volatility3.framework.automagic.symbol_cache module

class CacheManagerInterface(filename)

Bases: VersionableInterface

add_identifier(location, operating_system, identifier)

Adds an identifier to the store

find_location(identifier, operating_system)

Returns the location of the symbol file given the identifier

Parameters:

• identifier (bytes) – string that uniquely identifies a particular symbol table

• operating_system (Optional[str]) – optional string to restrict identifiers to just those for a particular operating system

Return type:

Optional[str]

Returns:

The location of the symbols file that matches the identifier

get_hash(location)

Returns the hash of the JSON from within a location ISF

Return type:

Optional[str]

get_identifier(location)

Returns an identifier based on a specific location or None

Return type:

Optional[bytes]

get_identifier_dictionary(operating_system=None, local_only=False)

Returns a dictionary of identifiers and locations

Parameters:

• operating_system (Optional[str]) – If set, limits responses to a specific operating system

• local_only (bool) – Returns only local locations

Return type:

Dict[bytes, str]

Returns:

A dictionary of identifiers mapped to a location

get_identifiers(operating_system)

Returns all identifiers for a particular operating system

Return type:

List[bytes]

get_local_locations()

Returns a list of all the local locations

Return type:

Iterable[str]

get_location_statistics(location)

Returns ISF statistics based on the location

Return type:

Optional[Tuple[int, int, int, int]]

Returns:

A tuple of base_types, types, enums, symbols, or None is location not found

update()

Locates all files under the symbol directories. Updates the cache with additions, modifications and removals. This also updates remote locations based on a cache timeout.

version = (0, 0, 0)

class IdentifierProcessor

Bases: object

abstract classmethod get_identifier(json)

Method to extract the identifier from a particular operating system’s JSON

Return type:

Optional[bytes]

Returns:

identifier is valid or None if not found

operating_system = None

class LinuxIdentifier

Bases: IdentifierProcessor

classmethod get_identifier(json)

Method to extract the identifier from a particular operating system’s JSON

Return type:

Optional[bytes]

Returns:

identifier is valid or None if not found

operating_system = 'linux'

class MacIdentifier

Bases: IdentifierProcessor

classmethod get_identifier(json)

Method to extract the identifier from a particular operating system’s JSON

Return type:

Optional[bytes]

Returns:

identifier is valid or None if not found

operating_system = 'mac'

class RemoteIdentifierFormat(location)

Bases: object

process(identifiers, operating_system)

Return type:

Generator[Tuple[bytes, str], None, None]

process_v1(identifiers, operating_system)

Return type:

Generator[Tuple[bytes, str], None, None]

class SqliteCache(filename)

Bases: CacheManagerInterface

add_identifier(location, operating_system, identifier)

Adds an identifier to the store

find_location(identifier, operating_system)

Returns the location of the symbol file given the identifier. If multiple locations exist for an identifier, the last found is returned

Parameters:

• identifier (bytes) – string that uniquely identifies a particular symbol table

• operating_system (Optional[str]) – optional string to restrict identifiers to just those for a particular operating system

Return type:

Optional[str]

Returns:

The location of the symbols file that matches the identifier or None

get_hash(location)

Returns the hash of the JSON from within a location ISF

Return type:

Optional[str]

get_identifier(location)

Returns an identifier based on a specific location or None

Return type:

Optional[bytes]

get_identifier_dictionary(operating_system=None, local_only=False)

Returns a dictionary of identifiers and locations

Parameters:

• operating_system (Optional[str]) – If set, limits responses to a specific operating system

• local_only (bool) – Returns only local locations

Return type:

Dict[bytes, str]

Returns:

A dictionary of identifiers mapped to a location

get_identifiers(operating_system)

Returns all identifiers for a particular operating system

Return type:

List[bytes]

get_local_locations()

Returns a list of all the local locations

Return type:

Generator[str, None, None]

get_location_statistics(location)

Returns ISF statistics based on the location

Return type:

Optional[Tuple[int, int, int, int]]

Returns:

A tuple of base_types, types, enums, symbols, or None is location not found

is_url_local(url)

Determines whether an url is local or not

Return type:

bool

update(progress_callback=None)

Locates all files under the symbol directories. Updates the cache with additions, modifications and removals. This also updates remote locations based on a cache timeout.

version = (1, 0, 0)

class SymbolCacheMagic(*args, **kwargs)

Bases: AutomagicInterface

Runs through all symbol tables and caches their identifiers

Basic initializer that allows configurables to access their own config settings.

build_configuration()

Constructs a HierarchicalDictionary of all the options required to build this component in the current context.

Ensures that if the class has been created, it can be recreated using the configuration built Inheriting classes must override this to ensure any dependent classes update their configurations too

Return type:

HierarchicalDict

property config: HierarchicalDict

The Hierarchical configuration Dictionary for this Configurable object.

property config_path: str

The configuration path on which this configurable lives.

property context: ContextInterface

The context object that this configurable belongs to/configuration is stored in.

exclusion_list = []

A list of plugin categories (typically operating systems) which the plugin will not operate on

find_requirements(context, config_path, requirement_root, requirement_type, shortcut=True)

Determines if there is actually an unfulfilled Requirement waiting.

This ensures we do not carry out an expensive search when there is no need for a particular Requirement

Parameters:

• context (ContextInterface) – Context on which to operate

• config_path (str) – Configuration path of the top-level requirement

• requirement_root (RequirementInterface) – Top-level requirement whose subrequirements will all be searched

• requirement_type (Union[Tuple[Type[RequirementInterface], ...], Type[RequirementInterface]]) – Type of requirement to find

• shortcut (bool) – Only returns requirements that live under unsatisfied requirements

Return type:

List[Tuple[str, RequirementInterface]]

Returns:

A list of tuples containing the config_path, sub_config_path and requirement identifying the unsatisfied Requirements

classmethod get_requirements()

Returns a list of RequirementInterface objects required by this object.

Return type:

List[RequirementInterface]

classmethod make_subconfig(context, base_config_path, **kwargs)

Convenience function to allow constructing a new randomly generated sub-configuration path, containing each element from kwargs.

Parameters:

• context (ContextInterface) – The context in which to store the new configuration

• base_config_path (str) – The base configuration path on which to build the new configuration

• kwargs – Keyword arguments that are used to populate the new configuration path

Returns:

The newly generated full configuration path

Return type:

str

priority = 0

An ordering to indicate how soon this automagic should be run

classmethod unsatisfied(context, config_path)

Returns a list of the names of all unsatisfied requirements.

Since a satisfied set of requirements will return [], it can be used in tests as follows:

unmet = configurable.unsatisfied(context, config_path)
if unmet:
    raise RuntimeError("Unsatisfied requirements: {}".format(unmet)

Return type:

Dict[str, RequirementInterface]

class WindowsIdentifier

Bases: IdentifierProcessor

classmethod generate(pdb_name, guid, age)

Return type:

bytes

classmethod get_identifier(json)

Returns the identifier for the file if one can be found

Return type:

Optional[bytes]

operating_system = 'windows'

separator = '|'