volatility3.framework.interfaces.context module¶
Defines an interface for contexts, which hold the core components that a plugin will operate upon when running.
These include a memory container which holds a series of forest of layers, and a symbol_space which contains tables of symbols that can be used to interpret data in a layer. The context also provides some convenience functions, most notably the object constructor function, object, which will construct a symbol on a layer at a particular offset.
-
class
ContextInterface
[source]¶ Bases:
object
All context-like objects must adhere to the following interface.
This interface is present to avoid import dependency cycles.
Initializes the context with a symbol_space.
-
add_layer
(layer)[source]¶ Adds a named translation layer to the context memory.
- Parameters
layer (
DataLayerInterface
) – Layer object to be added to the context memory
-
clone
()[source]¶ Produce a clone of the context (and configuration), allowing modifications to be made without affecting any mutable objects in the original.
Memory constraints may become an issue for this function depending on how much is actually stored in the context
- Return type
-
abstract property
config
¶ Returns the configuration object for this context.
- Return type
-
abstract property
layers
¶ Returns the memory object for the context.
- Return type
-
module
(module_name, layer_name, offset, native_layer_name=None, size=None)[source]¶ Create a module object.
A module object is associated with a symbol table, and acts like a context, but offsets locations by a known value and looks up symbols, by default within the associated symbol table. It can also be sized should that information be available.
- Parameters
module_name (
str
) – The name of the modulelayer_name (
str
) – The layer the module is associated with (which layer the module lives within)offset (
int
) – The initial/base offset of the module (used as the offset for relative symbols)native_layer_name (
Optional
[str
]) – The default native_layer_name to use when the module constructs objectssize (
Optional
[int
]) – The size, in bytes, that the module occupys from offset location within the layer named layer_name
- Return type
- Returns
A module object
-
abstract
object
(object_type, layer_name, offset, native_layer_name=None, **arguments)[source]¶ Object factory, takes a context, symbol, offset and optional layer_name.
Looks up the layer_name in the context, finds the object template based on the symbol, and constructs an object using the object template on the layer at the offset.
- Parameters
object_type (
Union
[str
,Template
]) – Either a string name of the type, or a Template of the type to be constructedlayer_name (
str
) – The name of the layer on which to construct the objectoffset (
int
) – The address within the layer at which to construct the objectnative_layer_name (
Optional
[str
]) – The layer this object references (should it be a pointer or similar)
- Returns
A fully constructed object
-
abstract property
symbol_space
¶ Returns the symbol_space for the context.
This object must support the
SymbolSpaceInterface
- Return type
-
-
class
ModuleInterface
(context, module_name, layer_name, offset, symbol_table_name=None, native_layer_name=None)[source]¶ Bases:
object
Maintains state concerning a particular loaded module in memory.
This object is OS-independent.
Constructs a new os-independent module.
- Parameters
context (
ContextInterface
) – The context within which this module will existmodule_name (
str
) – The name of the modulelayer_name (
str
) – The layer within the context in which the module existsoffset (
int
) – The offset at which the module exists in the layersymbol_table_name (
Optional
[str
]) – The name of an associated symbol tablenative_layer_name (
Optional
[str
]) – The default native layer for objects constructed by the module
-
property
context
¶ Context that the module uses.
- Return type
-
has_enumeration
(name)[source]¶ Determines whether an enumeration is present in the module.
- Return type
-
abstract
object
(object_type, offset=None, native_layer_name=None, absolute=False, **kwargs)[source]¶ Returns an object created using the symbol_table_name and layer_name of the Module.
- Parameters
object_type (
str
) – The name of object type to construct (using the module’s symbol_table)offset (
Optional
[int
]) – the offset (unless absolute is set) from the start of the modulenative_layer_name (
Optional
[str
]) – The native layer for objects that reference a different layer (if not the default provided during module construction)absolute (
bool
) – A boolean specifying whether the offset is absolute within the layer, or relative to the start of the module
- Return type
- Returns
The constructed object
-
abstract
object_from_symbol
(symbol_name, native_layer_name=None, absolute=False, **kwargs)[source]¶ Returns an object created using the symbol_table_name and layer_name of the Module.
- Parameters
symbol_name (
str
) – The name of a symbol (that must be present in the module’s symbol table). The symbol’s associated type will be used to construct an object at the symbol’s offset.native_layer_name (
Optional
[str
]) – The native layer for objects that reference a different layer (if not the default provided during module construction)absolute (
bool
) – A boolean specifying whether the offset is absolute within the layer, or relative to the start of the module
- Return type
- Returns
The constructed object