Method object

volatility3/framework/contexts/__init__.py:231–271

Returns an object created using the symbol_table_name and layer_name of the Module. Args: object_type: Name of the type/enumeration (within the module) to construct offset: The location of the object, ignored when symbol_type is SYMBOL native_laye

(
        self,
        object_type: str,
        offset: Optional[int] = None,
        native_layer_name: Optional[str] = None,
        absolute: bool = False,
        **kwargs,
    )

        return return_val

    def object(
        self,
        object_type: str,
        offset: Optional[int] = None,
        native_layer_name: Optional[str] = None,
        absolute: bool = False,
        **kwargs,
    ) -> "interfaces.objects.ObjectInterface":
        """Returns an object created using the symbol_table_name and layer_name
        of the Module.

        Args:
            object_type: Name of the type/enumeration (within the module) to construct
            offset: The location of the object, ignored when symbol_type is SYMBOL
            native_layer_name: Name of the layer in which constructed objects are made (for pointers)
            absolute: whether the type's offset is absolute within memory or relative to the module
        """
        if constants.BANG not in object_type:
            object_type = self.symbol_table_name + constants.BANG + object_type
        elif not object_type.startswith(self.symbol_table_name + constants.BANG):
            raise ValueError(
                "Cannot reference another module when constructing an object"
            )

        if offset is None:
            raise TypeError("Offset must not be None for non-symbol objects")

        if not absolute:
            offset += self._offset

        # We have to allow using an alternative layer name due to pool scanners switching
        # to the memory layer for scanning samples prior to Windows 10.
        layer_name = kwargs.pop("layer_name", self._layer_name)

        return self._context.object(
            object_type=object_type,
            layer_name=layer_name,
            offset=offset,
            native_layer_name=native_layer_name or self._native_layer_name,
            **kwargs,
        )

    def object_from_symbol(
        self,