volatility3.framework.objects.templates module

class ObjectTemplate(object_class, type_name, **arguments)

Bases: Template

Factory class that produces objects that adhere to the Object interface on demand.

This is effectively a method of currying, but adds more structure to avoid abuse. It also allows inspection of information that should already be known:

• Type size

• Members

• etc

Stores the keyword arguments for later object creation.

child_template(child)

Returns the template of a child of the templated object (see VolTem plateProxy)

Return type:

Template

property children: List[Template]

~volatilit y.framework.interfaces.objects.ObjectInterface.VolTemplateProxy)

Type:

Returns the children of the templated object (see

Type:

class

clone()

Returns a copy of the original Template as constructed (without update_vol additions having been made)

Return type:

Template

has_member(member_name)

Returns whether the object would contain a member called member_name.

Return type:

bool

relative_child_offset(child)

Returns the relative offset of a child of the templated object (see VolTem plateProxy)

Return type:

int

replace_child(old_child, new_child)

Replaces old_child for new_child in the templated object’s child list (see VolTemplateProxy)

Return type:

None

property size: int

~volatilit y.framework.interfaces.objects.ObjectInterface.VolTemplateProxy)

Type:

Returns the children of the templated object (see

Type:

class

update_vol(**new_arguments)

Updates the keyword arguments with values that will not be carried across to clones.

Return type:

None

property vol: ReadOnlyMapping

Returns a volatility information object, much like the ObjectInformation provides.

class ReferenceTemplate(type_name, **arguments)

Bases: Template

Factory class that produces objects based on a delayed reference type.

Attempts to access any standard attributes of a resolved template will result in a SymbolError.

Stores the keyword arguments for later object creation.

child_template(*args, **kwargs)

Referenced symbols must be appropriately resolved before they can provide information such as size This is because the size request has no context within which to determine the actual symbol structure.

Return type:

Any

property children: List[Template]

The children of this template (such as member types, sub-types and base-types where they are relevant).

Used to traverse the template tree.

clone()

Returns a copy of the original Template as constructed (without update_vol additions having been made)

Return type:

Template

has_member(*args, **kwargs)

Referenced symbols must be appropriately resolved before they can provide information such as size This is because the size request has no context within which to determine the actual symbol structure.

Return type:

Any

relative_child_offset(*args, **kwargs)

Referenced symbols must be appropriately resolved before they can provide information such as size This is because the size request has no context within which to determine the actual symbol structure.

Return type:

Any

replace_child(*args, **kwargs)

Referenced symbols must be appropriately resolved before they can provide information such as size This is because the size request has no context within which to determine the actual symbol structure.

Return type:

Any

property size: Any

Referenced symbols must be appropriately resolved before they can provide information such as size This is because the size request has no context within which to determine the actual symbol structure.

update_vol(**new_arguments)

Updates the keyword arguments with values that will not be carried across to clones.

Return type:

None

property vol: ReadOnlyMapping

Returns a volatility information object, much like the ObjectInformation provides.