Skip to content

Commit

Permalink
Keep the advanced configuration requirements out of the interfaces
Browse files Browse the repository at this point in the history
  • Loading branch information
ikelos committed Feb 2, 2025
1 parent 144a7cc commit fbb9627
Show file tree
Hide file tree
Showing 3 changed files with 6 additions and 12 deletions.
5 changes: 4 additions & 1 deletion volatility3/framework/configuration/requirements.py
Original file line number Diff line number Diff line change
Expand Up @@ -641,7 +641,10 @@ def __init__(

@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
return interfaces.context.ModuleInterface.get_requirements()
return [
IntRequirement(name="offset"),
SymbolTableRequirement(name="symbol_table_name"),
]

def unsatisfied(
self, context: "interfaces.context.ContextInterface", config_path: str
Expand Down
8 changes: 0 additions & 8 deletions volatility3/framework/interfaces/context.py
Original file line number Diff line number Diff line change
Expand Up @@ -158,14 +158,6 @@ def __init__(self, context: ContextInterface, config_path: str, name: str) -> No
super().__init__(context, config_path)
self._module_name = name

@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
# Can't include the translation layer without knowing the architectures
return [
SymbolTableRequirement(name="symbol_table_name"),
IntRequirement(name="offset"),
]

@property
def _layer_name(self) -> str:
return self.config["layer_name"]
Expand Down
5 changes: 2 additions & 3 deletions volatility3/framework/plugins/windows/ssdt.py
Original file line number Diff line number Diff line change
Expand Up @@ -89,9 +89,8 @@ def _generator(self) -> Iterator[Tuple[int, Tuple[int, int, Any, Any]]]:
self.context, layer_name, kernel.symbol_table_name
)

ntkrnlmp = self.context.module(
kernel.symbol_table_name, layer_name=kernel.offset, offset=kvo
)
ntkrnlmp = kernel
kvo = kernel.offset

# this is just one way to enumerate the native (NT) service table.
# to do the same thing for the Win32K service table, we would need Win32K.sys symbol support
Expand Down

0 comments on commit fbb9627

Please sign in to comment.