Core: Apply yapf across all files again.

volatility/cli/text_renderer.py

@@ -246,8 +246,9 @@ class PrettyTextRenderer(CLIRenderer):
         tree_indent_column = ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(20))
         max_column_widths = dict([(column.name, len(column.name)) for column in grid.columns])
 
-        def visitor(node, accumulator: List[Tuple[int, Dict[interfaces.renderers.Column, bytes]]]
-                    ) -> List[Tuple[int, Dict[interfaces.renderers.Column, bytes]]]:
+        def visitor(
+            node, accumulator: List[Tuple[int, Dict[interfaces.renderers.Column, bytes]]]
+        ) -> List[Tuple[int, Dict[interfaces.renderers.Column, bytes]]]:
             # Nodes always have a path value, giving them a path_depth of at least 1, we use max just in case
             max_column_widths[tree_indent_column] = max(max_column_widths.get(tree_indent_column, 0), node.path_depth)
             line = {}
@@ -307,8 +308,8 @@ class JsonRenderer(CLIRenderer):
         final_output = ({}, [])
 
         def visitor(
-                node: Optional[interfaces.renderers.TreeNode],
-                accumulator: Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]],
+            node: Optional[interfaces.renderers.TreeNode],
+            accumulator: Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]],
         ) -> Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]]:
             # Nodes always have a path value, giving them a path_depth of at least 1, we use max just in case
             acc_map, final_tree = accumulator

volatility/framework/automagic/__init__.py

@@ -80,8 +80,8 @@ def choose_automagic(automagics, plugin):
 
 def run(automagics: List[interfaces.automagic.AutomagicInterface],
         context: interfaces.context.ContextInterface,
-        configurable: Union[interfaces.configuration.ConfigurableInterface, Type[interfaces.configuration.
-                                                                                 ConfigurableInterface]],
+        configurable: Union[interfaces.configuration.ConfigurableInterface,
+                            Type[interfaces.configuration.ConfigurableInterface]],
         config_path: str,
         progress_callback: constants.ProgressCallback = None) -> List[traceback.TracebackException]:
     """Runs through the list of `automagics` in order, allowing them to make

volatility/framework/automagic/mac.py

@@ -119,24 +119,23 @@ class MacUtilities(object):
     """Class with multiple useful mac functions."""
 
     @classmethod
-    def mask_mods_list(cls,
-                      context: interfaces.context.ContextInterface,
-                      layer_name: str,
-                      mods: Iterator[Any]) -> Iterator[Any]:
-
+    def mask_mods_list(cls, context: interfaces.context.ContextInterface, layer_name: str,
+                       mods: Iterator[Any]) -> Iterator[Any]:
         """
         A helper function to mask the starting and end address of kernel modules
         """
         mask = context.layers[layer_name].address_mask
 
-        return [(objects.utility.array_to_string(mod.name), mod.address & mask, (mod.address & mask) + mod.size) for mod in mods]
+        return [(objects.utility.array_to_string(mod.name), mod.address & mask, (mod.address & mask) + mod.size)
+                for mod in mods]
 
     @classmethod
-    def generate_kernel_handler_info(cls,
-                                     context: interfaces.context.ContextInterface,
-                                     layer_name: str,
-                                     kernel, # ikelos - how to type this??
-                                     mods_list: Iterator[Any]):
+    def generate_kernel_handler_info(
+            cls,
+            context: interfaces.context.ContextInterface,
+            layer_name: str,
+            kernel,  # ikelos - how to type this??
+            mods_list: Iterator[Any]):
 
         try:
             start_addr = kernel.object_from_symbol("vm_kernel_stext")
@@ -149,17 +148,15 @@ class MacUtilities(object):
             end_addr = kernel.object_from_symbol("etext")
 
         mask = context.layers[layer_name].address_mask
-        
+
         start_addr = start_addr & mask
-        end_addr   = end_addr & mask
+        end_addr = end_addr & mask
 
         return [("__kernel__", start_addr, end_addr)] + \
                     MacUtilities.mask_mods_list(context, layer_name, mods_list)
 
     @classmethod
-    def lookup_module_address(cls,
-                              context: interfaces.context.ContextInterface, 
-                              handlers: Iterator[Any],
+    def lookup_module_address(cls, context: interfaces.context.ContextInterface, handlers: Iterator[Any],
                               target_address):
         mod_name = "UNKNOWN"
         symbol_name = "N/A"
@@ -169,14 +166,14 @@ class MacUtilities(object):
                 mod_name = name
                 if name == "__kernel__":
                     symbols = list(context.symbol_space.get_symbols_by_location(target_address))
-        
+
                     if len(symbols) > 0:
                         symbol_name = str(symbols[0].split(constants.BANG)[1]) if constants.BANG in symbols[0] else \
                                        str(symbols[0])
 
                 break
-    
-        return mod_name, symbol_name 
+
+        return mod_name, symbol_name
 
     @classmethod
     def aslr_mask_symbol_table(cls,
@@ -274,11 +271,8 @@ class MacUtilities(object):
         return addr - 0xffffff8000000000
 
     @classmethod
-    def files_descriptors_for_process(cls, 
-                                      context: interfaces.context.ContextInterface,
-                                      symbol_table_name : str,
+    def files_descriptors_for_process(cls, context: interfaces.context.ContextInterface, symbol_table_name: str,
                                       task: interfaces.objects.ObjectInterface):
-
         """Creates a generator for the file descriptors of a process
 
         Args:
@@ -335,7 +329,9 @@ class MacUtilities(object):
                 yield f, path, fd_num
 
     @classmethod
-    def walk_tailq(cls, queue: interfaces.objects.ObjectInterface, next_member: str,
+    def walk_tailq(cls,
+                   queue: interfaces.objects.ObjectInterface,
+                   next_member: str,
                    max_elements: int = 4096) -> Iterable[interfaces.objects.ObjectInterface]:
         seen = set()  # type: Set[int]
 

volatility/framework/automagic/pdbscan.py

@@ -228,7 +228,10 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
                 else:
                     vollog.debug("No suitable kernel pdb signature found")
 
-    def download_pdb_isf(self, guid: str, age: int, pdb_name: str,
+    def download_pdb_isf(self,
+                         guid: str,
+                         age: int,
+                         pdb_name: str,
                          progress_callback: constants.ProgressCallback = None) -> None:
         """Attempts to download the PDB file, convert it to an ISF file and
         save it to one of the symbol locations."""

volatility/framework/interfaces/automagic.py

@@ -60,8 +60,8 @@ class AutomagicInterface(interfaces.configuration.ConfigurableInterface, metacla
                           context: interfaces.context.ContextInterface,
                           config_path: str,
                           requirement_root: interfaces.configuration.RequirementInterface,
-                          requirement_type: Union[Tuple[Type[interfaces.configuration.RequirementInterface], ...], Type[
-                              interfaces.configuration.RequirementInterface]],
+                          requirement_type: Union[Tuple[Type[interfaces.configuration.RequirementInterface], ...],
+                                                  Type[interfaces.configuration.RequirementInterface]],
                           shortcut: bool = True) -> List[Tuple[str, interfaces.configuration.RequirementInterface]]:
         """Determines if there is actually an unfulfilled `Requirement`
         waiting.

volatility/framework/interfaces/configuration.py

@@ -62,7 +62,8 @@ class HierarchicalDict(collections.abc.Mapping):
     """The core of configuration data, it is a mapping class that stores keys
     within itself, and also stores lower hierarchies."""
 
-    def __init__(self, initial_dict: Dict[str, 'SimpleTypeRequirement'] = None,
+    def __init__(self,
+                 initial_dict: Dict[str, 'SimpleTypeRequirement'] = None,
                  separator: str = CONFIG_SEPARATOR) -> None:
         """
         Args:

volatility/framework/interfaces/layers.py

@@ -302,8 +302,8 @@ class DataLayerInterface(interfaces.configuration.ConfigurableInterface, metacla
                 result[1] = (last_start, self.maximum_address - last_start)
         return result
 
-    def _scan_iterator(self, scanner: 'ScannerInterface',
-                       sections: Iterable[Tuple[int, int]]) -> Iterable[IteratorValue]:
+    def _scan_iterator(self, scanner: 'ScannerInterface', sections: Iterable[Tuple[int,
+                                                                                   int]]) -> Iterable[IteratorValue]:
         """Iterator that indicates which blocks in the layer are to be read by
         for the scanning.
 
@@ -377,7 +377,9 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta):
     """
 
     @abstractmethod
-    def mapping(self, offset: int, length: int,
+    def mapping(self,
+                offset: int,
+                length: int,
                 ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]:
         """Returns a sorted iterable of (offset, sublength, mapped_offset, mapped_length, layer)
         mappings.
@@ -466,7 +468,9 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta):
 
             current_offset += len(new_data)
 
-    def _scan_iterator(self, scanner: 'ScannerInterface', sections: Iterable[Tuple[int, int]],
+    def _scan_iterator(self,
+                       scanner: 'ScannerInterface',
+                       sections: Iterable[Tuple[int, int]],
                        linear: bool = False) -> Iterable[IteratorValue]:
         """Iterator that indicates which blocks in the layer are to be read by
         for the scanning.

volatility/framework/layers/intel.py

@@ -171,7 +171,9 @@ class Intel(linear.LinearlyMappedLayer):
         except exceptions.InvalidAddressException:
             return False
 
-    def mapping(self, offset: int, length: int,
+    def mapping(self,
+                offset: int,
+                length: int,
                 ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]:
         """Returns a sorted iterable of (offset, sublength, mapped_offset, mapped_length, layer)
         mappings.

volatility/framework/layers/linear.py

@@ -65,6 +65,8 @@ class LinearlyMappedLayer(interfaces.layers.TranslationLayerInterface):
             value = value[length:]
             current_offset += length
 
-    def _scan_iterator(self, scanner: 'ScannerInterface', sections: Iterable[Tuple[int, int]],
+    def _scan_iterator(self,
+                       scanner: 'ScannerInterface',
+                       sections: Iterable[Tuple[int, int]],
                        linear: bool = True) -> Iterable[IteratorValue]:
         return super()._scan_iterator(scanner, sections, linear)

volatility/framework/layers/msf.py

@@ -136,7 +136,9 @@ class PdbMultiStreamFormat(linear.LinearlyMappedLayer):
     def is_valid(self, offset: int, length: int = 1) -> bool:
         return self.context.layers[self._base_layer].is_valid(offset, length)
 
-    def mapping(self, offset: int, length: int,
+    def mapping(self,
+                offset: int,
+                length: int,
                 ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]:
         yield offset, length, offset, length, self._base_layer
 
@@ -183,7 +185,9 @@ class PdbMSFStream(linear.LinearlyMappedLayer):
             requirements.IntRequirement(name = 'maximum_size')
         ]
 
-    def mapping(self, offset: int, length: int,
+    def mapping(self,
+                offset: int,
+                length: int,
                 ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]:
         returned = 0
         page_size = self._pdb_layer.page_size

volatility/framework/layers/registry.py

@@ -159,7 +159,8 @@ class RegistryHive(linear.LinearlyMappedLayer):
             return node_key
         return node_key[-1]
 
-    def visit_nodes(self, visitor: Callable[[objects.StructType], None],
+    def visit_nodes(self,
+                    visitor: Callable[[objects.StructType], None],
                     node: Optional[objects.StructType] = None) -> None:
         """Applies a callable (visitor) to all nodes within the registry tree
         from a given node."""
@@ -209,7 +210,9 @@ class RegistryHive(linear.LinearlyMappedLayer):
         entry = table.Table[table_index]
         return entry.get_block_offset() + suboffset
 
-    def mapping(self, offset: int, length: int,
+    def mapping(self,
+                offset: int,
+                length: int,
                 ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]:
 
         if length < 0:

volatility/framework/layers/segmented.py

@@ -69,7 +69,9 @@ class NonLinearlySegmentedLayer(interfaces.layers.TranslationLayerInterface, met
                 return self._segments[i]
         raise exceptions.InvalidAddressException(self.name, offset, "Invalid address at {:0x}".format(offset))
 
-    def mapping(self, offset: int, length: int,
+    def mapping(self,
+                offset: int,
+                length: int,
                 ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]:
         """Returns a sorted iterable of (offset, length, mapped_offset, mapped_length, layer)
         mappings."""

volatility/framework/objects/__init__.py

@@ -36,8 +36,8 @@ def convert_data_to_value(data: bytes, struct_type: Type[TUnion[int, float, byte
     return struct.unpack(struct_format, data)[0]
 
 
-def convert_value_to_data(value: TUnion[int, float, bytes, str, bool],
-                          struct_type: Type[TUnion[int, float, bytes, str, bool]],
+def convert_value_to_data(value: TUnion[int, float, bytes, str, bool], struct_type: Type[TUnion[int, float, bytes, str,
+                                                                                                bool]],
                           data_format: DataFormatInfo) -> bytes:
     """Converts a particular value to a series of bytes."""
     if not isinstance(value, struct_type):
@@ -425,8 +425,8 @@ class Enumeration(interfaces.objects.ObjectInterface, int):
         return int.__new__(cls, value)  # type: ignore
 
     def __init__(self, context: interfaces.context.ContextInterface, type_name: str,
-                 object_info: interfaces.objects.ObjectInformation, base_type: Integer,
-                 choices: Dict[str, int]) -> None:
+                 object_info: interfaces.objects.ObjectInformation, base_type: Integer, choices: Dict[str,
+                                                                                                      int]) -> None:
         super().__init__(context, type_name, object_info)
         self._inverse_choices = self._generate_inverse_choices(choices)
         self._vol['choices'] = choices

volatility/framework/objects/utility.py

@@ -7,7 +7,8 @@ from typing import Optional, Union
 from volatility.framework import interfaces, objects, constants
 
 
-def array_to_string(array: 'objects.Array', count: Optional[int] = None,
+def array_to_string(array: 'objects.Array',
+                    count: Optional[int] = None,
                     errors: str = 'replace') -> interfaces.objects.ObjectInterface:
     """Takes a volatility Array of characters and returns a string."""
     # TODO: Consider checking the Array's target is a native char

volatility/framework/plugins/linux/pslist.py

@@ -59,12 +59,12 @@ class PsList(interfaces.plugins.PluginInterface):
             yield (0, (pid, ppid, name))
 
     @classmethod
-    def list_tasks(cls,
-                   context: interfaces.context.ContextInterface,
-                   layer_name: str,
-                   vmlinux_symbols: str,
-                   filter_func: Callable[[int], bool] = lambda _: False
-                   ) -> Iterable[interfaces.objects.ObjectInterface]:
+    def list_tasks(
+            cls,
+            context: interfaces.context.ContextInterface,
+            layer_name: str,
+            vmlinux_symbols: str,
+            filter_func: Callable[[int], bool] = lambda _: False) -> Iterable[interfaces.objects.ObjectInterface]:
         """Lists all the tasks in the primary layer.
 
         Args:

volatility/framework/plugins/mac/check_syscall.py

@@ -32,7 +32,7 @@ class Check_syscall(plugins.PluginInterface):
         mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
 
         kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
-        
+
         mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
 
         handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
@@ -56,9 +56,10 @@ class Check_syscall(plugins.PluginInterface):
 
             module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr)
 
-            yield (0, (format_hints.Hex(table.vol.offset), "SysCall", i, format_hints.Hex(call_addr), module_name, symbol_name))
+            yield (0, (format_hints.Hex(table.vol.offset), "SysCall", i, format_hints.Hex(call_addr), module_name,
+                       symbol_name))
 
     def run(self):
         return renderers.TreeGrid([("Table Address", format_hints.Hex), ("Table Name", str), ("Index", int),
-                                   ("Handler Address", format_hints.Hex), ("Handler Module", str), ("Handler Symbol", str)],
-                                   self._generator())
+                                   ("Handler Address", format_hints.Hex), ("Handler Module", str),
+                                   ("Handler Symbol", str)], self._generator())

volatility/framework/plugins/mac/check_sysctl.py

@@ -118,7 +118,7 @@ class Check_sysctl(plugins.PluginInterface):
 
         mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
 
-        handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) 
+        handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
 
         sysctl_list = kernel.object_from_symbol(symbol_name = "sysctl__children")
 
@@ -128,11 +128,12 @@ class Check_sysctl(plugins.PluginInterface):
             except exceptions.InvalidAddressException:
                 continue
 
-            module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, check_addr) 
+            module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, check_addr)
 
-            yield (0, (name, sysctl.oid_number, sysctl.get_perms(), format_hints.Hex(check_addr), val, module_name, symbol_name))
+            yield (0, (name, sysctl.oid_number, sysctl.get_perms(), format_hints.Hex(check_addr), val, module_name,
+                       symbol_name))
 
     def run(self):
-        return renderers.TreeGrid([("Name", str), ("Number", int), ("Perms", str), ("Handler Address", format_hints.Hex),
-                                   ("Value", str), ("Handler Module", str), ("Handler Symbol", str)],
-                                   self._generator()) 
+        return renderers.TreeGrid([("Name", str), ("Number", int), ("Perms", str),
+                                   ("Handler Address", format_hints.Hex), ("Value", str), ("Handler Module", str),
+                                   ("Handler Symbol", str)], self._generator())

volatility/framework/plugins/mac/check_trap_table.py

@@ -33,7 +33,7 @@ class Check_trap_table(plugins.PluginInterface):
         mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
 
         kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
-        
+
         mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
 
         handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
@@ -51,12 +51,10 @@ class Check_trap_table(plugins.PluginInterface):
 
             module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr)
 
-            yield (0, (format_hints.Hex(table.vol.offset), "TrapTable", i, format_hints.Hex(call_addr), module_name, symbol_name))
+            yield (0, (format_hints.Hex(table.vol.offset), "TrapTable", i, format_hints.Hex(call_addr), module_name,
+                       symbol_name))
 
     def run(self):
         return renderers.TreeGrid([("Table Address", format_hints.Hex), ("Table Name", str), ("Index", int),
-                                   ("Handler Address", format_hints.Hex), ("Handler Module", str), ("Handler Symbol", str)],
-                                   self._generator())
-
-
-
+                                   ("Handler Address", format_hints.Hex), ("Handler Module", str),
+                                   ("Handler Symbol", str)], self._generator())

volatility/framework/plugins/mac/lsof.py

@@ -30,7 +30,8 @@ class lsof(plugins.PluginInterface):
         for task in tasks:
             pid = task.p_pid
 
-            for _, filepath, fd in mac.MacUtilities.files_descriptors_for_process(self.context, self.config['darwin'], task):
+            for _, filepath, fd in mac.MacUtilities.files_descriptors_for_process(self.context, self.config['darwin'],
+                                                                                  task):
                 if filepath and len(filepath) > 0:
                     yield (0, (pid, fd, filepath))
 

volatility/framework/plugins/mac/timers.py

@@ -34,7 +34,7 @@ class Timers(plugins.PluginInterface):
         mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
 
         kernel = contexts.Module(self.context, self.config['darwin'], self.config['primary'], 0)
-        
+
         mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
 
         handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
@@ -43,7 +43,7 @@ class Timers(plugins.PluginInterface):
 
         cpu_data_ptrs_ptr = kernel.get_symbol("cpu_data_ptr").address
 
-        cpu_data_ptrs_addr = kernel.object(object_type = "pointer", 
+        cpu_data_ptrs_addr = kernel.object(object_type = "pointer",
                                            offset = cpu_data_ptrs_ptr,
                                            subtype = kernel.get_type('long unsigned int'))
 
@@ -75,6 +75,6 @@ class Timers(plugins.PluginInterface):
                             timer.deadline, entry_time, module_name, symbol_name))
 
     def run(self):
-        return renderers.TreeGrid([("Function", format_hints.Hex), ("Param 0", format_hints.Hex), ("Param 1", format_hints.Hex),
-                                   ("Deadline", int), ("Entry Time", int), ("Module", str), ("Symbol", str)],
-                                  self._generator()) 
+        return renderers.TreeGrid([("Function", format_hints.Hex), ("Param 0", format_hints.Hex),
+                                   ("Param 1", format_hints.Hex), ("Deadline", int), ("Entry Time", int),
+                                   ("Module", str), ("Symbol", str)], self._generator())

volatility/framework/plugins/mac/trustedbsd.py

@@ -34,7 +34,7 @@ class trustedbsd(plugins.PluginInterface):
         mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
 
         kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
-        
+
         handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)
 
         policy_list = kernel.object_from_symbol(symbol_name = "mac_policy_list").cast("mac_policy_list")
@@ -43,7 +43,7 @@ class trustedbsd(plugins.PluginInterface):
                                 offset = policy_list.entries.dereference().vol.offset,
                                 subtype = kernel.get_type('mac_policy_list_element'),
                                 count = policy_list.staticmax + 1)
-    
+
         for i, ent in enumerate(entries):
             # I don't know how this can happen, but the kernel makes this check all over the place
             # the policy isn't useful without any ops so a rootkit can't abuse this
@@ -69,8 +69,8 @@ class trustedbsd(plugins.PluginInterface):
                 yield (0, (check, ent_name, format_hints.Hex(call_addr), module_name, symbol_name))
 
     def run(self):
-        return renderers.TreeGrid([("Member", str), ("Policy Name", str), ("Handler Address", format_hints.Hex), ("Handler Module", str),
-                                   ("Handler Symbol", str)],
+        return renderers.TreeGrid([("Member", str), ("Policy Name", str), ("Handler Address", format_hints.Hex),
+                                   ("Handler Module", str), ("Handler Symbol", str)],
                                   self._generator(
                                       lsmod.Lsmod.list_modules(self.context, self.config['primary'],
                                                                self.config['darwin'])))

volatility/framework/plugins/windows/info.py

@@ -27,7 +27,9 @@ class Info(plugins.PluginInterface):
         ]
 
     @classmethod
-    def get_depends(cls, context: interfaces.context.ContextInterface, layer_name: str,
+    def get_depends(cls,
+                    context: interfaces.context.ContextInterface,
+                    layer_name: str,
                     index: int = 0) -> Iterable[Tuple[int, interfaces.layers.DataLayerInterface]]:
         """List the dependencies of a given layer.
 

volatility/framework/plugins/windows/malfind.py

@@ -62,9 +62,9 @@ class Malfind(interfaces.plugins.PluginInterface):
         return True
 
     @classmethod
-    def list_injections(cls, context: interfaces.context.ContextInterface, kernel_layer_name: str, symbol_table: str,
-                        proc: interfaces.objects.ObjectInterface
-                        ) -> Iterable[Tuple[interfaces.objects.ObjectInterface, bytes]]:
+    def list_injections(
+            cls, context: interfaces.context.ContextInterface, kernel_layer_name: str, symbol_table: str,
+            proc: interfaces.objects.ObjectInterface) -> Iterable[Tuple[interfaces.objects.ObjectInterface, bytes]]:
         """Generate memory regions for a process that may contain injected
         code.
 

volatility/framework/plugins/windows/poolscanner.py

@@ -111,9 +111,10 @@ class PoolHeaderScanner(interfaces.layers.ScannerInterface):
             yield (constraint, header)
 
 
-def os_distinguisher(version_check: Callable[[Tuple[int, ...]], bool],
-                     fallback_checks: List[Tuple[str, Optional[str], bool]]
-                     ) -> Callable[[interfaces.context.ContextInterface, str], bool]:
+def os_distinguisher(
+    version_check: Callable[[Tuple[int, ...]], bool],
+    fallback_checks: List[Tuple[str, Optional[str],
+                                bool]]) -> Callable[[interfaces.context.ContextInterface, str], bool]:
     """Distinguishes a symbol table as being above a particular version or
     point.
 

volatility/framework/plugins/windows/registry/printkey.py

@@ -41,8 +41,12 @@ class PrintKey(interfaces.plugins.PluginInterface):
         ]
 
     @classmethod
-    def key_iterator(cls, hive: RegistryHive, node_path: Sequence[objects.StructType] = None, recurse: bool = False
-                     ) -> Iterable[Tuple[int, bool, datetime.datetime, str, bool, interfaces.objects.ObjectInterface]]:
+    def key_iterator(
+        cls,
+        hive: RegistryHive,
+        node_path: Sequence[objects.StructType] = None,
+        recurse: bool = False
+    ) -> Iterable[Tuple[int, bool, datetime.datetime, str, bool, interfaces.objects.ObjectInterface]]:
         """Walks through a set of nodes from a given node (last one in
         node_path). Avoids loops by not traversing into nodes already present
         in the node_path.

volatility/framework/plugins/windows/svcscan.py

@@ -32,16 +32,16 @@ class SvcScan(interfaces.plugins.PluginInterface):
                                                  fallback_checks = [("KdCopyDataBlock", None, False),
                                                                     ("_HANDLE_TABLE", "HandleCount", True)])
 
-    is_win10_up_to_15063 = poolscanner.os_distinguisher(version_check=lambda x: (10, 0) <= x < (10, 0, 15063),
-                                                        fallback_checks=[("ObHeaderCookie", None, True),
-                                                                         ("_HANDLE_TABLE", "HandleCount", False),
-                                                                         ("_EPROCESS", "KeepAliveCounter", True)])
+    is_win10_up_to_15063 = poolscanner.os_distinguisher(version_check = lambda x: (10, 0) <= x < (10, 0, 15063),
+                                                        fallback_checks = [("ObHeaderCookie", None, True),
+                                                                           ("_HANDLE_TABLE", "HandleCount", False),
+                                                                           ("_EPROCESS", "KeepAliveCounter", True)])
 
-    is_win10_15063 = poolscanner.os_distinguisher(version_check=lambda x: x == (10, 0, 15063),
-                                                  fallback_checks=[("ObHeaderCookie", None, True),
-                                                                   ("_HANDLE_TABLE", "HandleCount", False),
-                                                                   ("_EPROCESS", "KeepAliveCounter", False),
-                                                                   ("_EPROCESS", "ControlFlowGuardEnabled", True)])
+    is_win10_15063 = poolscanner.os_distinguisher(version_check = lambda x: x == (10, 0, 15063),
+                                                  fallback_checks = [("ObHeaderCookie", None, True),
+                                                                     ("_HANDLE_TABLE", "HandleCount", False),
+                                                                     ("_EPROCESS", "KeepAliveCounter", False),
+                                                                     ("_EPROCESS", "ControlFlowGuardEnabled", True)])
 
     is_win10_16299_or_later = poolscanner.os_distinguisher(version_check = lambda x: x >= (10, 0, 16299),
                                                            fallback_checks = [("ObHeaderCookie", None, True),
@@ -97,9 +97,9 @@ class SvcScan(interfaces.plugins.PluginInterface):
             symbol_filename = "services-win8-x64"
         elif SvcScan.is_win10_up_to_15063(context = context, symbol_table = symbol_table) and not is_64bit:
             symbol_filename = "services-win8-x86"
-        elif SvcScan.is_win10_15063(context=context, symbol_table=symbol_table) and is_64bit:
+        elif SvcScan.is_win10_15063(context = context, symbol_table = symbol_table) and is_64bit:
             symbol_filename = "services-win10-15063-x64"
-        elif SvcScan.is_win10_15063(context=context, symbol_table=symbol_table) and not is_64bit:
+        elif SvcScan.is_win10_15063(context = context, symbol_table = symbol_table) and not is_64bit:
             symbol_filename = "services-win10-15063-x86"
         elif poolscanner.PoolScanner.is_windows_8_or_later(context = context, symbol_table = symbol_table) and is_64bit:
             symbol_filename = "services-win8-x64"

volatility/framework/plugins/windows/verinfo.py

@@ -84,8 +84,8 @@ class VerInfo(interfaces.plugins.PluginInterface):
         return major, minor, product, build
 
     def _generator(self, procs: Generator[interfaces.objects.ObjectInterface, None, None],
-                   mods: Generator[interfaces.objects.ObjectInterface, None, None],
-                   session_layers: Generator[str, None, None]):
+                   mods: Generator[interfaces.objects.ObjectInterface, None, None], session_layers: Generator[str, None,
+                                                                                                              None]):
         """Generates a list of PE file version info for processes, dlls, and
         modules.
 

volatility/framework/symbols/mac/extensions/__init__.py

@@ -101,6 +101,7 @@ class fileglob(objects.StructType):
 
         return ret
 
+
 class vm_map_object(objects.StructType):
 
     def get_map_object(self):
@@ -430,12 +431,13 @@ class queue_entry(objects.StructType):
                     yielded = yielded + 1
                     if yielded == max_size:
                         return
- 
+
                     n = getattr(n.member(attr = member_name), attr).dereference().cast(type_name)
 
             except exceptions.InvalidAddressException:
                 pass
 
+
 class ifnet(objects.StructType):
 
     def sockaddr_dl(self):

volatility/framework/symbols/windows/extensions/registry.py

@@ -145,8 +145,9 @@ class CM_KEY_NODE(objects.StructType):
             subkey_node = hive.get_cell(self.SubKeyLists[index]).u.KeyIndex
             yield from self._get_subkeys_recursive(hive, subkey_node)
 
-    def _get_subkeys_recursive(self, hive: RegistryHive, node: interfaces.objects.ObjectInterface
-                               ) -> Iterable[interfaces.objects.ObjectInterface]:
+    def _get_subkeys_recursive(
+            self, hive: RegistryHive,
+            node: interfaces.objects.ObjectInterface) -> Iterable[interfaces.objects.ObjectInterface]:
         """Recursively descend a node returning subkeys."""
         # The keylist appears to include 4 bytes of key name after each value
         # We can either double the list and only use the even items, or

volatility/framework/symbols/windows/pdbconv.py

@@ -697,9 +697,9 @@ class PdbReader:
         self.user_types = self.replace_forward_references(self.user_types, type_references)
 
     def consume_type(
-            self, module: interfaces.context.ModuleInterface, offset: int, length: int
-    ) -> Tuple[Tuple[Optional[interfaces.objects.ObjectInterface], Optional[str], Union[None, List, interfaces.objects.
-                                                                                        ObjectInterface]], int]:
+        self, module: interfaces.context.ModuleInterface, offset: int, length: int
+    ) -> Tuple[Tuple[Optional[interfaces.objects.ObjectInterface], Optional[str], Union[
+            None, List, interfaces.objects.ObjectInterface]], int]:
         """Returns a (leaf_type, name, object) Tuple for a type, and the number
         of bytes consumed."""
         result = None, None, None  # type: Tuple[Optional[interfaces.objects.ObjectInterface], Optional[str], Optional[Union[List, interfaces.objects.ObjectInterface]]]
@@ -838,7 +838,8 @@ class PdbReader:
     # COMMON CODE
 
     @staticmethod
-    def parse_string(structure: interfaces.objects.ObjectInterface, parse_as_pascal: bool = False,
+    def parse_string(structure: interfaces.objects.ObjectInterface,
+                     parse_as_pascal: bool = False,
                      size: int = 0) -> str:
         """Consumes either a c-string or a pascal string depending on the
         leaf_type."""
@@ -882,7 +883,9 @@ class PdbReader:
 
 class PdbRetreiver:
 
-    def retreive_pdb(self, guid: str, file_name: str,
+    def retreive_pdb(self,
+                     guid: str,
+                     file_name: str,
                      progress_callback: constants.ProgressCallback = None) -> Optional[str]:
         vollog.info("Download PDB file...")
         file_name = ".".join(file_name.split(".")[:-1] + ['pdb'])