Core: Fix LGTM recommendations

This is mostly unused imports and unused variables.

volatility/framework/automagic/linux.py

@@ -9,7 +9,6 @@ from volatility.framework import interfaces, constants
 from volatility.framework.automagic import symbol_cache, symbol_finder
 from volatility.framework.layers import intel, scanners
 from volatility.framework.symbols import linux
-from volatility.framework.objects import utility
 
 vollog = logging.getLogger(__name__)
 

volatility/framework/interfaces/layers.py

@@ -11,27 +11,18 @@ import functools
 import logging
 import math
 import multiprocessing
+import multiprocessing.managers
 import threading
 import traceback
 import types
 from abc import ABCMeta, abstractmethod
-from multiprocessing import managers
 from typing import Any, Callable, Dict, Iterable, List, Mapping, Optional, Tuple, Union
 
 from volatility.framework import constants, exceptions, interfaces
 
 vollog = logging.getLogger(__name__)
 
-IMPORTED_MAGIC = False
-try:
-    import magic
-
-    IMPORTED_MAGIC = True
-    vollog.debug("Imported python-magic, autodetecting compressed files based on content")
-except ImportError:
-    pass
-
-ProgressValue = Union['DummyProgress', managers.ValueProxy]
+ProgressValue = Union['DummyProgress', multiprocessing.managers.ValueProxy]
 IteratorValue = Tuple[List[Tuple[str, int, int]], int]
 
 

volatility/framework/interfaces/objects.py

@@ -7,7 +7,6 @@ import abc
 import collections
 import collections.abc
 import logging
-from abc import ABCMeta, abstractmethod
 from typing import Any, Dict, List, Mapping, Optional
 
 from volatility.framework import constants, interfaces
@@ -88,7 +87,7 @@ class ObjectInformation(ReadOnlyMapping):
         })
 
 
-class ObjectInterface(metaclass = ABCMeta):
+class ObjectInterface(metaclass = abc.ABCMeta):
     """A base object required to be the ancestor of every object used in
     volatility."""
 
@@ -129,7 +128,7 @@ class ObjectInterface(metaclass = ABCMeta):
         # Wrap the outgoing vol in a read-only proxy
         return ReadOnlyMapping(self._vol)
 
-    @abstractmethod
+    @abc.abstractmethod
     def write(self, value: Any):
         """Writes the new value into the format at the offset the object
         currently resides at."""
@@ -296,20 +295,20 @@ class Template:
         return []
 
     @property
-    @abstractmethod
+    @abc.abstractmethod
     def size(self) -> int:
         """Returns the size of the template."""
 
-    @abstractmethod
+    @abc.abstractmethod
     def relative_child_offset(self, child: str) -> int:
         """Returns the relative offset of the `child` member from its parent
         offset."""
 
-    @abstractmethod
+    @abc.abstractmethod
     def replace_child(self, old_child: 'Template', new_child: 'Template') -> None:
         """Replaces `old_child` with `new_child` in the list of children."""
 
-    @abstractmethod
+    @abc.abstractmethod
     def has_member(self, member_name: str) -> bool:
         """Returns whether the object would contain a member called
         `member_name`"""

volatility/framework/layers/qemu.py

@@ -151,9 +151,9 @@ class QemuSuspendLayer(segmented.NonLinearlySegmentedLayer):
                                            layer_name = self._base_layer,
                                            max_length = name_len)
                 index += name_len
-                instance_id = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned long',
-                                                  offset = index,
-                                                  layer_name = self._base_layer)
+                # instance_id = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned long',
+                #                                    offset = index,
+                #                                    layer_name = self._base_layer)
                 index += 4
                 version_id = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned long',
                                                  offset = index,

volatility/framework/layers/resources.py

@@ -33,6 +33,7 @@ except ImportError:
 
 vollog = logging.getLogger(__name__)
 
+
 # TODO: Type-annotating the ResourceAccessor.open method is difficult because HTTPResponse is not actually an IO[Any] type
 #   fix this
 
@@ -155,9 +156,7 @@ class ResourceAccessor(object):
                     IMPORTED_MAGIC = True
                     # This is because python-magic and file provide a magic module
                     # Only file's python has magic.detect_from_fobj
-                except AttributeError:
-                    pass
-                except:
+                except (AttributeError, IOError):
                     pass
 
                 if detected:

volatility/framework/layers/scanners/multiregexp.py

@@ -3,7 +3,7 @@
 #
 
 import re
-from typing import Generator, List, Tuple, Union
+from typing import Generator, List, Tuple
 
 
 class MultiRegexp(object):

volatility/framework/layers/vmware.py

@@ -49,7 +49,7 @@ class VmwareLayer(segmented.SegmentedLayer):
             raise VmwareFormatException(self.name, "Wrong magic bytes for Vmware layer: {}".format(repr(magic)))
 
         # TODO: Change certain structure sizes based on the version
-        version = magic[1] & 0xf
+        # version = magic[1] & 0xf
 
         group_size = struct.calcsize(self.group_structure)
 
@@ -91,9 +91,9 @@ class VmwareLayer(segmented.SegmentedLayer):
         if tags[("regionsCount", ())][1] == 0:
             raise VmwareFormatException(self.name, "VMware VMEM is not split into regions")
         for region in range(tags[("regionsCount", ())][1]):
-            offset = tags[("regionPPN", (region, ))][1] * self._page_size
-            mapped_offset = tags[("regionPageNum", (region, ))][1] * self._page_size
-            length = tags[("regionSize", (region, ))][1] * self._page_size
+            offset = tags[("regionPPN", (region,))][1] * self._page_size
+            mapped_offset = tags[("regionPageNum", (region,))][1] * self._page_size
+            length = tags[("regionSize", (region,))][1] * self._page_size
             self._segments.append((offset, mapped_offset, length, length))
 
     @property
@@ -111,7 +111,6 @@ class VmwareLayer(segmented.SegmentedLayer):
 
 
 class VmwareStacker(interfaces.automagic.StackerLayerInterface):
-
     stack_order = 20
 
     @classmethod

volatility/framework/objects/__init__.py

@@ -5,7 +5,6 @@
 import collections
 import logging
 import struct
-from collections import abc
 from typing import Any, ClassVar, Dict, List, Iterable, Optional, Tuple, Type, Union as TUnion, overload
 
 from volatility.framework import interfaces, constants
@@ -516,7 +515,7 @@ class Enumeration(interfaces.objects.ObjectInterface, int):
                     template.update_vol(base_type = new_child)
 
 
-class Array(interfaces.objects.ObjectInterface, abc.Sequence):
+class Array(interfaces.objects.ObjectInterface, collections.abc.Sequence):
     """Object which can contain a fixed number of an object type."""
 
     def __init__(self,
@@ -695,7 +694,7 @@ class AggregateType(interfaces.objects.ObjectInterface):
             if isinstance(cls, agg_type):
                 agg_name = agg_type.__name__
 
-        assert isinstance(members, abc.Mapping)
+        assert isinstance(members, collections.abc.Mapping)
         "{} members parameter must be a mapping: {}".format(agg_name, type(members))
         assert all([(isinstance(member, tuple) and len(member) == 2) for member in members.values()])
         "{} members must be a tuple of relative_offsets and templates".format(agg_name)

volatility/framework/plugins/linux/check_creds.py

@@ -4,7 +4,7 @@
 
 import logging
 
-from volatility.framework import interfaces, renderers, constants, contexts
+from volatility.framework import interfaces, renderers, constants
 from volatility.framework.configuration import requirements
 from volatility.plugins.linux import pslist
 
@@ -27,7 +27,7 @@ class Check_creds(interfaces.plugins.PluginInterface):
         ]
 
     def _generator(self):
-        vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0)
+        # vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0)
 
         type_task = self.context.symbol_space.get_type(self.config['vmlinux'] + constants.BANG + "task_struct")
 

volatility/framework/plugins/mac/kauth_listeners.py

@@ -2,16 +2,12 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
-import logging
-
-from typing import Iterable, Callable, Tuple
-
-from volatility.framework import renderers, interfaces, constants, exceptions, contexts
+from volatility.framework import renderers, interfaces, contexts
 from volatility.framework.configuration import requirements
 from volatility.framework.objects import utility
+from volatility.framework.renderers import format_hints
 from volatility.framework.symbols import mac
 from volatility.plugins.mac import lsmod, kauth_scopes
-from volatility.framework.renderers import format_hints
 
 
 class Kauth_listeners(interfaces.plugins.PluginInterface):

volatility/framework/plugins/mac/kauth_scopes.py

@@ -2,16 +2,14 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
-import logging
-
 from typing import Iterable, Callable, Tuple
 
-from volatility.framework import renderers, interfaces, constants, exceptions, contexts
+from volatility.framework import renderers, interfaces, contexts
 from volatility.framework.configuration import requirements
 from volatility.framework.objects import utility
+from volatility.framework.renderers import format_hints
 from volatility.framework.symbols import mac
 from volatility.plugins.mac import lsmod
-from volatility.framework.renderers import format_hints
 
 
 class Kauth_scopes(interfaces.plugins.PluginInterface):
@@ -37,8 +35,8 @@ class Kauth_scopes(interfaces.plugins.PluginInterface):
                           darwin_symbols: str,
                           filter_func: Callable[[int], bool] = lambda _: False) -> \
             Iterable[Tuple[interfaces.objects.ObjectInterface,
-                          interfaces.objects.ObjectInterface,
-                          interfaces.objects.ObjectInterface]]:
+                           interfaces.objects.ObjectInterface,
+                           interfaces.objects.ObjectInterface]]:
         """
         Enumerates the registered kauth scopes and yields each object
         Uses smear-safe enumeration API

volatility/framework/plugins/mac/kevents.py

@@ -2,11 +2,9 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
-import logging
-
 from typing import Iterable, Callable, Tuple
 
-from volatility.framework import renderers, interfaces, constants, exceptions, contexts
+from volatility.framework import renderers, interfaces, exceptions, contexts
 from volatility.framework.configuration import requirements
 from volatility.framework.objects import utility
 from volatility.framework.symbols import mac
@@ -76,7 +74,7 @@ class Kevents(interfaces.plugins.PluginInterface):
     def _walk_klist_array(cls, kernel, fdp, array_pointer_member, array_size_member):
         """
         Convience wrapper for walking an array of lists of kernel events
-        Handles invalid address references 
+        Handles invalid address references
         """
         try:
             klist_array_pointer = getattr(fdp, array_pointer_member)

volatility/framework/plugins/mac/list_files.py

@@ -2,21 +2,18 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 import logging
-
 from typing import Iterable, Optional
 
 from volatility.framework import renderers, interfaces, exceptions
-from volatility.framework.objects import utility
 from volatility.framework.configuration import requirements
 from volatility.framework.interfaces import plugins
+from volatility.framework.objects import utility
 from volatility.framework.renderers import format_hints
 from volatility.framework.symbols import mac
 from volatility.plugins.mac import mount
 
 vollog = logging.getLogger(__name__)
 
-import sys
-
 
 class List_Files(plugins.PluginInterface):
     """Lists all open file descriptors for all processes."""
@@ -114,9 +111,9 @@ class List_Files(plugins.PluginInterface):
 
     @classmethod
     def _walk_mounts(cls,
-                   context: interfaces.context.ContextInterface,
-                   layer_name: str,
-                   darwin_symbols: str) -> \
+                     context: interfaces.context.ContextInterface,
+                     layer_name: str,
+                     darwin_symbols: str) -> \
             Iterable[interfaces.objects.ObjectInterface]:
 
         loop_vnodes = {}

volatility/framework/plugins/mac/socket_filters.py

@@ -4,7 +4,6 @@
 import logging
 from typing import List
 
-import volatility
 from volatility.framework import exceptions, interfaces
 from volatility.framework import renderers, contexts
 from volatility.framework.configuration import requirements
@@ -38,7 +37,8 @@ class Socket_filters(plugins.PluginInterface):
 
         handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
 
-        members_to_check = ["sf_unregistered", "sf_attach", "sf_detach", "sf_notify", "sf_getpeername", "sf_getsockname", \
+        members_to_check = ["sf_unregistered", "sf_attach", "sf_detach", "sf_notify", "sf_getpeername",
+                            "sf_getsockname", \
                             "sf_data_in", "sf_data_out", "sf_connect_in", "sf_connect_out", "sf_bind", "sf_setoption", \
                             "sf_getoption", "sf_listen", "sf_ioctl"]
 

volatility/framework/plugins/mac/vfsevents.py

@@ -2,11 +2,7 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
-import logging
-
-from typing import Iterable, Callable, Tuple
-
-from volatility.framework import renderers, interfaces, constants, exceptions, contexts
+from volatility.framework import renderers, interfaces, exceptions, contexts
 from volatility.framework.configuration import requirements
 from volatility.framework.objects import utility
 

volatility/framework/plugins/windows/cmdline.py

@@ -46,7 +46,6 @@ class CmdLine(interfaces.plugins.PluginInterface):
             A string with the command line
         """
 
-        proc_id = proc.UniqueProcessId
         proc_layer_name = proc.add_process_layer()
 
         peb = context.object(kernel_table_name + constants.BANG + "_PEB",

volatility/framework/plugins/windows/hashdump.py

@@ -168,7 +168,6 @@ class Hashdump(interfaces.plugins.PluginInterface):
                 enc_lm_hash = sam_data[lm_offset + 0x04:lm_offset + 0x14]
                 lmhash = cls.decrypt_single_hash(rid, hbootkey, enc_lm_hash, cls.almpassword)
         elif lm_revision == b'\x02':
-            lm_exists = lm_len == 56
             if lm_len == 56:
                 lm_salt = sam_data[lm_offset + 4:lm_offset + 20]
                 enc_lm_hash = sam_data[lm_offset + 20:lm_offset + 52]

volatility/framework/plugins/windows/info.py

@@ -11,7 +11,6 @@ from volatility.framework.interfaces import plugins
 from volatility.framework.renderers import TreeGrid
 from volatility.framework.symbols import intermed
 from volatility.framework.symbols.windows import extensions
-from volatility.framework.symbols.windows.extensions import kdbg
 
 
 class Info(plugins.PluginInterface):

volatility/framework/plugins/windows/netscan.py

@@ -2,11 +2,11 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
-import logging
 import datetime
+import logging
 from typing import Iterable, List, Optional
 
-from volatility.framework import constants, exceptions, interfaces, renderers, symbols, layers
+from volatility.framework import constants, exceptions, interfaces, renderers, symbols
 from volatility.framework.configuration import requirements
 from volatility.framework.renderers import format_hints
 from volatility.framework.symbols import intermed
@@ -239,7 +239,7 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
              layer_name: str,
              nt_symbol_table: str,
              netscan_symbol_table: str) -> \
-        Iterable[interfaces.objects.ObjectInterface]:
+            Iterable[interfaces.objects.ObjectInterface]:
         """Scans for network objects using the poolscanner module and constraints.
 
         Args:

volatility/framework/plugins/windows/poolscanner.py

@@ -4,7 +4,7 @@
 
 import enum
 import logging
-from typing import Dict, Generator, List, Optional, Tuple, Callable
+from typing import Dict, Generator, List, Optional, Tuple
 
 from volatility.framework import constants, interfaces, renderers, exceptions, symbols
 from volatility.framework.configuration import requirements

volatility/framework/plugins/windows/privileges.py

@@ -1,14 +1,13 @@
 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 
+import json
 import logging
-import os, json
-from typing import Callable, List, Generator, Iterable
+import os
+from typing import List
 
 from volatility.framework import renderers, interfaces, objects, exceptions, constants
 from volatility.framework.configuration import requirements
-from volatility.framework.objects import utility
-from volatility.framework.renderers import format_hints
 from volatility.plugins.windows import pslist
 
 vollog = logging.getLogger(__name__)

volatility/framework/plugins/windows/registry/printkey.py

@@ -43,10 +43,10 @@ class PrintKey(interfaces.plugins.PluginInterface):
 
     @classmethod
     def key_iterator(
-        cls,
-        hive: RegistryHive,
-        node_path: Sequence[objects.StructType] = None,
-        recurse: bool = False
+            cls,
+            hive: RegistryHive,
+            node_path: Sequence[objects.StructType] = None,
+            recurse: bool = False
     ) -> Iterable[Tuple[int, bool, datetime.datetime, str, bool, interfaces.objects.ObjectInterface]]:
         """Walks through a set of nodes from a given node (last one in
         node_path). Avoids loops by not traversing into nodes already present
@@ -79,7 +79,7 @@ class PrintKey(interfaces.plugins.PluginInterface):
             if recurse:
                 if key_node.vol.offset not in [x.vol.offset for x in node_path]:
                     try:
-                        sub_node_name = key_node.get_name()
+                        key_node.get_name()
                     except exceptions.InvalidAddressException as excp:
                         vollog.debug(excp)
                         continue

volatility/framework/plugins/windows/vadinfo.py

@@ -183,7 +183,6 @@ class VadInfo(interfaces.plugins.PluginInterface):
 
         for proc in procs:
             process_name = utility.array_to_string(proc.ImageFileName)
-            proc_layer_name = proc.add_process_layer()
 
             for vad in self.list_vads(proc, filter_func = filter_func):
 

volatility/framework/renderers/__init__.py

@@ -9,7 +9,6 @@ or file or graphical output
 import collections
 import datetime
 import logging
-from collections import abc
 from typing import Any, Callable, Iterable, List, Optional, Tuple, TypeVar, Union
 
 from volatility.framework import interfaces
@@ -71,7 +70,7 @@ class TreeNode(interfaces.renderers.TreeNode):
     def _validate_values(self, values: List[interfaces.renderers.BaseTypes]) -> None:
         """A function for raising exceptions if a given set of values is
         invalid according to the column properties."""
-        if not (isinstance(values, abc.Sequence) and len(values) == len(self._treegrid.columns)):
+        if not (isinstance(values, collections.abc.Sequence) and len(values) == len(self._treegrid.columns)):
             raise TypeError(
                 "Values must be a list of objects made up of simple types and number the same as the columns")
         for index in range(len(self._treegrid.columns)):

volatility/framework/symbols/intermed.py

@@ -13,7 +13,6 @@ import zipfile
 from abc import ABCMeta
 from typing import Any, Dict, Generator, Iterable, List, Optional, Type, Tuple, Mapping
 
-import volatility
 import volatility.framework.layers.resources
 from volatility import schemas, symbols
 from volatility.framework import class_subclasses, constants, exceptions, interfaces, objects
@@ -22,6 +21,7 @@ from volatility.framework.symbols import native, metadata
 
 vollog = logging.getLogger(__name__)
 
+
 # ## TODO
 #
 # All symbol tables should take a label to an object template
@@ -48,7 +48,6 @@ vollog = logging.getLogger(__name__)
 
 
 def _construct_delegate_function(name: str, is_property: bool = False) -> Any:
-
     def _delegate_function(self, *args, **kwargs):
         if is_property:
             return getattr(self._delegate, name)

volatility/framework/symbols/linux/extensions/__init__.py

@@ -12,7 +12,6 @@ from volatility.framework.layers import linear
 from volatility.framework.objects import utility
 from volatility.framework.symbols import generic, linux
 from volatility.framework.symbols import intermed
-from volatility.framework.symbols.linux import extensions
 from volatility.framework.symbols.linux.extensions import elf
 
 vollog = logging.getLogger(__name__)
@@ -100,8 +99,6 @@ class module(generic.GenericIntelProcess):
             yield attr
 
     def get_symbols(self):
-        ret_syms = []
-
         if symbols.symbol_table_is_64bit(self._context, self.get_symbol_table().name):
             prefix = "Elf64_"
         else:
@@ -158,7 +155,7 @@ class module(generic.GenericIntelProcess):
             return self.kallsyms.strtab
         # Older kernels
         elif self.has_member("strtab"):
-            strtab = self.strtab
+            return self.strtab
 
         raise AttributeError("module -> strtab: Unable to get strtab")
 

volatility/framework/symbols/windows/extensions/__init__.py

@@ -12,10 +12,11 @@ from volatility.framework import constants, exceptions, interfaces, objects, ren
 from volatility.framework.layers import intel
 from volatility.framework.renderers import conversion
 from volatility.framework.symbols import generic
-from volatility.framework.symbols.windows.extensions import pool, pe
+from volatility.framework.symbols.windows.extensions import pool, pe, kdbg
 
 vollog = logging.getLogger(__name__)
 
+
 # Keep these in a basic module, to prevent import cycles when symbol providers require them
 
 
@@ -665,11 +666,11 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject):
             return self.VadRoot.dereference().cast("_MMVAD")
 
     def environment_variables(self):
-        """Generator for environment variables. 
+        """Generator for environment variables.
 
         The PEB points to our env block - a series of null-terminated
-        unicode strings. Each string cannot be more than 0x7FFF chars. 
-        End of the list is a quad-null. 
+        unicode strings. Each string cannot be more than 0x7FFF chars.
+        End of the list is a quad-null.
         """
         context = self._context
         process_space = self.add_process_layer()

volatility/framework/symbols/windows/extensions/pool.py

@@ -168,15 +168,15 @@ class POOL_HEADER(objects.StructType):
         headers = []
         sizes = []
         for header in [
-                'CREATOR_INFO', 'NAME_INFO', 'HANDLE_INFO', 'QUOTA_INFO', 'PROCESS_INFO', 'AUDIT_INFO', 'EXTENDED_INFO',
-                'HANDLE_REVOCATION_INFO', 'PADDING_INFO'
+            'CREATOR_INFO', 'NAME_INFO', 'HANDLE_INFO', 'QUOTA_INFO', 'PROCESS_INFO', 'AUDIT_INFO', 'EXTENDED_INFO',
+            'HANDLE_REVOCATION_INFO', 'PADDING_INFO'
         ]:
             try:
                 type_name = "{}{}_OBJECT_HEADER_{}".format(symbol_table_name, constants.BANG, header)
                 header_type = context.symbol_space.get_type(type_name)
                 headers.append(header)
                 sizes.append(header_type.size)
-            except:
+            except AttributeError:
                 # Some of these may not exist, for example:
                 #   if build < 9200: PADDING_INFO else: AUDIT_INFO
                 #   if build == 10586: HANDLE_REVOCATION_INFO else EXTENDED_INFO

volatility/schemas/__init__.py

@@ -64,16 +64,19 @@ def valid(input: Dict[str, Any], schema: Dict[str, Any], use_cache: bool = True)
         return True
     try:
         import jsonschema
-        vollog.debug("Validating JSON against schema...")
-        jsonschema.validate(input, schema)
-        cached_validations.add(input_hash)
-        vollog.debug("JSON validated against schema (result cached)")
     except ImportError:
         vollog.info("Dependency for validation unavailable: jsonschema")
         vollog.debug("All validations will report success, even with malformed input")
         return True
-    except:
+
+    try:
+        vollog.debug("Validating JSON against schema...")
+        jsonschema.validate(input, schema)
+        cached_validations.add(input_hash)
+        vollog.debug("JSON validated against schema (result cached)")
+    except jsonschema.exceptions.SchemaError:
         vollog.debug("Schema validation error", exc_info = True)
         return False
+
     record_cached_validations(cached_validations)
     return True