volatility3.framework.objects.templates module

class ObjectTemplate(object_class, type_name, **arguments)[source]

Bases: volatility3.framework.interfaces.objects.Template

Factory class that produces objects that adhere to the Object interface on demand.

This is effectively a method of currying, but adds more structure to avoid abuse. It also allows inspection of information that should already be known:

  • Type size

  • Members

  • etc

Stores the keyword arguments for later object creation.

property children

~volatilit y.framework.interfaces.objects.ObjectInterface.VolTemplateProxy)

Type

Returns the children of the templated object (see

Type

class

Return type

List[Template]

clone()

Returns a copy of the original Template as constructed (without update_vol additions having been made)

Return type

Template

has_member(member_name)[source]

Returns whether the object would contain a member called member_name.

Return type

bool

relative_child_offset(child)[source]

Returns the relative offset of a child of the templated object (see VolTem plateProxy)

Return type

int

replace_child(old_child, new_child)[source]

Replaces old_child for new_child in the templated object’s child list (see VolTemplateProxy)

Return type

None

property size

~volatilit y.framework.interfaces.objects.ObjectInterface.VolTemplateProxy)

Type

Returns the children of the templated object (see

Type

class

Return type

int

update_vol(**new_arguments)

Updates the keyword arguments with values that will not be carried across to clones.

Return type

None

property vol

Returns a volatility information object, much like the ObjectInformation provides.

Return type

ReadOnlyMapping

class ReferenceTemplate(type_name, **arguments)[source]

Bases: volatility3.framework.interfaces.objects.Template

Factory class that produces objects based on a delayed reference type.

Attempts to access any standard attributes of a resolved template will result in a SymbolError.

Stores the keyword arguments for later object creation.

property children

The children of this template (such as member types, sub-types and base-types where they are relevant).

Used to traverse the template tree.

Return type

List[Template]

clone()

Returns a copy of the original Template as constructed (without update_vol additions having been made)

Return type

Template

has_member(*args, **kwargs)

Referenced symbols must be appropriately resolved before they can provide information such as size This is because the size request has no context within which to determine the actual symbol structure.

Return type

Any

relative_child_offset(*args, **kwargs)

Referenced symbols must be appropriately resolved before they can provide information such as size This is because the size request has no context within which to determine the actual symbol structure.

Return type

Any

replace_child(*args, **kwargs)

Referenced symbols must be appropriately resolved before they can provide information such as size This is because the size request has no context within which to determine the actual symbol structure.

Return type

Any

property size

Referenced symbols must be appropriately resolved before they can provide information such as size This is because the size request has no context within which to determine the actual symbol structure.

Return type

Any

update_vol(**new_arguments)

Updates the keyword arguments with values that will not be carried across to clones.

Return type

None

property vol

Returns a volatility information object, much like the ObjectInformation provides.

Return type

ReadOnlyMapping