
provides
= {'type': 'interface'}¶
-
set_type_class
(*args, **kwargs)¶ Overrides the object class for a specific Symbol type.
Name must be present in self.types
- Parameters
name – The name of the type to override the class for
clazz – The actual class to override for the provided type name
-
property
symbols
¶ Returns an iterator of the Symbol names.
-
property
types
¶ Returns an iterator of the Symbol type names.
-
classmethod
unsatisfied
(context, config_path)¶ Returns a list of the names of all unsatisfied requirements.
Since a satisfied set of requirements will return [], it can be used in tests as follows:
unmet = configurable.unsatisfied(context, config_path) if unmet: raise RuntimeError("Unsatisfied requirements: {}".format(unmet)
- Return type
-
class
LinuxUtilities
[source]¶ Bases:
volatility3.framework.interfaces.configuration.VersionableInterface
Class with multiple useful linux functions.
-
classmethod
generate_kernel_handler_info
(context, layer_name, kernel_name, mods_list)[source]¶ A helper function that gets the beginning and end address of the kernel module
-
classmethod
lookup_module_address
(context, handlers, target_address)[source]¶ Searches between the start and end address of the kernel module using target_address. Returns the module and symbol name of the address provided.
-
classmethod
mask_mods_list
(context, layer_name, mods)[source]¶ A helper function to mask the starting and end address of kernel modules
-
version
= (1, 0, 0)¶
-
classmethod