From 0c43beb42d3f1d7e3c7ac6ccb97c8f95c438042f Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 5 May 2020 22:14:33 +0100 Subject: [PATCH] Core: Apply yapf across all files again. --- volatility/cli/text_renderer.py | 9 ++-- volatility/framework/automagic/__init__.py | 4 +- volatility/framework/automagic/mac.py | 44 +++++++++---------- volatility/framework/automagic/pdbscan.py | 5 ++- volatility/framework/interfaces/automagic.py | 4 +- .../framework/interfaces/configuration.py | 3 +- volatility/framework/interfaces/layers.py | 12 +++-- volatility/framework/layers/intel.py | 4 +- volatility/framework/layers/linear.py | 4 +- volatility/framework/layers/msf.py | 8 +++- volatility/framework/layers/registry.py | 7 ++- volatility/framework/layers/segmented.py | 4 +- volatility/framework/objects/__init__.py | 8 ++-- volatility/framework/objects/utility.py | 3 +- volatility/framework/plugins/linux/pslist.py | 12 ++--- .../framework/plugins/mac/check_syscall.py | 9 ++-- .../framework/plugins/mac/check_sysctl.py | 13 +++--- .../framework/plugins/mac/check_trap_table.py | 12 +++-- volatility/framework/plugins/mac/lsof.py | 3 +- volatility/framework/plugins/mac/timers.py | 10 ++--- .../framework/plugins/mac/trustedbsd.py | 8 ++-- volatility/framework/plugins/windows/info.py | 4 +- .../framework/plugins/windows/malfind.py | 6 +-- .../framework/plugins/windows/poolscanner.py | 7 +-- .../plugins/windows/registry/printkey.py | 8 +++- .../framework/plugins/windows/svcscan.py | 22 +++++----- .../framework/plugins/windows/verinfo.py | 4 +- .../symbols/mac/extensions/__init__.py | 4 +- .../symbols/windows/extensions/registry.py | 5 ++- .../framework/symbols/windows/pdbconv.py | 13 +++--- 30 files changed, 146 insertions(+), 113 deletions(-) diff --git a/volatility/cli/text_renderer.py b/volatility/cli/text_renderer.py index ab3965f17..e81cbedea 100644 --- a/volatility/cli/text_renderer.py +++ b/volatility/cli/text_renderer.py @@ -246,8 +246,9 @@ class PrettyTextRenderer(CLIRenderer): tree_indent_column = ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(20)) max_column_widths = dict([(column.name, len(column.name)) for column in grid.columns]) - def visitor(node, accumulator: List[Tuple[int, Dict[interfaces.renderers.Column, bytes]]] - ) -> List[Tuple[int, Dict[interfaces.renderers.Column, bytes]]]: + def visitor( + node, accumulator: List[Tuple[int, Dict[interfaces.renderers.Column, bytes]]] + ) -> List[Tuple[int, Dict[interfaces.renderers.Column, bytes]]]: # Nodes always have a path value, giving them a path_depth of at least 1, we use max just in case max_column_widths[tree_indent_column] = max(max_column_widths.get(tree_indent_column, 0), node.path_depth) line = {} @@ -307,8 +308,8 @@ class JsonRenderer(CLIRenderer): final_output = ({}, []) def visitor( - node: Optional[interfaces.renderers.TreeNode], - accumulator: Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]], + node: Optional[interfaces.renderers.TreeNode], + accumulator: Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]], ) -> Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]]: # Nodes always have a path value, giving them a path_depth of at least 1, we use max just in case acc_map, final_tree = accumulator diff --git a/volatility/framework/automagic/__init__.py b/volatility/framework/automagic/__init__.py index f13726d06..59148748e 100644 --- a/volatility/framework/automagic/__init__.py +++ b/volatility/framework/automagic/__init__.py @@ -80,8 +80,8 @@ def choose_automagic(automagics, plugin): def run(automagics: List[interfaces.automagic.AutomagicInterface], context: interfaces.context.ContextInterface, - configurable: Union[interfaces.configuration.ConfigurableInterface, Type[interfaces.configuration. - ConfigurableInterface]], + configurable: Union[interfaces.configuration.ConfigurableInterface, + Type[interfaces.configuration.ConfigurableInterface]], config_path: str, progress_callback: constants.ProgressCallback = None) -> List[traceback.TracebackException]: """Runs through the list of `automagics` in order, allowing them to make diff --git a/volatility/framework/automagic/mac.py b/volatility/framework/automagic/mac.py index 5bc26d4cb..50f76a9ca 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility/framework/automagic/mac.py @@ -119,24 +119,23 @@ class MacUtilities(object): """Class with multiple useful mac functions.""" @classmethod - def mask_mods_list(cls, - context: interfaces.context.ContextInterface, - layer_name: str, - mods: Iterator[Any]) -> Iterator[Any]: - + def mask_mods_list(cls, context: interfaces.context.ContextInterface, layer_name: str, + mods: Iterator[Any]) -> Iterator[Any]: """ A helper function to mask the starting and end address of kernel modules """ mask = context.layers[layer_name].address_mask - return [(objects.utility.array_to_string(mod.name), mod.address & mask, (mod.address & mask) + mod.size) for mod in mods] + return [(objects.utility.array_to_string(mod.name), mod.address & mask, (mod.address & mask) + mod.size) + for mod in mods] @classmethod - def generate_kernel_handler_info(cls, - context: interfaces.context.ContextInterface, - layer_name: str, - kernel, # ikelos - how to type this?? - mods_list: Iterator[Any]): + def generate_kernel_handler_info( + cls, + context: interfaces.context.ContextInterface, + layer_name: str, + kernel, # ikelos - how to type this?? + mods_list: Iterator[Any]): try: start_addr = kernel.object_from_symbol("vm_kernel_stext") @@ -149,17 +148,15 @@ class MacUtilities(object): end_addr = kernel.object_from_symbol("etext") mask = context.layers[layer_name].address_mask - + start_addr = start_addr & mask - end_addr = end_addr & mask + end_addr = end_addr & mask return [("__kernel__", start_addr, end_addr)] + \ MacUtilities.mask_mods_list(context, layer_name, mods_list) @classmethod - def lookup_module_address(cls, - context: interfaces.context.ContextInterface, - handlers: Iterator[Any], + def lookup_module_address(cls, context: interfaces.context.ContextInterface, handlers: Iterator[Any], target_address): mod_name = "UNKNOWN" symbol_name = "N/A" @@ -169,14 +166,14 @@ class MacUtilities(object): mod_name = name if name == "__kernel__": symbols = list(context.symbol_space.get_symbols_by_location(target_address)) - + if len(symbols) > 0: symbol_name = str(symbols[0].split(constants.BANG)[1]) if constants.BANG in symbols[0] else \ str(symbols[0]) break - - return mod_name, symbol_name + + return mod_name, symbol_name @classmethod def aslr_mask_symbol_table(cls, @@ -274,11 +271,8 @@ class MacUtilities(object): return addr - 0xffffff8000000000 @classmethod - def files_descriptors_for_process(cls, - context: interfaces.context.ContextInterface, - symbol_table_name : str, + def files_descriptors_for_process(cls, context: interfaces.context.ContextInterface, symbol_table_name: str, task: interfaces.objects.ObjectInterface): - """Creates a generator for the file descriptors of a process Args: @@ -335,7 +329,9 @@ class MacUtilities(object): yield f, path, fd_num @classmethod - def walk_tailq(cls, queue: interfaces.objects.ObjectInterface, next_member: str, + def walk_tailq(cls, + queue: interfaces.objects.ObjectInterface, + next_member: str, max_elements: int = 4096) -> Iterable[interfaces.objects.ObjectInterface]: seen = set() # type: Set[int] diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index 745a7c74c..22ca5965a 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -228,7 +228,10 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): else: vollog.debug("No suitable kernel pdb signature found") - def download_pdb_isf(self, guid: str, age: int, pdb_name: str, + def download_pdb_isf(self, + guid: str, + age: int, + pdb_name: str, progress_callback: constants.ProgressCallback = None) -> None: """Attempts to download the PDB file, convert it to an ISF file and save it to one of the symbol locations.""" diff --git a/volatility/framework/interfaces/automagic.py b/volatility/framework/interfaces/automagic.py index dacd476c6..194681b95 100644 --- a/volatility/framework/interfaces/automagic.py +++ b/volatility/framework/interfaces/automagic.py @@ -60,8 +60,8 @@ class AutomagicInterface(interfaces.configuration.ConfigurableInterface, metacla context: interfaces.context.ContextInterface, config_path: str, requirement_root: interfaces.configuration.RequirementInterface, - requirement_type: Union[Tuple[Type[interfaces.configuration.RequirementInterface], ...], Type[ - interfaces.configuration.RequirementInterface]], + requirement_type: Union[Tuple[Type[interfaces.configuration.RequirementInterface], ...], + Type[interfaces.configuration.RequirementInterface]], shortcut: bool = True) -> List[Tuple[str, interfaces.configuration.RequirementInterface]]: """Determines if there is actually an unfulfilled `Requirement` waiting. diff --git a/volatility/framework/interfaces/configuration.py b/volatility/framework/interfaces/configuration.py index 4d1c93200..d19800554 100644 --- a/volatility/framework/interfaces/configuration.py +++ b/volatility/framework/interfaces/configuration.py @@ -62,7 +62,8 @@ class HierarchicalDict(collections.abc.Mapping): """The core of configuration data, it is a mapping class that stores keys within itself, and also stores lower hierarchies.""" - def __init__(self, initial_dict: Dict[str, 'SimpleTypeRequirement'] = None, + def __init__(self, + initial_dict: Dict[str, 'SimpleTypeRequirement'] = None, separator: str = CONFIG_SEPARATOR) -> None: """ Args: diff --git a/volatility/framework/interfaces/layers.py b/volatility/framework/interfaces/layers.py index 28392eba7..c3f218f90 100644 --- a/volatility/framework/interfaces/layers.py +++ b/volatility/framework/interfaces/layers.py @@ -302,8 +302,8 @@ class DataLayerInterface(interfaces.configuration.ConfigurableInterface, metacla result[1] = (last_start, self.maximum_address - last_start) return result - def _scan_iterator(self, scanner: 'ScannerInterface', - sections: Iterable[Tuple[int, int]]) -> Iterable[IteratorValue]: + def _scan_iterator(self, scanner: 'ScannerInterface', sections: Iterable[Tuple[int, + int]]) -> Iterable[IteratorValue]: """Iterator that indicates which blocks in the layer are to be read by for the scanning. @@ -377,7 +377,9 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): """ @abstractmethod - def mapping(self, offset: int, length: int, + def mapping(self, + offset: int, + length: int, ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]: """Returns a sorted iterable of (offset, sublength, mapped_offset, mapped_length, layer) mappings. @@ -466,7 +468,9 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): current_offset += len(new_data) - def _scan_iterator(self, scanner: 'ScannerInterface', sections: Iterable[Tuple[int, int]], + def _scan_iterator(self, + scanner: 'ScannerInterface', + sections: Iterable[Tuple[int, int]], linear: bool = False) -> Iterable[IteratorValue]: """Iterator that indicates which blocks in the layer are to be read by for the scanning. diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py index 20192b67e..25d7d4822 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility/framework/layers/intel.py @@ -171,7 +171,9 @@ class Intel(linear.LinearlyMappedLayer): except exceptions.InvalidAddressException: return False - def mapping(self, offset: int, length: int, + def mapping(self, + offset: int, + length: int, ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]: """Returns a sorted iterable of (offset, sublength, mapped_offset, mapped_length, layer) mappings. diff --git a/volatility/framework/layers/linear.py b/volatility/framework/layers/linear.py index 2ee0c75f2..5c63105f3 100644 --- a/volatility/framework/layers/linear.py +++ b/volatility/framework/layers/linear.py @@ -65,6 +65,8 @@ class LinearlyMappedLayer(interfaces.layers.TranslationLayerInterface): value = value[length:] current_offset += length - def _scan_iterator(self, scanner: 'ScannerInterface', sections: Iterable[Tuple[int, int]], + def _scan_iterator(self, + scanner: 'ScannerInterface', + sections: Iterable[Tuple[int, int]], linear: bool = True) -> Iterable[IteratorValue]: return super()._scan_iterator(scanner, sections, linear) diff --git a/volatility/framework/layers/msf.py b/volatility/framework/layers/msf.py index 783cda598..c030b5354 100644 --- a/volatility/framework/layers/msf.py +++ b/volatility/framework/layers/msf.py @@ -136,7 +136,9 @@ class PdbMultiStreamFormat(linear.LinearlyMappedLayer): def is_valid(self, offset: int, length: int = 1) -> bool: return self.context.layers[self._base_layer].is_valid(offset, length) - def mapping(self, offset: int, length: int, + def mapping(self, + offset: int, + length: int, ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]: yield offset, length, offset, length, self._base_layer @@ -183,7 +185,9 @@ class PdbMSFStream(linear.LinearlyMappedLayer): requirements.IntRequirement(name = 'maximum_size') ] - def mapping(self, offset: int, length: int, + def mapping(self, + offset: int, + length: int, ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]: returned = 0 page_size = self._pdb_layer.page_size diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index 89ff601a6..379053ad9 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -159,7 +159,8 @@ class RegistryHive(linear.LinearlyMappedLayer): return node_key return node_key[-1] - def visit_nodes(self, visitor: Callable[[objects.StructType], None], + def visit_nodes(self, + visitor: Callable[[objects.StructType], None], node: Optional[objects.StructType] = None) -> None: """Applies a callable (visitor) to all nodes within the registry tree from a given node.""" @@ -209,7 +210,9 @@ class RegistryHive(linear.LinearlyMappedLayer): entry = table.Table[table_index] return entry.get_block_offset() + suboffset - def mapping(self, offset: int, length: int, + def mapping(self, + offset: int, + length: int, ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]: if length < 0: diff --git a/volatility/framework/layers/segmented.py b/volatility/framework/layers/segmented.py index 01fbc3bc9..d2f80ec32 100644 --- a/volatility/framework/layers/segmented.py +++ b/volatility/framework/layers/segmented.py @@ -69,7 +69,9 @@ class NonLinearlySegmentedLayer(interfaces.layers.TranslationLayerInterface, met return self._segments[i] raise exceptions.InvalidAddressException(self.name, offset, "Invalid address at {:0x}".format(offset)) - def mapping(self, offset: int, length: int, + def mapping(self, + offset: int, + length: int, ignore_errors: bool = False) -> Iterable[Tuple[int, int, int, int, str]]: """Returns a sorted iterable of (offset, length, mapped_offset, mapped_length, layer) mappings.""" diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index cc25668ad..5d4c70886 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -36,8 +36,8 @@ def convert_data_to_value(data: bytes, struct_type: Type[TUnion[int, float, byte return struct.unpack(struct_format, data)[0] -def convert_value_to_data(value: TUnion[int, float, bytes, str, bool], - struct_type: Type[TUnion[int, float, bytes, str, bool]], +def convert_value_to_data(value: TUnion[int, float, bytes, str, bool], struct_type: Type[TUnion[int, float, bytes, str, + bool]], data_format: DataFormatInfo) -> bytes: """Converts a particular value to a series of bytes.""" if not isinstance(value, struct_type): @@ -425,8 +425,8 @@ class Enumeration(interfaces.objects.ObjectInterface, int): return int.__new__(cls, value) # type: ignore def __init__(self, context: interfaces.context.ContextInterface, type_name: str, - object_info: interfaces.objects.ObjectInformation, base_type: Integer, - choices: Dict[str, int]) -> None: + object_info: interfaces.objects.ObjectInformation, base_type: Integer, choices: Dict[str, + int]) -> None: super().__init__(context, type_name, object_info) self._inverse_choices = self._generate_inverse_choices(choices) self._vol['choices'] = choices diff --git a/volatility/framework/objects/utility.py b/volatility/framework/objects/utility.py index bcb6edbb6..e3795aa78 100644 --- a/volatility/framework/objects/utility.py +++ b/volatility/framework/objects/utility.py @@ -7,7 +7,8 @@ from typing import Optional, Union from volatility.framework import interfaces, objects, constants -def array_to_string(array: 'objects.Array', count: Optional[int] = None, +def array_to_string(array: 'objects.Array', + count: Optional[int] = None, errors: str = 'replace') -> interfaces.objects.ObjectInterface: """Takes a volatility Array of characters and returns a string.""" # TODO: Consider checking the Array's target is a native char diff --git a/volatility/framework/plugins/linux/pslist.py b/volatility/framework/plugins/linux/pslist.py index 9040bb934..dd486f166 100644 --- a/volatility/framework/plugins/linux/pslist.py +++ b/volatility/framework/plugins/linux/pslist.py @@ -59,12 +59,12 @@ class PsList(interfaces.plugins.PluginInterface): yield (0, (pid, ppid, name)) @classmethod - def list_tasks(cls, - context: interfaces.context.ContextInterface, - layer_name: str, - vmlinux_symbols: str, - filter_func: Callable[[int], bool] = lambda _: False - ) -> Iterable[interfaces.objects.ObjectInterface]: + def list_tasks( + cls, + context: interfaces.context.ContextInterface, + layer_name: str, + vmlinux_symbols: str, + filter_func: Callable[[int], bool] = lambda _: False) -> Iterable[interfaces.objects.ObjectInterface]: """Lists all the tasks in the primary layer. Args: diff --git a/volatility/framework/plugins/mac/check_syscall.py b/volatility/framework/plugins/mac/check_syscall.py index f51f3d956..091e8cd20 100644 --- a/volatility/framework/plugins/mac/check_syscall.py +++ b/volatility/framework/plugins/mac/check_syscall.py @@ -32,7 +32,7 @@ class Check_syscall(plugins.PluginInterface): mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary']) kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) - + mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) @@ -56,9 +56,10 @@ class Check_syscall(plugins.PluginInterface): module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr) - yield (0, (format_hints.Hex(table.vol.offset), "SysCall", i, format_hints.Hex(call_addr), module_name, symbol_name)) + yield (0, (format_hints.Hex(table.vol.offset), "SysCall", i, format_hints.Hex(call_addr), module_name, + symbol_name)) def run(self): return renderers.TreeGrid([("Table Address", format_hints.Hex), ("Table Name", str), ("Index", int), - ("Handler Address", format_hints.Hex), ("Handler Module", str), ("Handler Symbol", str)], - self._generator()) + ("Handler Address", format_hints.Hex), ("Handler Module", str), + ("Handler Symbol", str)], self._generator()) diff --git a/volatility/framework/plugins/mac/check_sysctl.py b/volatility/framework/plugins/mac/check_sysctl.py index 00df15a07..3f7ec1e2b 100644 --- a/volatility/framework/plugins/mac/check_sysctl.py +++ b/volatility/framework/plugins/mac/check_sysctl.py @@ -118,7 +118,7 @@ class Check_sysctl(plugins.PluginInterface): mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) - handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) + handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) sysctl_list = kernel.object_from_symbol(symbol_name = "sysctl__children") @@ -128,11 +128,12 @@ class Check_sysctl(plugins.PluginInterface): except exceptions.InvalidAddressException: continue - module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, check_addr) + module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, check_addr) - yield (0, (name, sysctl.oid_number, sysctl.get_perms(), format_hints.Hex(check_addr), val, module_name, symbol_name)) + yield (0, (name, sysctl.oid_number, sysctl.get_perms(), format_hints.Hex(check_addr), val, module_name, + symbol_name)) def run(self): - return renderers.TreeGrid([("Name", str), ("Number", int), ("Perms", str), ("Handler Address", format_hints.Hex), - ("Value", str), ("Handler Module", str), ("Handler Symbol", str)], - self._generator()) + return renderers.TreeGrid([("Name", str), ("Number", int), ("Perms", str), + ("Handler Address", format_hints.Hex), ("Value", str), ("Handler Module", str), + ("Handler Symbol", str)], self._generator()) diff --git a/volatility/framework/plugins/mac/check_trap_table.py b/volatility/framework/plugins/mac/check_trap_table.py index f6d2528f8..2ea026716 100644 --- a/volatility/framework/plugins/mac/check_trap_table.py +++ b/volatility/framework/plugins/mac/check_trap_table.py @@ -33,7 +33,7 @@ class Check_trap_table(plugins.PluginInterface): mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary']) kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) - + mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) @@ -51,12 +51,10 @@ class Check_trap_table(plugins.PluginInterface): module_name, symbol_name = mac.MacUtilities.lookup_module_address(self.context, handlers, call_addr) - yield (0, (format_hints.Hex(table.vol.offset), "TrapTable", i, format_hints.Hex(call_addr), module_name, symbol_name)) + yield (0, (format_hints.Hex(table.vol.offset), "TrapTable", i, format_hints.Hex(call_addr), module_name, + symbol_name)) def run(self): return renderers.TreeGrid([("Table Address", format_hints.Hex), ("Table Name", str), ("Index", int), - ("Handler Address", format_hints.Hex), ("Handler Module", str), ("Handler Symbol", str)], - self._generator()) - - - + ("Handler Address", format_hints.Hex), ("Handler Module", str), + ("Handler Symbol", str)], self._generator()) diff --git a/volatility/framework/plugins/mac/lsof.py b/volatility/framework/plugins/mac/lsof.py index df5659167..0c3456ed7 100644 --- a/volatility/framework/plugins/mac/lsof.py +++ b/volatility/framework/plugins/mac/lsof.py @@ -30,7 +30,8 @@ class lsof(plugins.PluginInterface): for task in tasks: pid = task.p_pid - for _, filepath, fd in mac.MacUtilities.files_descriptors_for_process(self.context, self.config['darwin'], task): + for _, filepath, fd in mac.MacUtilities.files_descriptors_for_process(self.context, self.config['darwin'], + task): if filepath and len(filepath) > 0: yield (0, (pid, fd, filepath)) diff --git a/volatility/framework/plugins/mac/timers.py b/volatility/framework/plugins/mac/timers.py index 8982ebef4..7705fd607 100644 --- a/volatility/framework/plugins/mac/timers.py +++ b/volatility/framework/plugins/mac/timers.py @@ -34,7 +34,7 @@ class Timers(plugins.PluginInterface): mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary']) kernel = contexts.Module(self.context, self.config['darwin'], self.config['primary'], 0) - + mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) @@ -43,7 +43,7 @@ class Timers(plugins.PluginInterface): cpu_data_ptrs_ptr = kernel.get_symbol("cpu_data_ptr").address - cpu_data_ptrs_addr = kernel.object(object_type = "pointer", + cpu_data_ptrs_addr = kernel.object(object_type = "pointer", offset = cpu_data_ptrs_ptr, subtype = kernel.get_type('long unsigned int')) @@ -75,6 +75,6 @@ class Timers(plugins.PluginInterface): timer.deadline, entry_time, module_name, symbol_name)) def run(self): - return renderers.TreeGrid([("Function", format_hints.Hex), ("Param 0", format_hints.Hex), ("Param 1", format_hints.Hex), - ("Deadline", int), ("Entry Time", int), ("Module", str), ("Symbol", str)], - self._generator()) + return renderers.TreeGrid([("Function", format_hints.Hex), ("Param 0", format_hints.Hex), + ("Param 1", format_hints.Hex), ("Deadline", int), ("Entry Time", int), + ("Module", str), ("Symbol", str)], self._generator()) diff --git a/volatility/framework/plugins/mac/trustedbsd.py b/volatility/framework/plugins/mac/trustedbsd.py index 0642f1766..aa6337943 100644 --- a/volatility/framework/plugins/mac/trustedbsd.py +++ b/volatility/framework/plugins/mac/trustedbsd.py @@ -34,7 +34,7 @@ class trustedbsd(plugins.PluginInterface): mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary']) kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) - + handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) policy_list = kernel.object_from_symbol(symbol_name = "mac_policy_list").cast("mac_policy_list") @@ -43,7 +43,7 @@ class trustedbsd(plugins.PluginInterface): offset = policy_list.entries.dereference().vol.offset, subtype = kernel.get_type('mac_policy_list_element'), count = policy_list.staticmax + 1) - + for i, ent in enumerate(entries): # I don't know how this can happen, but the kernel makes this check all over the place # the policy isn't useful without any ops so a rootkit can't abuse this @@ -69,8 +69,8 @@ class trustedbsd(plugins.PluginInterface): yield (0, (check, ent_name, format_hints.Hex(call_addr), module_name, symbol_name)) def run(self): - return renderers.TreeGrid([("Member", str), ("Policy Name", str), ("Handler Address", format_hints.Hex), ("Handler Module", str), - ("Handler Symbol", str)], + return renderers.TreeGrid([("Member", str), ("Policy Name", str), ("Handler Address", format_hints.Hex), + ("Handler Module", str), ("Handler Symbol", str)], self._generator( lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']))) diff --git a/volatility/framework/plugins/windows/info.py b/volatility/framework/plugins/windows/info.py index 8cd59a485..0be9273db 100644 --- a/volatility/framework/plugins/windows/info.py +++ b/volatility/framework/plugins/windows/info.py @@ -27,7 +27,9 @@ class Info(plugins.PluginInterface): ] @classmethod - def get_depends(cls, context: interfaces.context.ContextInterface, layer_name: str, + def get_depends(cls, + context: interfaces.context.ContextInterface, + layer_name: str, index: int = 0) -> Iterable[Tuple[int, interfaces.layers.DataLayerInterface]]: """List the dependencies of a given layer. diff --git a/volatility/framework/plugins/windows/malfind.py b/volatility/framework/plugins/windows/malfind.py index b3fcd44ee..423cc6f66 100644 --- a/volatility/framework/plugins/windows/malfind.py +++ b/volatility/framework/plugins/windows/malfind.py @@ -62,9 +62,9 @@ class Malfind(interfaces.plugins.PluginInterface): return True @classmethod - def list_injections(cls, context: interfaces.context.ContextInterface, kernel_layer_name: str, symbol_table: str, - proc: interfaces.objects.ObjectInterface - ) -> Iterable[Tuple[interfaces.objects.ObjectInterface, bytes]]: + def list_injections( + cls, context: interfaces.context.ContextInterface, kernel_layer_name: str, symbol_table: str, + proc: interfaces.objects.ObjectInterface) -> Iterable[Tuple[interfaces.objects.ObjectInterface, bytes]]: """Generate memory regions for a process that may contain injected code. diff --git a/volatility/framework/plugins/windows/poolscanner.py b/volatility/framework/plugins/windows/poolscanner.py index 317dd0d83..3e6a97bf6 100644 --- a/volatility/framework/plugins/windows/poolscanner.py +++ b/volatility/framework/plugins/windows/poolscanner.py @@ -111,9 +111,10 @@ class PoolHeaderScanner(interfaces.layers.ScannerInterface): yield (constraint, header) -def os_distinguisher(version_check: Callable[[Tuple[int, ...]], bool], - fallback_checks: List[Tuple[str, Optional[str], bool]] - ) -> Callable[[interfaces.context.ContextInterface, str], bool]: +def os_distinguisher( + version_check: Callable[[Tuple[int, ...]], bool], + fallback_checks: List[Tuple[str, Optional[str], + bool]]) -> Callable[[interfaces.context.ContextInterface, str], bool]: """Distinguishes a symbol table as being above a particular version or point. diff --git a/volatility/framework/plugins/windows/registry/printkey.py b/volatility/framework/plugins/windows/registry/printkey.py index eb420f4e1..4f17ad361 100644 --- a/volatility/framework/plugins/windows/registry/printkey.py +++ b/volatility/framework/plugins/windows/registry/printkey.py @@ -41,8 +41,12 @@ class PrintKey(interfaces.plugins.PluginInterface): ] @classmethod - def key_iterator(cls, hive: RegistryHive, node_path: Sequence[objects.StructType] = None, recurse: bool = False - ) -> Iterable[Tuple[int, bool, datetime.datetime, str, bool, interfaces.objects.ObjectInterface]]: + def key_iterator( + cls, + hive: RegistryHive, + node_path: Sequence[objects.StructType] = None, + recurse: bool = False + ) -> Iterable[Tuple[int, bool, datetime.datetime, str, bool, interfaces.objects.ObjectInterface]]: """Walks through a set of nodes from a given node (last one in node_path). Avoids loops by not traversing into nodes already present in the node_path. diff --git a/volatility/framework/plugins/windows/svcscan.py b/volatility/framework/plugins/windows/svcscan.py index a719edad2..5dc05f2b2 100644 --- a/volatility/framework/plugins/windows/svcscan.py +++ b/volatility/framework/plugins/windows/svcscan.py @@ -32,16 +32,16 @@ class SvcScan(interfaces.plugins.PluginInterface): fallback_checks = [("KdCopyDataBlock", None, False), ("_HANDLE_TABLE", "HandleCount", True)]) - is_win10_up_to_15063 = poolscanner.os_distinguisher(version_check=lambda x: (10, 0) <= x < (10, 0, 15063), - fallback_checks=[("ObHeaderCookie", None, True), - ("_HANDLE_TABLE", "HandleCount", False), - ("_EPROCESS", "KeepAliveCounter", True)]) + is_win10_up_to_15063 = poolscanner.os_distinguisher(version_check = lambda x: (10, 0) <= x < (10, 0, 15063), + fallback_checks = [("ObHeaderCookie", None, True), + ("_HANDLE_TABLE", "HandleCount", False), + ("_EPROCESS", "KeepAliveCounter", True)]) - is_win10_15063 = poolscanner.os_distinguisher(version_check=lambda x: x == (10, 0, 15063), - fallback_checks=[("ObHeaderCookie", None, True), - ("_HANDLE_TABLE", "HandleCount", False), - ("_EPROCESS", "KeepAliveCounter", False), - ("_EPROCESS", "ControlFlowGuardEnabled", True)]) + is_win10_15063 = poolscanner.os_distinguisher(version_check = lambda x: x == (10, 0, 15063), + fallback_checks = [("ObHeaderCookie", None, True), + ("_HANDLE_TABLE", "HandleCount", False), + ("_EPROCESS", "KeepAliveCounter", False), + ("_EPROCESS", "ControlFlowGuardEnabled", True)]) is_win10_16299_or_later = poolscanner.os_distinguisher(version_check = lambda x: x >= (10, 0, 16299), fallback_checks = [("ObHeaderCookie", None, True), @@ -97,9 +97,9 @@ class SvcScan(interfaces.plugins.PluginInterface): symbol_filename = "services-win8-x64" elif SvcScan.is_win10_up_to_15063(context = context, symbol_table = symbol_table) and not is_64bit: symbol_filename = "services-win8-x86" - elif SvcScan.is_win10_15063(context=context, symbol_table=symbol_table) and is_64bit: + elif SvcScan.is_win10_15063(context = context, symbol_table = symbol_table) and is_64bit: symbol_filename = "services-win10-15063-x64" - elif SvcScan.is_win10_15063(context=context, symbol_table=symbol_table) and not is_64bit: + elif SvcScan.is_win10_15063(context = context, symbol_table = symbol_table) and not is_64bit: symbol_filename = "services-win10-15063-x86" elif poolscanner.PoolScanner.is_windows_8_or_later(context = context, symbol_table = symbol_table) and is_64bit: symbol_filename = "services-win8-x64" diff --git a/volatility/framework/plugins/windows/verinfo.py b/volatility/framework/plugins/windows/verinfo.py index b7f497aed..12c6d6164 100644 --- a/volatility/framework/plugins/windows/verinfo.py +++ b/volatility/framework/plugins/windows/verinfo.py @@ -84,8 +84,8 @@ class VerInfo(interfaces.plugins.PluginInterface): return major, minor, product, build def _generator(self, procs: Generator[interfaces.objects.ObjectInterface, None, None], - mods: Generator[interfaces.objects.ObjectInterface, None, None], - session_layers: Generator[str, None, None]): + mods: Generator[interfaces.objects.ObjectInterface, None, None], session_layers: Generator[str, None, + None]): """Generates a list of PE file version info for processes, dlls, and modules. diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility/framework/symbols/mac/extensions/__init__.py index a4ee78f62..0235fba31 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility/framework/symbols/mac/extensions/__init__.py @@ -101,6 +101,7 @@ class fileglob(objects.StructType): return ret + class vm_map_object(objects.StructType): def get_map_object(self): @@ -430,12 +431,13 @@ class queue_entry(objects.StructType): yielded = yielded + 1 if yielded == max_size: return - + n = getattr(n.member(attr = member_name), attr).dereference().cast(type_name) except exceptions.InvalidAddressException: pass + class ifnet(objects.StructType): def sockaddr_dl(self): diff --git a/volatility/framework/symbols/windows/extensions/registry.py b/volatility/framework/symbols/windows/extensions/registry.py index 4932490fe..0ce440ac8 100644 --- a/volatility/framework/symbols/windows/extensions/registry.py +++ b/volatility/framework/symbols/windows/extensions/registry.py @@ -145,8 +145,9 @@ class CM_KEY_NODE(objects.StructType): subkey_node = hive.get_cell(self.SubKeyLists[index]).u.KeyIndex yield from self._get_subkeys_recursive(hive, subkey_node) - def _get_subkeys_recursive(self, hive: RegistryHive, node: interfaces.objects.ObjectInterface - ) -> Iterable[interfaces.objects.ObjectInterface]: + def _get_subkeys_recursive( + self, hive: RegistryHive, + node: interfaces.objects.ObjectInterface) -> Iterable[interfaces.objects.ObjectInterface]: """Recursively descend a node returning subkeys.""" # The keylist appears to include 4 bytes of key name after each value # We can either double the list and only use the even items, or diff --git a/volatility/framework/symbols/windows/pdbconv.py b/volatility/framework/symbols/windows/pdbconv.py index d48e49747..b56eb5fb3 100644 --- a/volatility/framework/symbols/windows/pdbconv.py +++ b/volatility/framework/symbols/windows/pdbconv.py @@ -697,9 +697,9 @@ class PdbReader: self.user_types = self.replace_forward_references(self.user_types, type_references) def consume_type( - self, module: interfaces.context.ModuleInterface, offset: int, length: int - ) -> Tuple[Tuple[Optional[interfaces.objects.ObjectInterface], Optional[str], Union[None, List, interfaces.objects. - ObjectInterface]], int]: + self, module: interfaces.context.ModuleInterface, offset: int, length: int + ) -> Tuple[Tuple[Optional[interfaces.objects.ObjectInterface], Optional[str], Union[ + None, List, interfaces.objects.ObjectInterface]], int]: """Returns a (leaf_type, name, object) Tuple for a type, and the number of bytes consumed.""" result = None, None, None # type: Tuple[Optional[interfaces.objects.ObjectInterface], Optional[str], Optional[Union[List, interfaces.objects.ObjectInterface]]] @@ -838,7 +838,8 @@ class PdbReader: # COMMON CODE @staticmethod - def parse_string(structure: interfaces.objects.ObjectInterface, parse_as_pascal: bool = False, + def parse_string(structure: interfaces.objects.ObjectInterface, + parse_as_pascal: bool = False, size: int = 0) -> str: """Consumes either a c-string or a pascal string depending on the leaf_type.""" @@ -882,7 +883,9 @@ class PdbReader: class PdbRetreiver: - def retreive_pdb(self, guid: str, file_name: str, + def retreive_pdb(self, + guid: str, + file_name: str, progress_callback: constants.ProgressCallback = None) -> Optional[str]: vollog.info("Download PDB file...") file_name = ".".join(file_name.split(".")[:-1] + ['pdb'])