Skip to content

Commit de11704

Browse files
committed
Remove symbol_table_name from object constructor
Get from `self.vol.type_name` instead
1 parent 41de562 commit de11704

File tree

2 files changed

+1
-8
lines changed

2 files changed

+1
-8
lines changed

volatility3/framework/plugins/windows/mftscan.py

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,6 @@ def enumerate_mft_records(
112112
mft_object_type_name,
113113
offset=offset,
114114
layer_name=layer.name,
115-
symbol_table_name=symbol_table_name,
116115
)
117116

118117
yield mft_record

volatility3/framework/symbols/windows/extensions/mft.py

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -20,21 +20,15 @@ def __init__(
2020
object_info: interfaces.objects.ObjectInformation,
2121
size: int,
2222
members: Dict[str, Tuple[int, interfaces.objects.Template]],
23-
**kwargs,
2423
) -> None:
2524
super().__init__(context, type_name, object_info, size, members)
2625

27-
self._symbol_table_name = kwargs.get("symbol_table_name")
2826
self._attrs_loaded = False
2927
self._attrs: List[MFTAttribute] = []
3028

3129
@property
3230
def symbol_table_name(self) -> str:
33-
if self._symbol_table_name is None:
34-
raise ValueError(
35-
"MFTEntry was instantiated without an MFT symbol table name"
36-
)
37-
return self._symbol_table_name
31+
return self.vol.type_name.split(constants.BANG)[0]
3832

3933
def get_signature(self) -> objects.String:
4034
signature = self.Signature.cast("string", max_length=4, encoding="latin-1")

0 commit comments

Comments
 (0)