diff --git a/doc/source/simple-plugin.rst b/doc/source/simple-plugin.rst index facf3ff93..7334353be 100644 --- a/doc/source/simple-plugin.rst +++ b/doc/source/simple-plugin.rst @@ -33,7 +33,7 @@ to be able to run properly. Any that are defined as optional need not necessari @classmethod def get_requirements(cls): return [requirements.TranslationLayerRequirement(name = 'primary', - description = 'Kernel Address Space', + description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), requirements.IntRequirement(name = 'pid', @@ -47,7 +47,7 @@ to instantiate the plugin). At the moment these requirements are fairly straigh :: requirements.TranslationLayerRequirement(name = 'primary', - description = 'Kernel Address Space', + description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), This requirement indicates that the plugin will operate on a single `TranslationLayer` diff --git a/volatility/cli/volshell/shellplugin.py b/volatility/cli/volshell/shellplugin.py index d58f97a93..86ca748ac 100644 --- a/volatility/cli/volshell/shellplugin.py +++ b/volatility/cli/volshell/shellplugin.py @@ -33,7 +33,7 @@ class Volshell(interfaces.plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]) + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]) ] def run(self, additional_locals: Dict[str, Any] = None) -> interfaces.renderers.TreeGrid: diff --git a/volatility/cli/volshell/windows.py b/volatility/cli/volshell/windows.py index 6d1ecc6c3..9a483552a 100644 --- a/volatility/cli/volshell/windows.py +++ b/volatility/cli/volshell/windows.py @@ -31,7 +31,7 @@ class Volshell(shellplugin.Volshell): @classmethod def get_requirements(cls): return (super().get_requirements() + [ - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.IntRequirement(name = 'pid', description = "Process ID", optional = True) ]) diff --git a/volatility/framework/configuration/requirements.py b/volatility/framework/configuration/requirements.py index 757a8df2c..03c135836 100644 --- a/volatility/framework/configuration/requirements.py +++ b/volatility/framework/configuration/requirements.py @@ -219,7 +219,8 @@ class LayerListRequirement(ComplexListRequirement): def new_requirement(self, index) -> configuration.RequirementInterface: """Constructs a new requirement based on the specified index""" - return TranslationLayerRequirement(name = self.name + str(index), description = "Swap Layer", optional = False) + return TranslationLayerRequirement( + name = self.name + str(index), description = "Layer for swap space", optional = False) class TranslationLayerRequirement(configuration.ConstructableRequirementInterface, diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index ae9126a81..93f125f3a 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -175,9 +175,14 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - IntRequirement(name = 'hive_offset', description = '', default = 0, optional = False), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), - TranslationLayerRequirement(name = 'base_layer', optional = False) + IntRequirement( + name = 'hive_offset', + description = 'Offset within the base layer at which the hive lives', + default = 0, + optional = False), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + TranslationLayerRequirement( + name = 'base_layer', description = 'Layer in which the registry hive lives', optional = False) ] def _translate(self, offset: int) -> int: diff --git a/volatility/framework/plugins/configwriter.py b/volatility/framework/plugins/configwriter.py index 7ba4bed7f..c76ca6870 100644 --- a/volatility/framework/plugins/configwriter.py +++ b/volatility/framework/plugins/configwriter.py @@ -36,7 +36,7 @@ class ConfigWriter(plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.BooleanRequirement( name = 'extra', description = 'Outputs whole configuration tree', default = False, optional = True) ] diff --git a/volatility/framework/plugins/linux/bash.py b/volatility/framework/plugins/linux/bash.py index bcffb778c..09bd59935 100644 --- a/volatility/framework/plugins/linux/bash.py +++ b/volatility/framework/plugins/linux/bash.py @@ -42,8 +42,8 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols") ] def _generator(self, tasks): diff --git a/volatility/framework/plugins/linux/check_afinfo.py b/volatility/framework/plugins/linux/check_afinfo.py index d3f0530db..0f795aadf 100644 --- a/volatility/framework/plugins/linux/check_afinfo.py +++ b/volatility/framework/plugins/linux/check_afinfo.py @@ -40,8 +40,8 @@ class Check_afinfo(plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols") ] # returns whether the symbol is found within the kernel (system.map) or not diff --git a/volatility/framework/plugins/linux/check_syscall.py b/volatility/framework/plugins/linux/check_syscall.py index 61d72ead4..fbc87d171 100644 --- a/volatility/framework/plugins/linux/check_syscall.py +++ b/volatility/framework/plugins/linux/check_syscall.py @@ -47,8 +47,8 @@ class Check_syscall(plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols") ] def _get_table_size_next_symbol(self, table_addr, ptr_sz, vmlinux): diff --git a/volatility/framework/plugins/linux/elfs.py b/volatility/framework/plugins/linux/elfs.py index 936f03d45..dd12cf642 100644 --- a/volatility/framework/plugins/linux/elfs.py +++ b/volatility/framework/plugins/linux/elfs.py @@ -38,8 +38,8 @@ class Elfs(plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols") ] def _generator(self, tasks): diff --git a/volatility/framework/plugins/linux/lsmod.py b/volatility/framework/plugins/linux/lsmod.py index 8ed53718f..3cb8d0fb5 100644 --- a/volatility/framework/plugins/linux/lsmod.py +++ b/volatility/framework/plugins/linux/lsmod.py @@ -39,8 +39,8 @@ class Lsmod(plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols") ] @classmethod diff --git a/volatility/framework/plugins/linux/lsof.py b/volatility/framework/plugins/linux/lsof.py index ce693fc5c..3d040ede2 100644 --- a/volatility/framework/plugins/linux/lsof.py +++ b/volatility/framework/plugins/linux/lsof.py @@ -40,8 +40,8 @@ class Lsof(plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols") ] def _generator(self, tasks): diff --git a/volatility/framework/plugins/linux/malfind.py b/volatility/framework/plugins/linux/malfind.py index 04f9ea6bf..3afdbfb48 100644 --- a/volatility/framework/plugins/linux/malfind.py +++ b/volatility/framework/plugins/linux/malfind.py @@ -37,8 +37,8 @@ class Malfind(interfaces_plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols") ] def _list_injections(self, task): diff --git a/volatility/framework/plugins/linux/proc.py b/volatility/framework/plugins/linux/proc.py index d9f7c7306..32d21d6e4 100644 --- a/volatility/framework/plugins/linux/proc.py +++ b/volatility/framework/plugins/linux/proc.py @@ -37,8 +37,8 @@ class Maps(plugins.PluginInterface): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols") ] def _generator(self, tasks): diff --git a/volatility/framework/plugins/linux/pslist.py b/volatility/framework/plugins/linux/pslist.py index edad5949e..d31b4a7ff 100644 --- a/volatility/framework/plugins/linux/pslist.py +++ b/volatility/framework/plugins/linux/pslist.py @@ -34,8 +34,8 @@ class PsList(interfaces_plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "vmlinux", description = "Linux kernel symbols") ] @classmethod diff --git a/volatility/framework/plugins/mac/bash.py b/volatility/framework/plugins/mac/bash.py index 0b8a11edc..06c94e473 100644 --- a/volatility/framework/plugins/mac/bash.py +++ b/volatility/framework/plugins/mac/bash.py @@ -42,8 +42,8 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): def get_requirements(cls): return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", description = "mac Kernel") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols") ] def _generator(self, tasks): diff --git a/volatility/framework/plugins/mac/check_syscall.py b/volatility/framework/plugins/mac/check_syscall.py index 1005dfb37..5255a2593 100644 --- a/volatility/framework/plugins/mac/check_syscall.py +++ b/volatility/framework/plugins/mac/check_syscall.py @@ -17,8 +17,8 @@ class Check_syscall(plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", description = "OSX Kernel")] + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")] def _generator(self): mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary']) diff --git a/volatility/framework/plugins/mac/lsmod.py b/volatility/framework/plugins/mac/lsmod.py index dde35b314..5cd09ba18 100644 --- a/volatility/framework/plugins/mac/lsmod.py +++ b/volatility/framework/plugins/mac/lsmod.py @@ -36,8 +36,8 @@ class Lsmod(plugins.PluginInterface): def get_requirements(cls): return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", description = "Linux Kernel") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "darwin", description = "Linux kernel symbols") ] @classmethod diff --git a/volatility/framework/plugins/mac/malfind.py b/volatility/framework/plugins/mac/malfind.py index f53ca4e58..307ed4f30 100644 --- a/volatility/framework/plugins/mac/malfind.py +++ b/volatility/framework/plugins/mac/malfind.py @@ -35,8 +35,8 @@ class Malfind(interfaces_plugins.PluginInterface): def get_requirements(cls): return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", description = "Linux Kernel") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "darwin", description = "Linux kernel symbols") ] def _list_injections(self, task): diff --git a/volatility/framework/plugins/mac/psaux.py b/volatility/framework/plugins/mac/psaux.py index 2008801c1..1d16a4ddd 100644 --- a/volatility/framework/plugins/mac/psaux.py +++ b/volatility/framework/plugins/mac/psaux.py @@ -34,8 +34,8 @@ class Psaux(plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", description = "Mac Kernel") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols") ] def _generator(self, tasks: Iterator[Any]) -> Generator[Tuple[int, Tuple[int, str, int, str]], None, None]: diff --git a/volatility/framework/plugins/mac/pslist.py b/volatility/framework/plugins/mac/pslist.py index bd1db781c..b5f0c71a1 100644 --- a/volatility/framework/plugins/mac/pslist.py +++ b/volatility/framework/plugins/mac/pslist.py @@ -37,8 +37,8 @@ class PsList(interfaces_plugins.PluginInterface): def get_requirements(cls): return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", description = "Mac Kernel") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols") ] @classmethod diff --git a/volatility/framework/plugins/mac/pstree.py b/volatility/framework/plugins/mac/pstree.py index f8dee79c5..12a394fea 100644 --- a/volatility/framework/plugins/mac/pstree.py +++ b/volatility/framework/plugins/mac/pstree.py @@ -38,8 +38,8 @@ class PsTree(plugins.PluginInterface): def get_requirements(cls): return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", description = "Mac Kernel") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols") ] def _find_level(self, pid): diff --git a/volatility/framework/plugins/mac/trustedbsd.py b/volatility/framework/plugins/mac/trustedbsd.py index 350034c01..e855d7c15 100644 --- a/volatility/framework/plugins/mac/trustedbsd.py +++ b/volatility/framework/plugins/mac/trustedbsd.py @@ -40,8 +40,8 @@ class Check_syscall(plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", description = "OSX Kernel") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols") ] def _generator(self, mods: Iterator[Any]): diff --git a/volatility/framework/plugins/windows/cmdline.py b/volatility/framework/plugins/windows/cmdline.py index d94936af9..3516d1394 100644 --- a/volatility/framework/plugins/windows/cmdline.py +++ b/volatility/framework/plugins/windows/cmdline.py @@ -36,8 +36,8 @@ class CmdLine(interfaces_plugins.PluginInterface): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/dlldump.py b/volatility/framework/plugins/windows/dlldump.py index b39514c5e..904316938 100644 --- a/volatility/framework/plugins/windows/dlldump.py +++ b/volatility/framework/plugins/windows/dlldump.py @@ -42,9 +42,9 @@ class DllDump(interfaces_plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [requirements.TranslationLayerRequirement(name = 'primary', - description = 'Kernel Address Space', + description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), # TODO: Convert this to a ListRequirement so that people can filter on sets of ranges requirements.IntRequirement(name = 'address', description = "Process virtual memory address to include " \ diff --git a/volatility/framework/plugins/windows/dlllist.py b/volatility/framework/plugins/windows/dlllist.py index 1f4242d16..fe7ca93a8 100644 --- a/volatility/framework/plugins/windows/dlllist.py +++ b/volatility/framework/plugins/windows/dlllist.py @@ -35,8 +35,8 @@ class DllList(interfaces_plugins.PluginInterface): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index 60889a534..f6d7085f5 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -54,8 +54,8 @@ class Handles(interfaces_plugins.PluginInterface): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] def _decode_pointer(self, value, magic): diff --git a/volatility/framework/plugins/windows/info.py b/volatility/framework/plugins/windows/info.py index 2167aa3b5..92d5ff574 100644 --- a/volatility/framework/plugins/windows/info.py +++ b/volatility/framework/plugins/windows/info.py @@ -36,8 +36,8 @@ class Info(plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] def get_depends(self, layer_name: str, index: int = 0): diff --git a/volatility/framework/plugins/windows/malfind.py b/volatility/framework/plugins/windows/malfind.py index 6c91b3ed6..ac4e57b79 100644 --- a/volatility/framework/plugins/windows/malfind.py +++ b/volatility/framework/plugins/windows/malfind.py @@ -35,8 +35,8 @@ class Malfind(interfaces.plugins.PluginInterface): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] @classmethod diff --git a/volatility/framework/plugins/windows/moddump.py b/volatility/framework/plugins/windows/moddump.py index 28484f5f1..22a8c6f40 100644 --- a/volatility/framework/plugins/windows/moddump.py +++ b/volatility/framework/plugins/windows/moddump.py @@ -43,8 +43,8 @@ class ModDump(interfaces_plugins.PluginInterface): # Reuse the requirements from the plugins we use return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] @classmethod diff --git a/volatility/framework/plugins/windows/modules.py b/volatility/framework/plugins/windows/modules.py index c76640606..2a7fc54ae 100644 --- a/volatility/framework/plugins/windows/modules.py +++ b/volatility/framework/plugins/windows/modules.py @@ -34,8 +34,8 @@ class Modules(interfaces.plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] def _generator(self): diff --git a/volatility/framework/plugins/windows/poolscanner.py b/volatility/framework/plugins/windows/poolscanner.py index c0f8004c0..3adf315b4 100644 --- a/volatility/framework/plugins/windows/poolscanner.py +++ b/volatility/framework/plugins/windows/poolscanner.py @@ -78,8 +78,8 @@ class PoolScanner(plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] @staticmethod diff --git a/volatility/framework/plugins/windows/procdump.py b/volatility/framework/plugins/windows/procdump.py index 948296068..9f559a4ba 100644 --- a/volatility/framework/plugins/windows/procdump.py +++ b/volatility/framework/plugins/windows/procdump.py @@ -42,8 +42,8 @@ class ProcDump(interfaces_plugins.PluginInterface): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/pslist.py b/volatility/framework/plugins/windows/pslist.py index 0a18ced07..e96246a85 100644 --- a/volatility/framework/plugins/windows/pslist.py +++ b/volatility/framework/plugins/windows/pslist.py @@ -37,8 +37,8 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): def get_requirements(cls): return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), # TODO: Convert this to a ListRequirement so that people can filter on sets of pids requirements.IntRequirement( name = 'pid', description = "Process ID to include (all other processes are excluded)", diff --git a/volatility/framework/plugins/windows/registry/hivelist.py b/volatility/framework/plugins/windows/registry/hivelist.py index 15296ec4f..74af10381 100644 --- a/volatility/framework/plugins/windows/registry/hivelist.py +++ b/volatility/framework/plugins/windows/registry/hivelist.py @@ -33,8 +33,8 @@ class HiveList(plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.StringRequirement( name = 'filter', description = "String to filter hive names returned", optional = True, default = None) ] diff --git a/volatility/framework/plugins/windows/registry/printkey.py b/volatility/framework/plugins/windows/registry/printkey.py index eb58789f0..06379e705 100644 --- a/volatility/framework/plugins/windows/registry/printkey.py +++ b/volatility/framework/plugins/windows/registry/printkey.py @@ -38,8 +38,8 @@ class PrintKey(interfaces.plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.IntRequirement(name = 'offset', description = "Hive Offset", default = None, optional = True), requirements.StringRequirement( name = 'key', description = "Key to start from", default = None, optional = True), diff --git a/volatility/framework/plugins/windows/registry/userassist.py b/volatility/framework/plugins/windows/registry/userassist.py index ca7a3e1ff..1b4da3a6e 100644 --- a/volatility/framework/plugins/windows/registry/userassist.py +++ b/volatility/framework/plugins/windows/registry/userassist.py @@ -51,8 +51,8 @@ class UserAssist(interfaces.plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.IntRequirement(name = 'offset', description = "Hive Offset", default = None, optional = True) ] diff --git a/volatility/framework/plugins/windows/ssdt.py b/volatility/framework/plugins/windows/ssdt.py index 35a1eda91..687744fde 100644 --- a/volatility/framework/plugins/windows/ssdt.py +++ b/volatility/framework/plugins/windows/ssdt.py @@ -39,8 +39,8 @@ class SSDT(plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS") + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols") ] def _generator(self, mods: Iterator[Any]) -> Iterator[Tuple[int, Tuple[int, int, Any, Any]]]: diff --git a/volatility/framework/plugins/windows/strings.py b/volatility/framework/plugins/windows/strings.py index 555f306e9..5e8f669fa 100644 --- a/volatility/framework/plugins/windows/strings.py +++ b/volatility/framework/plugins/windows/strings.py @@ -37,8 +37,8 @@ class Strings(interfaces.plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.URIRequirement(name = "strings_file", description = "Strings file") ] # TODO: Make URLRequirement that can accept a file address which the framework can open diff --git a/volatility/framework/plugins/windows/vaddump.py b/volatility/framework/plugins/windows/vaddump.py index a5a9cd8b7..95540e382 100644 --- a/volatility/framework/plugins/windows/vaddump.py +++ b/volatility/framework/plugins/windows/vaddump.py @@ -39,9 +39,9 @@ class VadDump(interfaces_plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [requirements.TranslationLayerRequirement(name = 'primary', - description = 'Kernel Address Space', + description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), # TODO: Convert this to a ListRequirement so that people can filter on sets of ranges requirements.IntRequirement(name = 'address', description = "Process virtual memory address to include " \ diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility/framework/plugins/windows/vadinfo.py index f55662a79..64a49d868 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility/framework/plugins/windows/vadinfo.py @@ -58,9 +58,9 @@ class VadInfo(interfaces.plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [requirements.TranslationLayerRequirement(name = 'primary', - description = 'Kernel Address Space', + description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), # TODO: Convert this to a ListRequirement so that people can filter on sets of ranges requirements.IntRequirement(name = 'address', description = "Process virtual memory address to include " \ diff --git a/volatility/framework/plugins/windows/vadyarascan.py b/volatility/framework/plugins/windows/vadyarascan.py index 39f50b7f1..abbe168b9 100644 --- a/volatility/framework/plugins/windows/vadyarascan.py +++ b/volatility/framework/plugins/windows/vadyarascan.py @@ -43,8 +43,8 @@ class VadYaraScan(interfaces.plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = "Primary kernel address space", architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), + name = 'primary', description = "Memory layer for the kernel", architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.BooleanRequirement( name = "wide", description = "Match wide (unicode) strings", default = False, optional = True), requirements.StringRequirement( diff --git a/volatility/framework/plugins/windows/verinfo.py b/volatility/framework/plugins/windows/verinfo.py index a0639bba1..2d5a8468d 100644 --- a/volatility/framework/plugins/windows/verinfo.py +++ b/volatility/framework/plugins/windows/verinfo.py @@ -49,8 +49,8 @@ class VerInfo(interfaces_plugins.PluginInterface): ## TODO: and we don't want any CLI options from pslist, modules, or moddump return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "nt_symbols", description = "Windows kernel symbols"), ] @classmethod diff --git a/volatility/framework/plugins/yarascan.py b/volatility/framework/plugins/yarascan.py index 7899e05f9..e7aa739cb 100644 --- a/volatility/framework/plugins/yarascan.py +++ b/volatility/framework/plugins/yarascan.py @@ -56,7 +56,7 @@ class YaraScan(plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = "Primary kernel address space", architectures = ["Intel32", "Intel64"]), + name = 'primary', description = "Memory layer for the kernel", architectures = ["Intel32", "Intel64"]), requirements.BooleanRequirement( name = "all", description = "Scan both process and kernel memory", default = False, optional = True), requirements.BooleanRequirement( diff --git a/volatility/plugins/windows/statistics.py b/volatility/plugins/windows/statistics.py index ef62fda59..80cac6edf 100644 --- a/volatility/plugins/windows/statistics.py +++ b/volatility/plugins/windows/statistics.py @@ -32,7 +32,7 @@ class Statistics(plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]) + name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]) ] def _generator(self):