From 0a655d76a8e2d2082bf2df428faff22dda4390da Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 4 Nov 2020 22:41:39 +0000 Subject: [PATCH] Core: Fix LGTM recommendations This is mostly unused imports and unused variables. --- volatility/framework/automagic/linux.py | 1 - volatility/framework/interfaces/layers.py | 13 ++----------- volatility/framework/interfaces/objects.py | 13 ++++++------- volatility/framework/layers/qemu.py | 6 +++--- volatility/framework/layers/resources.py | 5 ++--- volatility/framework/layers/scanners/multiregexp.py | 2 +- volatility/framework/layers/vmware.py | 9 ++++----- volatility/framework/objects/__init__.py | 5 ++--- volatility/framework/plugins/linux/check_creds.py | 4 ++-- volatility/framework/plugins/mac/kauth_listeners.py | 8 ++------ volatility/framework/plugins/mac/kauth_scopes.py | 10 ++++------ volatility/framework/plugins/mac/kevents.py | 6 ++---- volatility/framework/plugins/mac/list_files.py | 11 ++++------- volatility/framework/plugins/mac/socket_filters.py | 4 ++-- volatility/framework/plugins/mac/vfsevents.py | 6 +----- volatility/framework/plugins/windows/cmdline.py | 1 - volatility/framework/plugins/windows/hashdump.py | 1 - volatility/framework/plugins/windows/info.py | 1 - volatility/framework/plugins/windows/netscan.py | 6 +++--- volatility/framework/plugins/windows/poolscanner.py | 2 +- volatility/framework/plugins/windows/privileges.py | 7 +++---- .../framework/plugins/windows/registry/printkey.py | 10 +++++----- volatility/framework/plugins/windows/vadinfo.py | 1 - volatility/framework/renderers/__init__.py | 3 +-- volatility/framework/symbols/intermed.py | 3 +-- .../framework/symbols/linux/extensions/__init__.py | 5 +---- .../symbols/windows/extensions/__init__.py | 9 +++++---- .../framework/symbols/windows/extensions/pool.py | 6 +++--- volatility/schemas/__init__.py | 13 ++++++++----- 29 files changed, 68 insertions(+), 103 deletions(-) diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index c9b94fd3d..6f7781b44 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -9,7 +9,6 @@ from volatility.framework import interfaces, constants from volatility.framework.automagic import symbol_cache, symbol_finder from volatility.framework.layers import intel, scanners from volatility.framework.symbols import linux -from volatility.framework.objects import utility vollog = logging.getLogger(__name__) diff --git a/volatility/framework/interfaces/layers.py b/volatility/framework/interfaces/layers.py index bd088fc09..369384b9c 100644 --- a/volatility/framework/interfaces/layers.py +++ b/volatility/framework/interfaces/layers.py @@ -11,27 +11,18 @@ import functools import logging import math import multiprocessing +import multiprocessing.managers import threading import traceback import types from abc import ABCMeta, abstractmethod -from multiprocessing import managers from typing import Any, Callable, Dict, Iterable, List, Mapping, Optional, Tuple, Union from volatility.framework import constants, exceptions, interfaces vollog = logging.getLogger(__name__) -IMPORTED_MAGIC = False -try: - import magic - - IMPORTED_MAGIC = True - vollog.debug("Imported python-magic, autodetecting compressed files based on content") -except ImportError: - pass - -ProgressValue = Union['DummyProgress', managers.ValueProxy] +ProgressValue = Union['DummyProgress', multiprocessing.managers.ValueProxy] IteratorValue = Tuple[List[Tuple[str, int, int]], int] diff --git a/volatility/framework/interfaces/objects.py b/volatility/framework/interfaces/objects.py index 1850cb2b6..88e6c061f 100644 --- a/volatility/framework/interfaces/objects.py +++ b/volatility/framework/interfaces/objects.py @@ -7,7 +7,6 @@ import abc import collections import collections.abc import logging -from abc import ABCMeta, abstractmethod from typing import Any, Dict, List, Mapping, Optional from volatility.framework import constants, interfaces @@ -88,7 +87,7 @@ class ObjectInformation(ReadOnlyMapping): }) -class ObjectInterface(metaclass = ABCMeta): +class ObjectInterface(metaclass = abc.ABCMeta): """A base object required to be the ancestor of every object used in volatility.""" @@ -129,7 +128,7 @@ class ObjectInterface(metaclass = ABCMeta): # Wrap the outgoing vol in a read-only proxy return ReadOnlyMapping(self._vol) - @abstractmethod + @abc.abstractmethod def write(self, value: Any): """Writes the new value into the format at the offset the object currently resides at.""" @@ -296,20 +295,20 @@ class Template: return [] @property - @abstractmethod + @abc.abstractmethod def size(self) -> int: """Returns the size of the template.""" - @abstractmethod + @abc.abstractmethod def relative_child_offset(self, child: str) -> int: """Returns the relative offset of the `child` member from its parent offset.""" - @abstractmethod + @abc.abstractmethod def replace_child(self, old_child: 'Template', new_child: 'Template') -> None: """Replaces `old_child` with `new_child` in the list of children.""" - @abstractmethod + @abc.abstractmethod def has_member(self, member_name: str) -> bool: """Returns whether the object would contain a member called `member_name`""" diff --git a/volatility/framework/layers/qemu.py b/volatility/framework/layers/qemu.py index 70736f960..d5f926639 100644 --- a/volatility/framework/layers/qemu.py +++ b/volatility/framework/layers/qemu.py @@ -151,9 +151,9 @@ class QemuSuspendLayer(segmented.NonLinearlySegmentedLayer): layer_name = self._base_layer, max_length = name_len) index += name_len - instance_id = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned long', - offset = index, - layer_name = self._base_layer) + # instance_id = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned long', + # offset = index, + # layer_name = self._base_layer) index += 4 version_id = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned long', offset = index, diff --git a/volatility/framework/layers/resources.py b/volatility/framework/layers/resources.py index bb5d9d494..8ed9a77cb 100644 --- a/volatility/framework/layers/resources.py +++ b/volatility/framework/layers/resources.py @@ -33,6 +33,7 @@ except ImportError: vollog = logging.getLogger(__name__) + # TODO: Type-annotating the ResourceAccessor.open method is difficult because HTTPResponse is not actually an IO[Any] type # fix this @@ -155,9 +156,7 @@ class ResourceAccessor(object): IMPORTED_MAGIC = True # This is because python-magic and file provide a magic module # Only file's python has magic.detect_from_fobj - except AttributeError: - pass - except: + except (AttributeError, IOError): pass if detected: diff --git a/volatility/framework/layers/scanners/multiregexp.py b/volatility/framework/layers/scanners/multiregexp.py index d69f4cf72..36c6410aa 100644 --- a/volatility/framework/layers/scanners/multiregexp.py +++ b/volatility/framework/layers/scanners/multiregexp.py @@ -3,7 +3,7 @@ # import re -from typing import Generator, List, Tuple, Union +from typing import Generator, List, Tuple class MultiRegexp(object): diff --git a/volatility/framework/layers/vmware.py b/volatility/framework/layers/vmware.py index d9b0b4e08..95eb7b75e 100644 --- a/volatility/framework/layers/vmware.py +++ b/volatility/framework/layers/vmware.py @@ -49,7 +49,7 @@ class VmwareLayer(segmented.SegmentedLayer): raise VmwareFormatException(self.name, "Wrong magic bytes for Vmware layer: {}".format(repr(magic))) # TODO: Change certain structure sizes based on the version - version = magic[1] & 0xf + # version = magic[1] & 0xf group_size = struct.calcsize(self.group_structure) @@ -91,9 +91,9 @@ class VmwareLayer(segmented.SegmentedLayer): if tags[("regionsCount", ())][1] == 0: raise VmwareFormatException(self.name, "VMware VMEM is not split into regions") for region in range(tags[("regionsCount", ())][1]): - offset = tags[("regionPPN", (region, ))][1] * self._page_size - mapped_offset = tags[("regionPageNum", (region, ))][1] * self._page_size - length = tags[("regionSize", (region, ))][1] * self._page_size + offset = tags[("regionPPN", (region,))][1] * self._page_size + mapped_offset = tags[("regionPageNum", (region,))][1] * self._page_size + length = tags[("regionSize", (region,))][1] * self._page_size self._segments.append((offset, mapped_offset, length, length)) @property @@ -111,7 +111,6 @@ class VmwareLayer(segmented.SegmentedLayer): class VmwareStacker(interfaces.automagic.StackerLayerInterface): - stack_order = 20 @classmethod diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index 89d08f664..ec62f1fcc 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -5,7 +5,6 @@ import collections import logging import struct -from collections import abc from typing import Any, ClassVar, Dict, List, Iterable, Optional, Tuple, Type, Union as TUnion, overload from volatility.framework import interfaces, constants @@ -516,7 +515,7 @@ class Enumeration(interfaces.objects.ObjectInterface, int): template.update_vol(base_type = new_child) -class Array(interfaces.objects.ObjectInterface, abc.Sequence): +class Array(interfaces.objects.ObjectInterface, collections.abc.Sequence): """Object which can contain a fixed number of an object type.""" def __init__(self, @@ -695,7 +694,7 @@ class AggregateType(interfaces.objects.ObjectInterface): if isinstance(cls, agg_type): agg_name = agg_type.__name__ - assert isinstance(members, abc.Mapping) + assert isinstance(members, collections.abc.Mapping) "{} members parameter must be a mapping: {}".format(agg_name, type(members)) assert all([(isinstance(member, tuple) and len(member) == 2) for member in members.values()]) "{} members must be a tuple of relative_offsets and templates".format(agg_name) diff --git a/volatility/framework/plugins/linux/check_creds.py b/volatility/framework/plugins/linux/check_creds.py index d2300debb..7d68bf644 100644 --- a/volatility/framework/plugins/linux/check_creds.py +++ b/volatility/framework/plugins/linux/check_creds.py @@ -4,7 +4,7 @@ import logging -from volatility.framework import interfaces, renderers, constants, contexts +from volatility.framework import interfaces, renderers, constants from volatility.framework.configuration import requirements from volatility.plugins.linux import pslist @@ -27,7 +27,7 @@ class Check_creds(interfaces.plugins.PluginInterface): ] def _generator(self): - vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0) + # vmlinux = contexts.Module(self.context, self.config['vmlinux'], self.config['primary'], 0) type_task = self.context.symbol_space.get_type(self.config['vmlinux'] + constants.BANG + "task_struct") diff --git a/volatility/framework/plugins/mac/kauth_listeners.py b/volatility/framework/plugins/mac/kauth_listeners.py index d52234603..1eed0b415 100644 --- a/volatility/framework/plugins/mac/kauth_listeners.py +++ b/volatility/framework/plugins/mac/kauth_listeners.py @@ -2,16 +2,12 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import logging - -from typing import Iterable, Callable, Tuple - -from volatility.framework import renderers, interfaces, constants, exceptions, contexts +from volatility.framework import renderers, interfaces, contexts from volatility.framework.configuration import requirements from volatility.framework.objects import utility +from volatility.framework.renderers import format_hints from volatility.framework.symbols import mac from volatility.plugins.mac import lsmod, kauth_scopes -from volatility.framework.renderers import format_hints class Kauth_listeners(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/kauth_scopes.py b/volatility/framework/plugins/mac/kauth_scopes.py index d8ab8a1fe..1541b45c4 100644 --- a/volatility/framework/plugins/mac/kauth_scopes.py +++ b/volatility/framework/plugins/mac/kauth_scopes.py @@ -2,16 +2,14 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import logging - from typing import Iterable, Callable, Tuple -from volatility.framework import renderers, interfaces, constants, exceptions, contexts +from volatility.framework import renderers, interfaces, contexts from volatility.framework.configuration import requirements from volatility.framework.objects import utility +from volatility.framework.renderers import format_hints from volatility.framework.symbols import mac from volatility.plugins.mac import lsmod -from volatility.framework.renderers import format_hints class Kauth_scopes(interfaces.plugins.PluginInterface): @@ -37,8 +35,8 @@ class Kauth_scopes(interfaces.plugins.PluginInterface): darwin_symbols: str, filter_func: Callable[[int], bool] = lambda _: False) -> \ Iterable[Tuple[interfaces.objects.ObjectInterface, - interfaces.objects.ObjectInterface, - interfaces.objects.ObjectInterface]]: + interfaces.objects.ObjectInterface, + interfaces.objects.ObjectInterface]]: """ Enumerates the registered kauth scopes and yields each object Uses smear-safe enumeration API diff --git a/volatility/framework/plugins/mac/kevents.py b/volatility/framework/plugins/mac/kevents.py index 19d46109d..10154350c 100644 --- a/volatility/framework/plugins/mac/kevents.py +++ b/volatility/framework/plugins/mac/kevents.py @@ -2,11 +2,9 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import logging - from typing import Iterable, Callable, Tuple -from volatility.framework import renderers, interfaces, constants, exceptions, contexts +from volatility.framework import renderers, interfaces, exceptions, contexts from volatility.framework.configuration import requirements from volatility.framework.objects import utility from volatility.framework.symbols import mac @@ -76,7 +74,7 @@ class Kevents(interfaces.plugins.PluginInterface): def _walk_klist_array(cls, kernel, fdp, array_pointer_member, array_size_member): """ Convience wrapper for walking an array of lists of kernel events - Handles invalid address references + Handles invalid address references """ try: klist_array_pointer = getattr(fdp, array_pointer_member) diff --git a/volatility/framework/plugins/mac/list_files.py b/volatility/framework/plugins/mac/list_files.py index 03d4cfaa1..a1a062113 100644 --- a/volatility/framework/plugins/mac/list_files.py +++ b/volatility/framework/plugins/mac/list_files.py @@ -2,21 +2,18 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging - from typing import Iterable, Optional from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.objects import utility from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins +from volatility.framework.objects import utility from volatility.framework.renderers import format_hints from volatility.framework.symbols import mac from volatility.plugins.mac import mount vollog = logging.getLogger(__name__) -import sys - class List_Files(plugins.PluginInterface): """Lists all open file descriptors for all processes.""" @@ -114,9 +111,9 @@ class List_Files(plugins.PluginInterface): @classmethod def _walk_mounts(cls, - context: interfaces.context.ContextInterface, - layer_name: str, - darwin_symbols: str) -> \ + context: interfaces.context.ContextInterface, + layer_name: str, + darwin_symbols: str) -> \ Iterable[interfaces.objects.ObjectInterface]: loop_vnodes = {} diff --git a/volatility/framework/plugins/mac/socket_filters.py b/volatility/framework/plugins/mac/socket_filters.py index ec987c8e2..d33e2b58a 100644 --- a/volatility/framework/plugins/mac/socket_filters.py +++ b/volatility/framework/plugins/mac/socket_filters.py @@ -4,7 +4,6 @@ import logging from typing import List -import volatility from volatility.framework import exceptions, interfaces from volatility.framework import renderers, contexts from volatility.framework.configuration import requirements @@ -38,7 +37,8 @@ class Socket_filters(plugins.PluginInterface): handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) - members_to_check = ["sf_unregistered", "sf_attach", "sf_detach", "sf_notify", "sf_getpeername", "sf_getsockname", \ + members_to_check = ["sf_unregistered", "sf_attach", "sf_detach", "sf_notify", "sf_getpeername", + "sf_getsockname", \ "sf_data_in", "sf_data_out", "sf_connect_in", "sf_connect_out", "sf_bind", "sf_setoption", \ "sf_getoption", "sf_listen", "sf_ioctl"] diff --git a/volatility/framework/plugins/mac/vfsevents.py b/volatility/framework/plugins/mac/vfsevents.py index 717dcc5b0..2a8db4a9d 100644 --- a/volatility/framework/plugins/mac/vfsevents.py +++ b/volatility/framework/plugins/mac/vfsevents.py @@ -2,11 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import logging - -from typing import Iterable, Callable, Tuple - -from volatility.framework import renderers, interfaces, constants, exceptions, contexts +from volatility.framework import renderers, interfaces, exceptions, contexts from volatility.framework.configuration import requirements from volatility.framework.objects import utility diff --git a/volatility/framework/plugins/windows/cmdline.py b/volatility/framework/plugins/windows/cmdline.py index d27c8513d..83ac2aa02 100644 --- a/volatility/framework/plugins/windows/cmdline.py +++ b/volatility/framework/plugins/windows/cmdline.py @@ -46,7 +46,6 @@ class CmdLine(interfaces.plugins.PluginInterface): A string with the command line """ - proc_id = proc.UniqueProcessId proc_layer_name = proc.add_process_layer() peb = context.object(kernel_table_name + constants.BANG + "_PEB", diff --git a/volatility/framework/plugins/windows/hashdump.py b/volatility/framework/plugins/windows/hashdump.py index f6e103c85..64e312bb0 100644 --- a/volatility/framework/plugins/windows/hashdump.py +++ b/volatility/framework/plugins/windows/hashdump.py @@ -168,7 +168,6 @@ class Hashdump(interfaces.plugins.PluginInterface): enc_lm_hash = sam_data[lm_offset + 0x04:lm_offset + 0x14] lmhash = cls.decrypt_single_hash(rid, hbootkey, enc_lm_hash, cls.almpassword) elif lm_revision == b'\x02': - lm_exists = lm_len == 56 if lm_len == 56: lm_salt = sam_data[lm_offset + 4:lm_offset + 20] enc_lm_hash = sam_data[lm_offset + 20:lm_offset + 52] diff --git a/volatility/framework/plugins/windows/info.py b/volatility/framework/plugins/windows/info.py index efc2926d3..90ede538a 100644 --- a/volatility/framework/plugins/windows/info.py +++ b/volatility/framework/plugins/windows/info.py @@ -11,7 +11,6 @@ from volatility.framework.interfaces import plugins from volatility.framework.renderers import TreeGrid from volatility.framework.symbols import intermed from volatility.framework.symbols.windows import extensions -from volatility.framework.symbols.windows.extensions import kdbg class Info(plugins.PluginInterface): diff --git a/volatility/framework/plugins/windows/netscan.py b/volatility/framework/plugins/windows/netscan.py index 4b3650bf0..00eb8726a 100644 --- a/volatility/framework/plugins/windows/netscan.py +++ b/volatility/framework/plugins/windows/netscan.py @@ -2,11 +2,11 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import logging import datetime +import logging from typing import Iterable, List, Optional -from volatility.framework import constants, exceptions, interfaces, renderers, symbols, layers +from volatility.framework import constants, exceptions, interfaces, renderers, symbols from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints from volatility.framework.symbols import intermed @@ -239,7 +239,7 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): layer_name: str, nt_symbol_table: str, netscan_symbol_table: str) -> \ - Iterable[interfaces.objects.ObjectInterface]: + Iterable[interfaces.objects.ObjectInterface]: """Scans for network objects using the poolscanner module and constraints. Args: diff --git a/volatility/framework/plugins/windows/poolscanner.py b/volatility/framework/plugins/windows/poolscanner.py index 2c1df940d..c888c1f6a 100644 --- a/volatility/framework/plugins/windows/poolscanner.py +++ b/volatility/framework/plugins/windows/poolscanner.py @@ -4,7 +4,7 @@ import enum import logging -from typing import Dict, Generator, List, Optional, Tuple, Callable +from typing import Dict, Generator, List, Optional, Tuple from volatility.framework import constants, interfaces, renderers, exceptions, symbols from volatility.framework.configuration import requirements diff --git a/volatility/framework/plugins/windows/privileges.py b/volatility/framework/plugins/windows/privileges.py index 7fc9ad95a..cd642950c 100644 --- a/volatility/framework/plugins/windows/privileges.py +++ b/volatility/framework/plugins/windows/privileges.py @@ -1,14 +1,13 @@ # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +import json import logging -import os, json -from typing import Callable, List, Generator, Iterable +import os +from typing import List from volatility.framework import renderers, interfaces, objects, exceptions, constants from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints from volatility.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/registry/printkey.py b/volatility/framework/plugins/windows/registry/printkey.py index 547e65930..2fe3337cf 100644 --- a/volatility/framework/plugins/windows/registry/printkey.py +++ b/volatility/framework/plugins/windows/registry/printkey.py @@ -43,10 +43,10 @@ class PrintKey(interfaces.plugins.PluginInterface): @classmethod def key_iterator( - cls, - hive: RegistryHive, - node_path: Sequence[objects.StructType] = None, - recurse: bool = False + cls, + hive: RegistryHive, + node_path: Sequence[objects.StructType] = None, + recurse: bool = False ) -> Iterable[Tuple[int, bool, datetime.datetime, str, bool, interfaces.objects.ObjectInterface]]: """Walks through a set of nodes from a given node (last one in node_path). Avoids loops by not traversing into nodes already present @@ -79,7 +79,7 @@ class PrintKey(interfaces.plugins.PluginInterface): if recurse: if key_node.vol.offset not in [x.vol.offset for x in node_path]: try: - sub_node_name = key_node.get_name() + key_node.get_name() except exceptions.InvalidAddressException as excp: vollog.debug(excp) continue diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility/framework/plugins/windows/vadinfo.py index 2a23fa4f9..a68bd7171 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility/framework/plugins/windows/vadinfo.py @@ -183,7 +183,6 @@ class VadInfo(interfaces.plugins.PluginInterface): for proc in procs: process_name = utility.array_to_string(proc.ImageFileName) - proc_layer_name = proc.add_process_layer() for vad in self.list_vads(proc, filter_func = filter_func): diff --git a/volatility/framework/renderers/__init__.py b/volatility/framework/renderers/__init__.py index c77be2346..59517ba2e 100644 --- a/volatility/framework/renderers/__init__.py +++ b/volatility/framework/renderers/__init__.py @@ -9,7 +9,6 @@ or file or graphical output import collections import datetime import logging -from collections import abc from typing import Any, Callable, Iterable, List, Optional, Tuple, TypeVar, Union from volatility.framework import interfaces @@ -71,7 +70,7 @@ class TreeNode(interfaces.renderers.TreeNode): def _validate_values(self, values: List[interfaces.renderers.BaseTypes]) -> None: """A function for raising exceptions if a given set of values is invalid according to the column properties.""" - if not (isinstance(values, abc.Sequence) and len(values) == len(self._treegrid.columns)): + if not (isinstance(values, collections.abc.Sequence) and len(values) == len(self._treegrid.columns)): raise TypeError( "Values must be a list of objects made up of simple types and number the same as the columns") for index in range(len(self._treegrid.columns)): diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 4e1b19ad0..951659e0b 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -13,7 +13,6 @@ import zipfile from abc import ABCMeta from typing import Any, Dict, Generator, Iterable, List, Optional, Type, Tuple, Mapping -import volatility import volatility.framework.layers.resources from volatility import schemas, symbols from volatility.framework import class_subclasses, constants, exceptions, interfaces, objects @@ -22,6 +21,7 @@ from volatility.framework.symbols import native, metadata vollog = logging.getLogger(__name__) + # ## TODO # # All symbol tables should take a label to an object template @@ -48,7 +48,6 @@ vollog = logging.getLogger(__name__) def _construct_delegate_function(name: str, is_property: bool = False) -> Any: - def _delegate_function(self, *args, **kwargs): if is_property: return getattr(self._delegate, name) diff --git a/volatility/framework/symbols/linux/extensions/__init__.py b/volatility/framework/symbols/linux/extensions/__init__.py index 0ca7aa4f4..bddb3c7a3 100644 --- a/volatility/framework/symbols/linux/extensions/__init__.py +++ b/volatility/framework/symbols/linux/extensions/__init__.py @@ -12,7 +12,6 @@ from volatility.framework.layers import linear from volatility.framework.objects import utility from volatility.framework.symbols import generic, linux from volatility.framework.symbols import intermed -from volatility.framework.symbols.linux import extensions from volatility.framework.symbols.linux.extensions import elf vollog = logging.getLogger(__name__) @@ -100,8 +99,6 @@ class module(generic.GenericIntelProcess): yield attr def get_symbols(self): - ret_syms = [] - if symbols.symbol_table_is_64bit(self._context, self.get_symbol_table().name): prefix = "Elf64_" else: @@ -158,7 +155,7 @@ class module(generic.GenericIntelProcess): return self.kallsyms.strtab # Older kernels elif self.has_member("strtab"): - strtab = self.strtab + return self.strtab raise AttributeError("module -> strtab: Unable to get strtab") diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index eebfb3a91..34cbae0da 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -12,10 +12,11 @@ from volatility.framework import constants, exceptions, interfaces, objects, ren from volatility.framework.layers import intel from volatility.framework.renderers import conversion from volatility.framework.symbols import generic -from volatility.framework.symbols.windows.extensions import pool, pe +from volatility.framework.symbols.windows.extensions import pool, pe, kdbg vollog = logging.getLogger(__name__) + # Keep these in a basic module, to prevent import cycles when symbol providers require them @@ -665,11 +666,11 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): return self.VadRoot.dereference().cast("_MMVAD") def environment_variables(self): - """Generator for environment variables. + """Generator for environment variables. The PEB points to our env block - a series of null-terminated - unicode strings. Each string cannot be more than 0x7FFF chars. - End of the list is a quad-null. + unicode strings. Each string cannot be more than 0x7FFF chars. + End of the list is a quad-null. """ context = self._context process_space = self.add_process_layer() diff --git a/volatility/framework/symbols/windows/extensions/pool.py b/volatility/framework/symbols/windows/extensions/pool.py index c5ced8399..e61764be8 100644 --- a/volatility/framework/symbols/windows/extensions/pool.py +++ b/volatility/framework/symbols/windows/extensions/pool.py @@ -168,15 +168,15 @@ class POOL_HEADER(objects.StructType): headers = [] sizes = [] for header in [ - 'CREATOR_INFO', 'NAME_INFO', 'HANDLE_INFO', 'QUOTA_INFO', 'PROCESS_INFO', 'AUDIT_INFO', 'EXTENDED_INFO', - 'HANDLE_REVOCATION_INFO', 'PADDING_INFO' + 'CREATOR_INFO', 'NAME_INFO', 'HANDLE_INFO', 'QUOTA_INFO', 'PROCESS_INFO', 'AUDIT_INFO', 'EXTENDED_INFO', + 'HANDLE_REVOCATION_INFO', 'PADDING_INFO' ]: try: type_name = "{}{}_OBJECT_HEADER_{}".format(symbol_table_name, constants.BANG, header) header_type = context.symbol_space.get_type(type_name) headers.append(header) sizes.append(header_type.size) - except: + except AttributeError: # Some of these may not exist, for example: # if build < 9200: PADDING_INFO else: AUDIT_INFO # if build == 10586: HANDLE_REVOCATION_INFO else EXTENDED_INFO diff --git a/volatility/schemas/__init__.py b/volatility/schemas/__init__.py index 3fe70ae5c..0e140c7d0 100644 --- a/volatility/schemas/__init__.py +++ b/volatility/schemas/__init__.py @@ -64,16 +64,19 @@ def valid(input: Dict[str, Any], schema: Dict[str, Any], use_cache: bool = True) return True try: import jsonschema - vollog.debug("Validating JSON against schema...") - jsonschema.validate(input, schema) - cached_validations.add(input_hash) - vollog.debug("JSON validated against schema (result cached)") except ImportError: vollog.info("Dependency for validation unavailable: jsonschema") vollog.debug("All validations will report success, even with malformed input") return True - except: + + try: + vollog.debug("Validating JSON against schema...") + jsonschema.validate(input, schema) + cached_validations.add(input_hash) + vollog.debug("JSON validated against schema (result cached)") + except jsonschema.exceptions.SchemaError: vollog.debug("Schema validation error", exc_info = True) return False + record_cached_validations(cached_validations) return True