volatility3.framework.symbols.native module

class NativeTable(name, native_dictionary)

Bases: NativeTableInterface

Symbol List that handles Native types.

Parameters:

• name (str) – Name of the symbol table

• native_types – The native symbol table used to resolve any base/native types

• table_mapping – A dictionary mapping names of tables (which when present within the table will be changed to the mapped table)

• class_types – A dictionary of types and classes that should be instantiated instead of Struct to construct them

clear_symbol_cache()

Clears the symbol cache of this symbol table.

Return type:

None

del_type_class(name)

Removes the associated class override for a specific Symbol type.

Return type:

None

property enumerations: Iterable[str]

Returns an iterator of the Enumeration names.

get_enumeration(name)

Return type:

Template

get_symbol(name)

Resolves a symbol name into a symbol object.

If the symbol isn’t found, it raises a SymbolError exception

Return type:

SymbolInterface

get_symbol_type(name)

Resolves a symbol name into a symbol and then resolves the symbol’s type.

Return type:

Optional[Template]

get_symbols_by_location(offset, size=0)

Returns the name of all symbols in this table that live at a particular offset.

Return type:

Iterable[str]

get_symbols_by_type(type_name)

Returns the name of all symbols in this table that have type matching type_name.

Return type:

Iterable[str]

get_type(type_name)

Resolves a symbol name into an object template.

This always construct a new python object, rather than using a cached value otherwise changes made later may affect the cached copy. Calling clone after every native type construction was extremely slow.

Return type:

Template

get_type_class(name)

Returns the class associated with a Symbol type.

Return type:

Type[ObjectInterface]

property natives: NativeTableInterface

Returns None or a NativeTable for handling space specific native types.

optional_set_type_class(name, clazz)

Calls the set_type_class function but does not throw an exception. Returns whether setting the type class was successful. :type name: str :param name: The name of the type to override the class for :type clazz: Type[ObjectInterface] :param clazz: The actual class to override for the provided type name

Return type:

bool

set_type_class(name, clazz)

Overrides the object class for a specific Symbol type.

Name must be present in self.types

Parameters:

• name (str) – The name of the type to override the class for

• clazz (Type[ObjectInterface]) – The actual class to override for the provided type name

Return type:

None

property symbols: Iterable[str]

Returns an iterator of the Symbol names.

property types: Iterable[str]

Returns an iterator of the symbol type names.