WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-11 04:07:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #445 from volatilityfoundation/release/v1.0.0

Browse Source 
Release/v1.0.0
This commit is contained in:
ikelos
2021-02-01 15:30:16 +00:00
committed by GitHub
parent 93c6a62972 2797ac58bc
commit 0e372b3ba2
259 changed files with 1124 additions and 1068 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-pypi.yml
+42
View File
@@ -0,0 +1,42 @@
name: build-pypi
on:
push:
branches:
- stable
- develop
- 'release/**'
pull_request:
branches:
- stable
- 'release/**'
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- name: Set up Python 3.x
uses: actions/setup-python@v2
with:
python-version: '3.x'
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install setuptools wheel
- name: Build PyPi packages
run: |
python setup.py sdist --formats=gztar,zip
python setup.py bdist_wheel
- name: Archive dist
uses: actions/upload-artifact@v2
with:
name: volatility3-pypi
path: |
dist/
.gitignore
+5 -5
View File
@@ -4,7 +4,7 @@ __pycache__
# Sphinx generated files
doc/build
doc/source/volatility.*
doc/source/volatility3.*
# Pycharm/PyDev development files
workspace.xml
@@ -14,14 +14,14 @@ workspace.xml
# Manually generated files
.mypy_cache
stubs
volatility/symbols/linux*
volatility/symbols/windows*
volatility/symbols/mac*
volatility3/symbols/linux*
volatility3/symbols/windows*
volatility3/symbols/mac*
# Mac metadata files
.DS_Store
# Volatility's config
# Volatility's config
config*.json
# Pyinstaller files
MANIFEST.in
+2 -2
View File
@@ -2,5 +2,5 @@ prune development
include * .*
include doc/make.bat doc/Makefile
recursive-include doc/source *
recursive-include volatility *.json
recursive-exclude doc/source volatility*.rst
recursive-include volatility3 *.json
recursive-exclude doc/source volatility3.*.rst
README.md
+1 -1
View File
@@ -77,7 +77,7 @@ The hashes to verify whether any of the symbol pack files have downloaded succes
<https://downloads.volatilityfoundation.org/volatility3/symbols/SHA1SUMS>
<https://downloads.volatilityfoundation.org/volatility3/symbols/MD5SUMS>
Symbol tables zip files must be placed, as named, into the `volatility/symbols` directory (or just the symbols directory next to the executable file).
Symbol tables zip files must be placed, as named, into the `volatility3/symbols` directory (or just the symbols directory next to the executable file).
Windows symbols that cannot be found will be queried, downloaded, generated and cached. Mac and Linux symbol tables must be manually produced by a tool such as [dwarf2json](https://github.com/volatilityfoundation/dwarf2json).
development/schema_validate.py
+1 -1
View File
@@ -17,7 +17,7 @@ logger = logging.getLogger("")
logger.addHandler(console)
logger.setLevel(logging.DEBUG)
from volatility import schemas
from volatility3 import schemas
if __name__ == '__main__':
parser = argparse.ArgumentParser("Validates ")
doc/Makefile
+1 -1
View File
@@ -15,7 +15,7 @@ help:
# Ensure we clean the autodoc files when we clean
clean:
-rm source/volatility.*.rst
-rm source/volatility3.*.rst
@$(SPHINXBUILD) -M clean "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
# Catch-all target: route all unknown targets to Sphinx using the new
doc/source/basics.rst
+28 -28
View File
@@ -7,7 +7,7 @@ Volatility splits memory analysis down to several components:
* Templates and Objects
* Symbol Tables
Volatility 3 stores all of these within a :py:class:`Context <volatility.framework.interfaces.context.ContextInterface>`,
Volatility 3 stores all of these within a :py:class:`Context <volatility3.framework.interfaces.context.ContextInterface>`,
which acts as a container for all the various layers and tables necessary to conduct memory analysis.
Memory layers
@@ -21,8 +21,8 @@ two other sources. These are typically handled by programs that process file fo
processor, but these are all translations (either in the geometric or linguistic sense) of the original data.
In Volatility 3 this is represented by a directed graph, whose end nodes are
:py:class:`DataLayers <volatility.framework.interfaces.layers.DataLayerInterface>` and whose internal nodes are
specifically called a :py:class:`TranslationLayer <volatility.framework.interfaces.layers.TranslationLayerInterface>`.
:py:class:`DataLayers <volatility3.framework.interfaces.layers.DataLayerInterface>` and whose internal nodes are
specifically called a :py:class:`TranslationLayer <volatility3.framework.interfaces.layers.TranslationLayerInterface>`.
In this way, a raw memory image in the LiME file format and a page file can be
combined to form a single Intel virtual memory layer. When requesting addresses from the Intel layer, it will use the
Intel memory mapping algorithm, along with the address of the directory table base or page table map, to translate that
@@ -39,17 +39,17 @@ Templates and Objects
Once we can address contiguous chunks of memory with a means to translate a virtual address (as seen by the programs)
into the actual data used by the processor, we can start pulling out
:py:class:`Objects <volatility.framework.interfaces.objects.ObjectInterface>` by taking a
:py:class:`~volatility.framework.interfaces.objects.Template` and constructing
it on the memory layer at a specific offset. A :py:class:`~volatility.framework.interfaces.objects.Template` contains
:py:class:`Objects <volatility3.framework.interfaces.objects.ObjectInterface>` by taking a
:py:class:`~volatility3.framework.interfaces.objects.Template` and constructing
it on the memory layer at a specific offset. A :py:class:`~volatility3.framework.interfaces.objects.Template` contains
all the information you can know about the structure of the object without actually being populated by any data.
As such a :py:class:`~volatility.framework.interfaces.objects.Template` can tell you the size of a structure and its
As such a :py:class:`~volatility3.framework.interfaces.objects.Template` can tell you the size of a structure and its
members, how far into the structure a particular member lives and potentially what various values in that field would
mean, but not what resides in a particular member.
Using a :py:class:`~volatility.framework.interfaces.objects.Template` on a memory layer at a particular offset, an
:py:class:`Object <volatility.framework.interfaces.objects.ObjectInterface>` can be constructed. In Volatility 3, once an
:py:class:`Object <volatility.framework.interfaces.objects.ObjectInterface>` has been created, the data has been read from the
Using a :py:class:`~volatility3.framework.interfaces.objects.Template` on a memory layer at a particular offset, an
:py:class:`Object <volatility3.framework.interfaces.objects.ObjectInterface>` can be constructed. In Volatility 3, once an
:py:class:`Object <volatility3.framework.interfaces.objects.ObjectInterface>` has been created, the data has been read from the
layer and is not read again. An object allows its members to be interrogated and in particular allows pointers to be
followed, providing easy access to the data contained in the object.
@@ -62,23 +62,23 @@ Symbol Tables
-------------
Most compiled programs know of their own templates, and define the structure (and location within the program) of these
templates as a :py:class:`Symbol <volatility.framework.interfaces.symbols.SymbolInterface>`. A
:py:class:`Symbol <volatility.framework.interfaces.symbols.SymbolInterface>` is often an address and a template and can
templates as a :py:class:`Symbol <volatility3.framework.interfaces.symbols.SymbolInterface>`. A
:py:class:`Symbol <volatility3.framework.interfaces.symbols.SymbolInterface>` is often an address and a template and can
be used to refer to either independently. Lookup tables of these symbols are often produced as debugging information
alongside the compilation of the program. Volatility 3 provides access to these through a
:py:class:`SymbolTable <volatility.framework.interfaces.symbols.SymbolTableInterface>`, many of which can be collected
within a :py:class:`~volatility.framework.contexts.Context` as a :py:class:`SymbolSpace <volatility.framework.interfaces.symbols.SymbolSpaceInterface>`.
A :py:class:`~volatility.framework.contexts.Context` can store only one :py:class:`~volatility.framework.symbols.SymbolSpace`
at a time, although a :py:class:`~volatility.framework.symbols.SymbolSpace` can store as
many :py:class:`~volatility.framework.symbols.SymbolTable` items as necessary.
:py:class:`SymbolTable <volatility3.framework.interfaces.symbols.SymbolTableInterface>`, many of which can be collected
within a :py:class:`~volatility3.framework.contexts.Context` as a :py:class:`SymbolSpace <volatility.framework.interfaces.symbols.SymbolSpaceInterface>`.
A :py:class:`~volatility3.framework.contexts.Context` can store only one :py:class:`~volatility.framework.symbols.SymbolSpace`
at a time, although a :py:class:`~volatility3.framework.symbols.SymbolSpace` can store as
many :py:class:`~volatility3.framework.symbols.SymbolTable` items as necessary.
Volatility 3 uses the de facto naming convention for symbols of `module!symbol` to refer to them. It reads them from its
own JSON formatted file, which acts as a common intermediary between Windows PDB files, Linux DWARF files, other symbol
formats and the internal Python format that Volatility 3 uses to represent
a :py:class:`~volatility.framework.interfaces.objects.Template` or
a :py:class:`Symbol <volatility.framework.interfaces.symbols.SymbolInterface>`.
a :py:class:`~volatility3.framework.interfaces.objects.Template` or
a :py:class:`Symbol <volatility3.framework.interfaces.symbols.SymbolInterface>`.
.. note:: Volatility 2's name for a :py:class:`~volatility.framework.symbols.SymbolSpace` was a profile, but it could
.. note:: Volatility 2's name for a :py:class:`~volatility3.framework.symbols.SymbolSpace` was a profile, but it could
not differentiate between symbols from different modules and required special handling for 32-bit programs that
used Wow64 on Windows. This meant that all symbols lived in a single namespace with the possibility of symbol name
collisions. It read the symbols using a format called *vtypes*, written in Python code directly.
@@ -88,18 +88,18 @@ Plugins
-------
A plugin acts as a means of requesting data from the user interface (and so the user) and then using it to carry out a
specific form of analysis on the :py:class:`Context <volatility.framework.interfaces.context.ContextInterface>`
specific form of analysis on the :py:class:`Context <volatility3.framework.interfaces.context.ContextInterface>`
(containing whatever symbol tables and memory layers it may). The means of communication between the user interface and
the library is the configuration tree, which is used by components within the :py:class:`~volatility.framework.contexts.Context`
the library is the configuration tree, which is used by components within the :py:class:`~volatility3.framework.contexts.Context`
to store configurable data. After the plugin has been run, it then returns the results in a specific format known as a
:py:class:`~volatility.framework.interfaces.renderers.TreeGrid`. This ensures that the data can be handled by consumers of
:py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`. This ensures that the data can be handled by consumers of
the library, without knowing exactly what the data is or how it's formatted.
Output Renderers
----------------
User interfaces can choose how best to present the output of the results to their users. The library always responds from
every plugin with a :py:class:`~volatility.framework.renderers.TreeGrid`, and the user interface can then determine how
every plugin with a :py:class:`~volatility3.framework.renderers.TreeGrid`, and the user interface can then determine how
best to display it. For the Command Line Interface, that might be via text output as a table, or it might output to an
SQLite database or a CSV file. For a web interface, the best output is probably as JSON where it could be displayed as
a table, or inserted into a database like Elastic Search and trawled using an existing frontend such as Kibana.
@@ -111,9 +111,9 @@ Configuration Tree
------------------
The configuration tree acts as the interface between the calling program and Volatility 3 library. Elements of the
library (such as a :py:class:`Plugin <volatility.framework.interfaces.plugins.PluginInterface>`,
a :py:class:`TranslationLayer <volatility.framework.interfaces.layers.TranslationLayerInterface>`,
an :py:class:`Automagic <volatility.framework.interfaces.automagic.AutomagicInterface>`, etc.) can use the configuration
library (such as a :py:class:`Plugin <volatility3.framework.interfaces.plugins.PluginInterface>`,
a :py:class:`TranslationLayer <volatility3.framework.interfaces.layers.TranslationLayerInterface>`,
an :py:class:`Automagic <volatility3.framework.interfaces.automagic.AutomagicInterface>`, etc.) can use the configuration
tree to inform the calling program of the options they require and/or optionally support, and allows the calling program
to provide that information when the library is then called.
@@ -122,7 +122,7 @@ Automagic
There are certain setup tasks that establish the context in a way favorable to a plugin before it runs, removing
several tasks that are repetitive and also easy to get wrong. These are called
:py:class:`Automagic <volatility.framework.interfaces.automagic.AutomagicInterface>`, since they do things like magically
:py:class:`Automagic <volatility3.framework.interfaces.automagic.AutomagicInterface>`, since they do things like magically
taking a raw memory image and automatically providing the plugin with an appropriate Intel translation layer and an
accurate symbol table without either the plugin or the calling program having to specify all the necessary details.
doc/source/complex-plugin.rst
+37 -37
View File
@@ -6,17 +6,17 @@ which are discussed below.
Writing Reusable Methods
------------------------
Classes which inherit from :py:class:`~volatility.framework.interfaces.plugins.PluginInterface` all have a :py:meth:`run()` method
which takes no parameters and will return a :py:class:`~volatility.framework.interfaces.renderers.TreeGrid`. Since most useful
Classes which inherit from :py:class:`~volatility3.framework.interfaces.plugins.PluginInterface` all have a :py:meth:`run()` method
which takes no parameters and will return a :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`. Since most useful
functions are parameterized, to provide parameters to a plugin the `configuration` for the context must be appropriately manipulated.
There is scope for this, in order to run multiple plugins (see `Writing plugins that run other plugins`) but a much simpler method
is to provide a parameterized `classmethod` within the plugin, which will allow the method to yield whatever kind of output it will
generate and take whatever parameters it might need.
This is how processes are listed, which is an often used function. The code lives within the
:py:class:`~volatility.plugins.windows.pslist.PsList` plugin but can be used by other plugins by providing the
:py:class:`~volatility3.plugins.windows.pslist.PsList` plugin but can be used by other plugins by providing the
appropriate parameters (see
:py:meth:`~volatility.plugins.windows.pslist.PsList.list_processes`).
:py:meth:`~volatility3.plugins.windows.pslist.PsList.list_processes`).
It is up to the author of a plugin to validate that any required plugins are present and are the appropriate version.
Writing plugins that run other plugins
@@ -34,7 +34,7 @@ available plugins that feature a Timeliner interface). This can be achieved wit
This code will first generate suitable automagics for running against the context. Unfortunately this must be re-run for
each plugin in order to populate the context's configuration correctly based on the plugin's requirements (which may vary
between plugins). Once the automagics have been constructed, the plugin can be instantiated using the helper function
:py:func:`~volatility.framework.plugins.construct_plugin` providing:
:py:func:`~volatility3.framework.plugins.construct_plugin` providing:
* the base context (containing the configuration and any already loaded layers or symbol tables),
* the plugin class to run,
@@ -43,7 +43,7 @@ between plugins). Once the automagics have been constructed, the plugin can be
* an open method for the plugin to create files during the run
With the constructed plugin, it can either be run by calling its
:py:meth:`~volatility.framework.interfaces.plugins.PluginInterface.run` method, or any other known method can
:py:meth:`~volatility3.framework.interfaces.plugins.PluginInterface.run` method, or any other known method can
be invoked on it.
Writing plugins that output files
@@ -55,7 +55,7 @@ an abstraction layer is used.
The user interface specifies an open_method (which is actually a class constructor that can double as a python
ContextManager, so it can be used by the python `with` keyword). This is set on the plugin using
`plugin.set_open_method` and can then be called or accessed using `plugin.open(preferred_filename)`. There are no additional options
that can be set on the filename, and a :py:class:`~volatility.framework.interfaces.plugins.FileHandlerInterface` is the result.
that can be set on the filename, and a :py:class:`~volatility3.framework.interfaces.plugins.FileHandlerInterface` is the result.
This mimics an `IO[bytes]` object, which closely mimics a standard python file-like object.
As such code for outputting to a file would be expected to look something like:
@@ -73,10 +73,10 @@ closed to allow the preferred filename to be changed (or data to be added/modifi
Writing Scanners
----------------
Scanners are objects that adhere to the :py:class:`~volatility.framework.interfaces.layers.ScannerInterface`. They are
passed to the :py:meth:`~volatility.framework.interfaces.layers.TranslationLayerInterface.scan` method on layers which will
Scanners are objects that adhere to the :py:class:`~volatility3.framework.interfaces.layers.ScannerInterface`. They are
passed to the :py:meth:`~volatility3.framework.interfaces.layers.TranslationLayerInterface.scan` method on layers which will
divide the provided range of sections (or the entire layer
if none are provided) and call the :py:meth:`~volatility.framework.interfaces.layers.ScannerInterface`'s call method
if none are provided) and call the :py:meth:`~volatility3.framework.interfaces.layers.ScannerInterface`'s call method
method with each chunk as a parameter, ensuring a suitable amount of overlap (as defined by the scanner).
The offset of the chunk, within the layer, is also provided as a parameter.
@@ -96,7 +96,7 @@ Writing/Using Intermediate Symbol Format Files
----------------------------------------------
It can occasionally be useful to create a data file containing the static structures that can create a
:py:class:`~volatility.framework.interfaces.objects.Template` to be instantiated on a layer.
:py:class:`~volatility3.framework.interfaces.objects.Template` to be instantiated on a layer.
Volatility has all the machinery necessary to construct these for you from properly formatted JSON data.
The JSON format is documented by the JSON schema files located in schemas. These are versioned using standard .so
@@ -115,7 +115,7 @@ Constructing an appropriate file, the file can be loaded into a symbol table as
table_name = intermed.IntermediateSymbolTable.create(context, config_path, 'sub_path', 'filename')
This code will load a JSON file from one of the standard symbol paths (volatility/symbols and volatility/framework/symbols)
This code will load a JSON file from one of the standard symbol paths (volatility3/symbols and volatility3/framework/symbols)
under the additional directory sub_path, with a name matching filename.json
(the extension should not be included in the filename).
@@ -136,7 +136,7 @@ Another useful parameter is `table_mapping` which allows for type referenced ins
table_mapping = {'one_table': 'another_table'})
The last parameter that can be used is called `class_types` which allows a particular structure to be instantiated on
a class other than :py:class:`~volatility.framework.objects.StructType`, allowing for additional methods to be defined
a class other than :py:class:`~volatility3.framework.objects.StructType`, allowing for additional methods to be defined
and associated with the type.
The table name can then by used to access the constructed table from the context, such as:
@@ -152,7 +152,7 @@ Translation layers offer a way for data to be translated from a higher (domain)
The main method that must be overloaded for a translation layer is the `mapping` method. Usually this is a linear
mapping whereby a value at an offset in the domain maps directly to an offset in the range.
Most new layers should inherit from :py:class:`~volatility.framework.layers.linear.LinearlyMappedLayer` where they
Most new layers should inherit from :py:class:`~volatility3.framework.layers.linear.LinearlyMappedLayer` where they
can define a mapping method as follows:
.. code-block:: python
@@ -182,8 +182,8 @@ of data. Each chunk contains the following information, in order:
An example (and the most common layer encountered in memory forensics) would be an Intel layer, which models the intel
page mapping system. Based on a series of tables stored within the layer itself, an intel layer can convert a virtual
address to a physical address. It should be noted that intel layers are surjective in that a single virtual address can
map to multiple physical addresses, but a single virtual address can only ever map to a single physical address.
address to a physical address. It should be noted that intel layers allow multiple virtual addresses to map to the
same physical address (but a single virtual address cannot ever map to more than one physical address).
As a simple example, in a virtual layer which looks like `abracadabra` but maps to a physical layer that looks
like `abcdr`, requesting `mapping(5, 4)` would return:
@@ -205,7 +205,7 @@ This mechanism also allowed for some minor optimization in scanning such a layer
scanning of layers be needed, please refer to the Layer Scanning page.
Whilst it may seem as though some of the data seems redundant (the length values are always the same) this is not the
case for :py:class:`~volatility.framework.layers.segmented.NonLinearlySegmentedLayer`. These layers do not guarantee
case for :py:class:`~volatility3.framework.layers.segmented.NonLinearlySegmentedLayer`. These layers do not guarantee
that each domain address maps directly to a range address, and in fact can carry out processing on the data. These
layers are most commonly encountered as compression or encryption layers (whereby a domain address may map into a
chunk of the range, but not directly). In this instance, the mapping will likely define additional methods that can
@@ -285,8 +285,8 @@ Writing new Templates and Objects
---------------------------------
In most cases, a whole new type of object is unnecessary. It will usually be derived from an
:py:class:`~volatility.framework.objects.StructType` (which is itself just another name for a
:py:class:`~volatility.framework.objects.AggregateType`, but it's better to use `StructType` for readability).
:py:class:`~volatility3.framework.objects.StructType` (which is itself just another name for a
:py:class:`~volatility3.framework.objects.AggregateType`, but it's better to use `StructType` for readability).
This can be used as a class override for a particular symbol table, so that an existing structure can be augmented with
additional methods. An example of this would be:
@@ -300,27 +300,27 @@ This will mean that when a specific structure is loaded from the symbol_space, i
`StructType`, but instead is instantiated using the NewStructureClass, meaning new methods can be called directly on it.
If the situation really calls for an entirely new object, that isn't covered by one of the existing
:py:class:`~volatility.framework.objects.PrimativeObject` objects (such as
:py:class:`~volatility.framework.objects.Integer`,
:py:class:`~volatility.framework.objects.Boolean`,
:py:class:`~volatility.framework.objects.Float`,
:py:class:`~volatility.framework.objects.Char`,
:py:class:`~volatility.framework.objects.Bytes`)
:py:class:`~volatility3.framework.objects.PrimativeObject` objects (such as
:py:class:`~volatility3.framework.objects.Integer`,
:py:class:`~volatility3.framework.objects.Boolean`,
:py:class:`~volatility3.framework.objects.Float`,
:py:class:`~volatility3.framework.objects.Char`,
:py:class:`~volatility3.framework.objects.Bytes`)
or the other builtins (such as
:py:class:`~volatility.framework.objects.Array`,
:py:class:`~volatility.framework.objects.Bitfield`,
:py:class:`~volatility.framework.objects.Enumeration`,
:py:class:`~volatility.framework.objects.Pointer`,
:py:class:`~volatility.framework.objects.String`,
:py:class:`~volatility.framework.objects.Void`) then you can review the following information about defining an entirely
:py:class:`~volatility3.framework.objects.Array`,
:py:class:`~volatility3.framework.objects.Bitfield`,
:py:class:`~volatility3.framework.objects.Enumeration`,
:py:class:`~volatility3.framework.objects.Pointer`,
:py:class:`~volatility3.framework.objects.String`,
:py:class:`~volatility3.framework.objects.Void`) then you can review the following information about defining an entirely
new object.
All objects must inherit from :py:class:`~volatility.framework.interfaces.objects.ObjectInterface` which defines a
constructor that takes a context, a `type_name`, an :py:class:`~volatility.framework.interfaces.objects.ObjectInformation`
All objects must inherit from :py:class:`~volatility3.framework.interfaces.objects.ObjectInterface` which defines a
constructor that takes a context, a `type_name`, an :py:class:`~volatility3.framework.interfaces.objects.ObjectInformation`
object and then can accept additional keywords (which will not necessarily be provided if the object is constructed
from a JSON reference).
The :py:class:`~volatility.framework.interfaces.objects.ObjectInformation` class contains all the basic elements that
The :py:class:`~volatility3.framework.interfaces.objects.ObjectInformation` class contains all the basic elements that
define an object, which include:
* layer_name
@@ -345,10 +345,10 @@ should be. Note, the size can change throughout the lifespan of the object, and
it compensates for such a change.
Objects must also contain a specific class called `VolTemplateProxy` which must inherit from
:py:class:`~volatility.framework.interfaces.objects.ObjectInterface`. This is used to access information about
:py:class:`~volatility3.framework.interfaces.objects.ObjectInterface`. This is used to access information about
a structure before it has been associated with data and becomes an Object. The
:py:class:`~volatility.framework.interfaces.objects.ObjectInterface.VolTemplateProxy` class contains a number of
abstract classmethods, which take a :py:class:`~volatility.framework.interfaces.objects.Template`. The main method
:py:class:`~volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy` class contains a number of
abstract classmethods, which take a :py:class:`~volatility3.framework.interfaces.objects.Template`. The main method
that is likely to need overwriting is the `size` method, which should return the size of the object (for the template
of a dynamically-sized object, this should be a suitable value, and calculated based on the best available information).
For most objects, this can be determined from the JSON data used to construct a normal `Struct` and therefore only needs
doc/source/conf.py
+14 -14
View File
@@ -21,18 +21,18 @@ import sphinx.ext.apidoc
def setup(app):
volatility_directory = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..', 'volatility'))
volatility_directory = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..', 'volatility3'))
source_dir = os.path.abspath(os.path.dirname(__file__))
sphinx.ext.apidoc.main(argv = ['-e', '-M', '-f', '-T', '-o', source_dir, volatility_directory])
# Go through the volatility.framework.plugins files and change them to volatility.plugins
# Go through the volatility3.framework.plugins files and change them to volatility3.plugins
for dir, _, files in os.walk(os.path.dirname(__file__)):
for filename in files:
if filename.startswith('volatility.framework.plugins') and filename != 'volatility.framework.plugins.rst':
# Change all volatility.framework.plugins to volatility.plugins in the file
if filename.startswith('volatility3.framework.plugins') and filename != 'volatility3.framework.plugins.rst':
# Change all volatility3.framework.plugins to volatility3.plugins in the file
# Rename the file
new_filename = filename.replace('volatility.framework.plugins', 'volatility.plugins')
new_filename = filename.replace('volatility3.framework.plugins', 'volatility3.plugins')
replace_string = b"Submodules\n----------\n\n.. toctree::\n\n"
submodules = replace_string
@@ -48,25 +48,25 @@ def setup(app):
with open(os.path.join(dir, new_filename), 'wb') as newfile:
with open(os.path.join(dir, filename), "rb") as oldfile:
line = oldfile.read()
correct_plugins = line.replace(b'volatility.framework.plugins', b'volatility.plugins')
correct_plugins = line.replace(b'volatility3.framework.plugins', b'volatility3.plugins')
correct_submodules = correct_plugins.replace(replace_string, submodules)
newfile.write(correct_submodules)
os.remove(os.path.join(dir, filename))
elif filename == 'volatility.framework.rst':
elif filename == 'volatility3.framework.rst':
with open(os.path.join(dir, filename), "rb") as contents:
lines = contents.readlines()
plugins_seen = False
with open(os.path.join(dir, filename), "wb") as contents:
for line in lines:
if b'volatility.framework.plugins' in line:
if b'volatility3.framework.plugins' in line:
plugins_seen = True
if plugins_seen and line == b'':
contents.write(b' volatility.plugins')
contents.write(b' volatility3.plugins')
contents.write(line)
elif filename == 'volatility.plugins.rst':
elif filename == 'volatility3.plugins.rst':
with open(os.path.join(dir, filename), "rb") as contents:
lines = contents.readlines()
with open(os.path.join(dir, 'volatility.framework.plugins.rst'), "rb") as contents:
with open(os.path.join(dir, 'volatility3.framework.plugins.rst'), "rb") as contents:
real_lines = contents.readlines()
# Process real_lines
@@ -75,14 +75,14 @@ def setup(app):
break
else:
line_index = len(real_lines)
submodule_lines = real_lines[line_index:]
submodule_lines = [b"\n"] + real_lines[line_index:]
plugins_seen = False
with open(os.path.join(dir, filename), "wb") as contents:
for line in lines:
contents.write(line)
for line in submodule_lines:
contents.write(line.replace(b'volatility.framework.plugins', b'volatility.plugins'))
contents.write(line.replace(b'volatility3.framework.plugins', b'volatility3.plugins'))
# If extensions (or modules to document with autodoc) are in another directory,
@@ -90,7 +90,7 @@ def setup(app):
# documentation root, use os.path.abspath to make it absolute, like shown here.
sys.path.insert(0, os.path.abspath('../..'))
from volatility.framework import constants
from volatility3.framework import constants
# -- General configuration ------------------------------------------------
doc/source/index.rst
+2 -2
View File
@@ -5,7 +5,7 @@ This is the documentation for Volatility 3, the most advanced memory forensics
framework in the world. Like previous versions of the Volatility framework,
Volatility 3 is Open Source.
:doc:`List of plugins <volatility.plugins>`
:doc:`List of plugins <volatility3.plugins>`
Here are some guidelines for using Volatility 3 effectively:
@@ -22,7 +22,7 @@ Python Packages
===============
.. toctree::
volatility
volatility3
Indices and tables
==================
doc/source/simple-plugin.rst
+28 -28
View File
@@ -3,19 +3,19 @@ How to Write a Simple Plugin
This guide will step through how to construct a simple plugin using Volatility 3.
The example plugin we'll use is :py:class:`~volatility.plugins.windows.dlllist.DllList`, which features the main traits
The example plugin we'll use is :py:class:`~volatility3.plugins.windows.dlllist.DllList`, which features the main traits
of a normal plugin, and reuses other plugins appropriately.
Inherit from PluginInterface
----------------------------
The first step is to define a class that inherits from :py:class:`~volatility.framework.interfaces.plugins.PluginInterface`.
The first step is to define a class that inherits from :py:class:`~volatility3.framework.interfaces.plugins.PluginInterface`.
Volatility automatically finds all plugins defined under the various plugin directories by importing them and then
making use of any classes that inherit from :py:class:`~volatility.framework.interfaces.plugins.PluginInterface`.
making use of any classes that inherit from :py:class:`~volatility3.framework.interfaces.plugins.PluginInterface`.
::
from volatility.framework import interfaces
from volatility3.framework import interfaces
class DllList(interfaces.plugins.PluginInterface):
@@ -56,7 +56,7 @@ to instantiate the plugin). At the moment these requirements are fairly straigh
architectures = ["Intel32", "Intel64"]),
This requirement indicates that the plugin will operate on a single
:py:class:`TranslationLayer <volatility.framework.interfaces.layers.TranslationLayerInterface>`. The name of the
:py:class:`TranslationLayer <volatility3.framework.interfaces.layers.TranslationLayerInterface>`. The name of the
loaded layer will appear in the plugin's configuration under the name ``primary``. Requirement values can be
accessed within the plugin through the plugin's `config` attribute (for example ``self.config['pid']``).
@@ -71,7 +71,7 @@ layers, for example a plugin that carries out some form of difference or statist
This requirement (and the next two) are known as Complex Requirements, and user interfaces will likely not directly
request a value for this from a user. The value stored in the configuration tree for a
:py:class:`~volatility.framework.configuration.requirements.TranslationLayerRequirement` is
:py:class:`~volatility3.framework.configuration.requirements.TranslationLayerRequirement` is
the string name of a layer present in the context's memory that satisfies the requirement.
::
@@ -80,14 +80,14 @@ the string name of a layer present in the context's memory that satisfies the re
description = "Windows kernel symbols"),
This requirement specifies the need for a particular
:py:class:`SymbolTable <volatility.framework.interfaces.symbols.SymbolTableInterface>`
:py:class:`SymbolTable <volatility3.framework.interfaces.symbols.SymbolTableInterface>`
to be loaded. This gets populated by various
:py:class:`Automagic <volatility.framework.interfaces.automagic.AutoMagicInterface>` as the nearest sibling to a particular
:py:class:`~volatility.framework.configuration.requirements.TranslationLayerRequirement`.
This means that if the :py:class:`~volatility.framework.configuration.requirements.TranslationLayerRequirement`
is satisfied and the :py:class:`Automagic <volatility.framework.interfaces.automagic.AutoMagicInterface>` can determine
the appropriate :py:class:`SymbolTable <volatility.framework.interfaces.symbols.SymbolTableInterface>`, the
name of the :py:class:`SymbolTable <volatility.framework.interfaces.symbols.SymbolTableInterface>` will be stored in the configuration.
:py:class:`Automagic <volatility3.framework.interfaces.automagic.AutoMagicInterface>` as the nearest sibling to a particular
:py:class:`~volatility3.framework.configuration.requirements.TranslationLayerRequirement`.
This means that if the :py:class:`~volatility3.framework.configuration.requirements.TranslationLayerRequirement`
is satisfied and the :py:class:`Automagic <volatility3.framework.interfaces.automagic.AutoMagicInterface>` can determine
the appropriate :py:class:`SymbolTable <volatility3.framework.interfaces.symbols.SymbolTableInterface>`, the
name of the :py:class:`SymbolTable <volatility3.framework.interfaces.symbols.SymbolTableInterface>` will be stored in the configuration.
This requirement is also a Complex Requirement and therefore will not be requested directly from the user.
@@ -119,10 +119,10 @@ Define the `run` method
The run method is the primary method called on a plugin. It takes no parameters (these have been passed through the
context's configuration tree, and the context is provided at plugin initialization time) and returns an unpopulated
:py:class:`~volatility.framework.interfaces.renderers.TreeGrid` object. These are typically constructed based on a
:py:class:`~volatility3.framework.interfaces.renderers.TreeGrid` object. These are typically constructed based on a
generator that carries out the bulk of the plugin's processing. The
:py:class:`~volatility.framework.interfaces.renderers.TreeGrid` also specifies the column names and types
that will be output as part of the :py:class:`~volatility.framework.interfaces.renderers.TreeGrid`.
:py:class:`~volatility3.framework.interfaces.renderers.TreeGrid` also specifies the column names and types
that will be output as part of the :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`.
::
@@ -143,28 +143,28 @@ that will be output as part of the :py:class:`~volatility.framework.interfaces.r
In this instance, the plugin constructs a filter (using the PsList plugin's *classmethod* for creating filters).
It checks the plugin's configuration for the ``pid`` value, and passes it in as a list if it finds it, or None if
it does not. The :py:func:`~volatility.plugins.windows.pslist.PsList.create_pid_filter` method accepts a list of process
it does not. The :py:func:`~volatility3.plugins.windows.pslist.PsList.create_pid_filter` method accepts a list of process
identifiers that are included in the list. If the list is empty, all processes are returned.
The next line specifies the columns by their name and type. The types are simple types (int, str, bytes, float, and bool)
but can also provide hints as to how the output should be displayed (such as a hexidecimal number, using
:py:class:`volatility.framework.renderers.format_hints.Hex`).
:py:class:`volatility3.framework.renderers.format_hints.Hex`).
This indicates to user interfaces that the value should be displayed in a particular way, but does not guarantee that the value
will be displayed that way (for example, if it doesn't make sense to do so in a particular interface).
Finally, the generator is provided. The generator accepts a list of processes, which is gathered using a different plugin,
the :py:class:`~volatility.plugins.windows.pslist.PsList` plugin. That plugin features a *classmethod*,
the :py:class:`~volatility3.plugins.windows.pslist.PsList` plugin. That plugin features a *classmethod*,
so that other plugins can call it. As such, it takes all the necessary parameters rather than accessing them
from a configuration. Since it must be portable code, it takes a context, as well as the layer name,
symbol table and optionally a filter. In this instance we unconditionally
pass it the values from the configuration for the ``primary`` and ``nt_symbols`` requirements. This will generate a list
of :py:class:`~volatility.framework.symbols.windows.extensions.EPROCESS` objects, as provided by the :py:class:`~volatility.plugins.windows.pslist.PsList` plugin,
of :py:class:`~volatility3.framework.symbols.windows.extensions.EPROCESS` objects, as provided by the :py:class:`~volatility.plugins.windows.pslist.PsList` plugin,
and is not covered here but is used as an example for how to share code across plugins
(both as the provider and the consumer of the shared code).
Define the generator
--------------------
The :py:class:`~volatility.framework.interfaces.renderers.TreeGrid` can be populated without a generator,
The :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid` can be populated without a generator,
but it is quite a common model to use. This is where the main processing for this plugin lives.
::
@@ -189,10 +189,10 @@ but it is quite a common model to use. This is where the main processing for th
format_hints.Hex(entry.DllBase), format_hints.Hex(entry.SizeOfImage),
BaseDllName, FullDllName))
This iterates through the list of processes and for each one calls the :py:meth:`~volatility.framework.symbols.windows.extensions.EPROCESS.load_order_modules` method on it. This provides
This iterates through the list of processes and for each one calls the :py:meth:`~volatility3.framework.symbols.windows.extensions.EPROCESS.load_order_modules` method on it. This provides
a list of the loaded modules within the process.
The plugin then defaults the ``BaseDllName`` and ``FullDllName`` variables to an :py:class:`~volatility.framework.renderers.UnreadableValue`,
The plugin then defaults the ``BaseDllName`` and ``FullDllName`` variables to an :py:class:`~volatility3.framework.renderers.UnreadableValue`,
which is a way of indicating to the user interface that the value couldn't be read for some reason (but that it isn't fatal).
There are currently four different reasons a value may be unreadable:
@@ -204,7 +204,7 @@ There are currently four different reasons a value may be unreadable:
This is a safety provision to ensure that the data returned by the Volatility library is accurate and describes why
information may not be provided.
The plugin then takes the process's ``BaseDllName`` value, and calls :py:meth:`~volatility.framework.symbols.windows.extensions.UNICODE_STRING.get_string` on it. All structure attributes,
The plugin then takes the process's ``BaseDllName`` value, and calls :py:meth:`~volatility3.framework.symbols.windows.extensions.UNICODE_STRING.get_string` on it. All structure attributes,
as defined by the symbols, are directly accessible and use the case-style of the symbol library it came from (in Windows,
attributes are CamelCase), such as ``entry.BaseDllName`` in this instance. Any attribtues not defined by the symbol but added
by Volatility extensions cannot be properties (in case they overlap with the attributes defined in the symbol libraries)
@@ -215,16 +215,16 @@ read the data at a particular offset. This will cause an exception to be thrown
as a means of communicating when something exceptional happens. It is the responsibility of the plugin developer to
appropriately catch and handle any non-fatal exceptions and otherwise allow the exception to be thrown by the user interface.
In this instance, the :py:class:`~volatility.framework.exceptions.InvalidAddressException` class is caught, which is thrown
In this instance, the :py:class:`~volatility3.framework.exceptions.InvalidAddressException` class is caught, which is thrown
by any layer which cannot access an offset requested of it. Since we have already populated both values with ``UnreadableValue``
we do not need to write code for the exception handler.
Finally, we yield the record in the format required by the :py:class:`~volatility.framework.interfaces.renderers.TreeGrid`,
Finally, we yield the record in the format required by the :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`,
a tuple, listing the indentation level (for trees) and then the list of values for each column.
This plugin demonstrates casting a value ``ImageFileName`` to ensure it's returned
as a string with a specific maximum length, rather than its original type (potentially an array of characters, etc).
This is carried out using the :py:meth:`~volatility.framework.interfaces.objects.ObjectInterface.cast` method which takes a type (either a native type, such as string or pointer, or a
structure type defined in a :py:class:`SymbolTable <volatility.framework.interfaces.symbols.SymbolTableInterface>`
This is carried out using the :py:meth:`~volatility3.framework.interfaces.objects.ObjectInterface.cast` method which takes a type (either a native type, such as string or pointer, or a
structure type defined in a :py:class:`SymbolTable <volatility3.framework.interfaces.symbols.SymbolTableInterface>`
such as ``<table>!_UNICODE``) and the parameters to that type.
Since the cast value must populate a string typed column, it had to be a Python string (such as being cast to the native
doc/source/symbol-tables.rst
+2 -2
View File
@@ -12,7 +12,7 @@ Volatility will automatically decompress them on use. It will also cache their
under the user's home directory, in :file:`.cache/volatility3`, along with other useful data. The cache directory currently
cannot be altered.
Symbol table JSON files live, by default, under the :file:`volatility/symbols`, underneath an operating system directory
Symbol table JSON files live, by default, under the :file:`volatility3/symbols`, underneath an operating system directory
(currently one of :file:`windows`, :file:`mac` or :file:`linux`). The symbols directory is configurable within the framework and can
usually be set within the user interface.
@@ -33,7 +33,7 @@ Windows symbol tables can be manually constructed from an appropriate PDB file.
is built into Volatility 3, called :file:`pdbconv.py`. It can be run from the top-level Volatility path, using the
following command:
:command:`PYTHONPATH="." python volatility/framework/symbols/windows/pdbconv.py`
:command:`PYTHONPATH="." python volatility3/framework/symbols/windows/pdbconv.py`
The :envvar:`PYTHONPATH` environment variable is not required if the Volatility library is installed in the system's library path
or a virtual environment.
doc/source/using-as-a-library.rst
+23 -23
View File
@@ -25,7 +25,7 @@ from versions 1.1 or 1.2:
::
volatility.framework.require_interface_version(1, 0, 0)
volatility3.framework.require_interface_version(1, 0, 0)
Contexts can be spun up quite easily, just construct one. It's not a singleton, so multiple contexts can be
constructed and operate independently, but be aware of which context you're handing where and make sure to use
@@ -42,20 +42,20 @@ Determine what plugins are available
------------------------------------
You can also interrogate the framework to see which plugins are available. First we have to try to load all
available plugins. The :py:func:`~volatility.framework.import_files` method will automatically use the module
paths for the provided module (in this case, volatility.plugins) and walk the directory (or directories) loading up
available plugins. The :py:func:`~volatility3.framework.import_files` method will automatically use the module
paths for the provided module (in this case, volatility3.plugins) and walk the directory (or directories) loading up
all python files. Any import failures will be provided in the failures return value, unless the second parameter is
False in which case the call will raise any exceptions encountered. Any additional directories containing plugins
should be added to the `__path__` attribute for the `volatility.plugins` module. The standard paths should generally
also be included, which can be found in `volatility.constants.PLUGINS_PATH`.
should be added to the `__path__` attribute for the `volatility3.plugins` module. The standard paths should generally
also be included, which can be found in `volatility3.constants.PLUGINS_PATH`.
::
volatility.plugins.__path__ = <new_plugin_path> + constants.PLUGINS_PATH
failures = framework.import_files(volatility.plugins, True)
volatility3.plugins.__path__ = <new_plugin_path> + constants.PLUGINS_PATH
failures = framework.import_files(volatility3.plugins, True)
Once the plugins have been imported, we can interrogate which plugins are available. The
:py:func:`~volatility.framework.list_plugins` call will
:py:func:`~volatility3.framework.list_plugins` call will
return a dictionary of plugin names and the plugin classes.
::
@@ -68,9 +68,9 @@ Determine what configuration options a plugin requires
------------------------------------------------------
For each plugin class, we can call the classmethod `requirements` on it, which will return a list of objects that
adhere to the :py:class:`~volatility.framework.interfaces.configuration.RequirementInterface` method. The various
adhere to the :py:class:`~volatility3.framework.interfaces.configuration.RequirementInterface` method. The various
types of Requirement are split roughly in two,
:py:class:`~volatility.framework.interfaces.configuration.SimpleTypeRequirement` (such as integers, booleans, floats
:py:class:`~volatility3.framework.interfaces.configuration.SimpleTypeRequirement` (such as integers, booleans, floats
and strings) and more complex requirements (such as lists, choices, multiple requirements, translation layer
requirements or symbol table requirements). A requirement just specifies a type of data and a name, and must be
combined with a configuration hierarchy to have meaning.
@@ -98,7 +98,7 @@ underneaths its own branch). To set the hierarchy, you'll need to know where th
For this example, we'll assume plugins' base_config_path is set as `plugins`, and that automagics are configured under
the `automagic` tree. We'll see later how to ensure this matches up with the plugins and automagic when they're
constructed. Joining configuration options should always be carried out using
:py:func:`~volatility.framework.interfaces.configuration.path_join`
:py:func:`~volatility3.framework.interfaces.configuration.path_join`
in case the separator value gets changed in the future. Configuration items can then be set as follows:
::
@@ -170,7 +170,7 @@ be called whenever a plugin produces an auxiliary file.
constructed = plugin(context, plugin_config_path, progress_callback = progress_callback)
constructed.set_open_method(file_handler)
The file_handler must adhere to the :py:class:`~volatility.framework.interfaces.plugins.FileHandlerInterface`,
The file_handler must adhere to the :py:class:`~volatility3.framework.interfaces.plugins.FileHandlerInterface`,
which represents an IO[bytes] object but also contains a `preferred_filename` attribute as a hint.
All of this functionality has been condensed into a framework method called `construct_plugin` which will
@@ -181,7 +181,7 @@ accepts an optional progress_callback and an optional file_consumer.
constructed = plugins.construct_plugin(ctx, automagics, plugin, base_config_path, progress_callback, file_consumer)
Finally the plugin can be run, and will return a :py:class:`~volatility.framework.interfaces.renderers.TreeGrid`.
Finally the plugin can be run, and will return a :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`.
::
@@ -201,22 +201,22 @@ does the actual work. This can return an exception if one occurs during the run
The results can be accessed either as the results are being processed, or by visiting the nodes in the tree
once it is fully populated. In either case, a visitor method will be required. The visitor method
should accept a :py:class:`~volatility.framework.interfaces.renderers.TreeNode` and an `accumulator`. It will
should accept a :py:class:`~volatility3.framework.interfaces.renderers.TreeNode` and an `accumulator`. It will
return an updated accumulator.
When provided a :py:class:`~volatility.framework.interfaces.renderers.TreeNode`, it can be accessed as a dictionary
When provided a :py:class:`~volatility3.framework.interfaces.renderers.TreeNode`, it can be accessed as a dictionary
based on the column names that the treegrid contains. It should be noted that each column can contain only the
type specified in the `column.type` field (which can be a simple type like string, integer, float, bytes or
a more complex type, like a DateTime, a Disassembly or a descendant of
:py:class:`~volatility.framework.interfaces.renderers.BaseAbsentValue`). The various fields may also be wrapped in
:py:class:`~volatility3.framework.interfaces.renderers.BaseAbsentValue`). The various fields may also be wrapped in
`format_hints` designed to tell the user interface how to render the data. These hints can be things like Bin, Hex or
HexBytes, so that fields like offsets are displayed in hex form or so that bytes are displayed in their hex form rather
than their raw form. Descendants of :py:class:`~volatility.framework.interfaces.renderers.BaseAbsentValue` can currently
than their raw form. Descendants of :py:class:`~volatility3.framework.interfaces.renderers.BaseAbsentValue` can currently
be one of
:py:class:`~volatility.framework.renderers.UnreadableValue`,
:py:class:`~volatility.framework.renderers.UnparsableValue`,
:py:class:`~volatility.framework.renderers.NotApplicableValue` or
:py:class:`~volatility.framework.renderers.NotAvailableValue`. These indicate that data could not be read from the
:py:class:`~volatility3.framework.renderers.UnreadableValue`,
:py:class:`~volatility3.framework.renderers.UnparsableValue`,
:py:class:`~volatility3.framework.renderers.NotApplicableValue` or
:py:class:`~volatility3.framework.renderers.NotAvailableValue`. These indicate that data could not be read from the
memory for some reason, could not be parsed properly, was not applicable or was not available.
A simple text renderer (that returns output immediately) would appear as follows. This doesn't use
@@ -240,5 +240,5 @@ the accumulator, but instead uses print to directly produce the output. This is
grid.populate(visitor, None)
More complex examples of renderers can be found in the default CLI implementation, such as the
:py:class:`~volatility.cli.text_renderer.QuickTextRenderer` or the
:py:class:`~volatility.cli.text_renderer.PrettyTextRenderer`.
:py:class:`~volatility3.cli.text_renderer.QuickTextRenderer` or the
:py:class:`~volatility3.cli.text_renderer.PrettyTextRenderer`.
doc/source/vol2to3.rst
+9 -9
View File
@@ -6,7 +6,7 @@ Library and Context
Volatility 3 has been designed from the ground up to be a library, this means the components are independent and all
state required to run a particular plugin at a particular time is self-contained in an object derived from
a :py:class:`~volatility.framework.interfaces.context.ContextInterface`.
a :py:class:`~volatility3.framework.interfaces.context.ContextInterface`.
The context contains the two core components that make up Volatility, layers of data and the available symbols.
@@ -14,7 +14,7 @@ Symbols and Types
-----------------
Volatility 3 no longer uses profiles, it comes with an extensive library of
:py:class:`symbol tables <volatility.framework.interfaces.symbols.SymbolTableInterface>`, and can generate new symbol
:py:class:`symbol tables <volatility3.framework.interfaces.symbols.SymbolTableInterface>`, and can generate new symbol
tables for most windows memory images, based on the memory image itself. This allows symbol tables to include specific
offsets for locations (symbol locations) based on that operating system in particular. This means it is easier and quicker
to identify structures within an operating system, by having known offsets for those structures provided by the official
@@ -37,11 +37,11 @@ re-read many times over for no benefit (particularly since each re-read could re
from following page table translations).
Finally, in order to provide Volatility specific information without impact on the ability for structures to have members
with arbitrary names, all the metadata about the object (such as its layer or offset) have been moved to a read-only :py:meth:`~volatility.framework.interfaces.objects.ObjectInterface.vol`
with arbitrary names, all the metadata about the object (such as its layer or offset) have been moved to a read-only :py:meth:`~volatility3.framework.interfaces.objects.ObjectInterface.vol`
dictionary.
Further the distinction between a :py:class:`~volatility.framework.interfaces.objects.Template` (the thing that
constructs an object) and the :py:class:`Object <volatility.framework.interfaces.objects.ObjectInterface>` itself has
Further the distinction between a :py:class:`~volatility3.framework.interfaces.objects.Template` (the thing that
constructs an object) and the :py:class:`Object <volatility3.framework.interfaces.objects.ObjectInterface>` itself has
been made more explicit. In Volatility 2, some information (such as size) could only be determined from a constructed object,
leading to instantiating a template on an empty buffer, just to determine the size. In Volatility 3, templates contain
information such as their size, which can be queried directly without constructing the object.
@@ -49,7 +49,7 @@ information such as their size, which can be queried directly without constructi
Layer and Layer dependencies
----------------------------
Address spaces in Volatility 2, are now more accurately referred to as
:py:class:`Translation Layers <volatility.framework.interfaces.layers.TranslationLayerInterface>`, since each one typically sits
:py:class:`Translation Layers <volatility3.framework.interfaces.layers.TranslationLayerInterface>`, since each one typically sits
atop another and can translate addresses between the higher logical layer and the lower physical layer. Address spaces in
Volatility 2 were strictly limited to a stack, one on top of one other. In Volatility 3, layers can have multiple
"dependencies" (lower layers), which allows for the integration of features such as swap space.
@@ -65,13 +65,13 @@ included a stacker automagic to emulate the most common feature of Volatility 2,
Searching and Scanning
----------------------
Scanning is very similar to scanning in Volatility 2, a scanner object (such as a
:py:class:`~volatility.framework.layers.scanners.BytesScanner` or :py:class:`~volatility.framework.layers.scanners.RegExScanner`) is
primed with the data to be searched for, and the :py:meth:`~volatility.framework.interfaces.layers.DataLayerInterface.scan` method is called on the layer to be searched.
:py:class:`~volatility3.framework.layers.scanners.BytesScanner` or :py:class:`~volatility.framework.layers.scanners.RegExScanner`) is
primed with the data to be searched for, and the :py:meth:`~volatility3.framework.interfaces.layers.DataLayerInterface.scan` method is called on the layer to be searched.
Output Rendering
----------------
This is extremely similar to Volatility 2, because we were developing it for Volatility 3 when we added it to Volatility 2.
We now require that all plugins produce output in a :py:class:`~volatility.framework.interfaces.renderers.TreeGrid` object,
We now require that all plugins produce output in a :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid` object,
which ensure that the library can be used regardless of which interface is driving it. An example web GUI is also available
called Volumetric which allows all the plugins that can be run from the command line to be run from a webpage, and offers
features such as automatic formatting and sorting of the data, which previously couldn't be provided easily from the CLI.
setup.py
+5 -5
View File
@@ -4,9 +4,9 @@
import setuptools
from volatility.framework import constants
from volatility3.framework import constants
setuptools.setup(name = "volatility",
setuptools.setup(name = "volatility3",
description = "Memory forensics framework",
version = constants.PACKAGE_VERSION,
license = "VSL",
@@ -16,7 +16,7 @@ setuptools.setup(name = "volatility",
url = "https://volatilityfoundation.org/volatility/",
project_urls = {
"Bug Tracker": "https://github.com/volatilityfoundation/volatility3/issues",
"Documentation": "https://volatilityfoundation.org/volatility/docs/",
"Documentation": "https://volatility3.readthedocs.io/",
"Source Code": "https://github.com/volatilityfoundation/volatility3",
},
include_package_data = True,
@@ -27,8 +27,8 @@ setuptools.setup(name = "volatility",
packages = setuptools.find_packages(exclude = ["development", "development.*"]),
entry_points = {
'console_scripts': [
'vol = volatility.cli:main',
'volshell = volatility.cli.volshell:main',
'vol = volatility3.cli:main',
'volshell = volatility3.cli.volshell:main',
],
},
install_requires = ["pefile"],
vol.py
+2 -2
View File
@@ -4,7 +4,7 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
import volatility.cli
import volatility3.cli
if __name__ == '__main__':
volatility.cli.main()
volatility3.cli.main()
vol.spec
+19 -19
View File
@@ -31,15 +31,15 @@ sys.path.append(os.getcwd())
vol_analysis = Analysis(['vol.py'],
pathex = [],
binaries = binaries,
datas = collect_data_files('volatility.framework') + \
collect_data_files('volatility.framework.automagic', include_py_files = True) + \
collect_data_files('volatility.framework.plugins', include_py_files = True) + \
collect_data_files('volatility.framework.layers', include_py_files = True) + \
collect_data_files('volatility.schemas') + \
collect_data_files('volatility.plugins', include_py_files = True),
hiddenimports = collect_submodules('volatility.framework.automagic') + \
collect_submodules('volatility.framework.plugins') + \
collect_submodules('volatility.framework.symbols'),
datas = collect_data_files('volatility3.framework') + \
collect_data_files('volatility3.framework.automagic', include_py_files = True) + \
collect_data_files('volatility3.framework.plugins', include_py_files = True) + \
collect_data_files('volatility3.framework.layers', include_py_files = True) + \
collect_data_files('volatility3.schemas') + \
collect_data_files('volatility3.plugins', include_py_files = True),
hiddenimports = collect_submodules('volatility3.framework.automagic') + \
collect_submodules('volatility3.framework.plugins') + \
collect_submodules('volatility3.framework.symbols'),
hookspath = [],
runtime_hooks = [],
excludes = [],
@@ -55,16 +55,16 @@ vol_analysis = Analysis(['vol.py'],
# volshell_analysis = Analysis(['volshell.py'],
# pathex = [],
# binaries = [],
# datas = collect_data_files('volatility.framework') + \
# collect_data_files('volatility.framework.automagic', include_py_files = True) + \
# collect_data_files('volatility.framework.plugins', include_py_files = True) + \
# collect_data_files('volatility.framework.layers', include_py_files = True) + \
# collect_data_files('volatility.cli', include_py_files = True) + \
# collect_data_files('volatility.schemas') + \
# collect_data_files('volatility.plugins', include_py_files = True),
# hiddenimports = collect_submodules('volatility.framework.automagic') + \
# collect_submodules('volatility.framework.plugins') + \
# collect_submodules('volatility.framework.symbols'),
# datas = collect_data_files('volatility3.framework') + \
# collect_data_files('volatility3.framework.automagic', include_py_files = True) + \
# collect_data_files('volatility3.framework.plugins', include_py_files = True) + \
# collect_data_files('volatility3.framework.layers', include_py_files = True) + \
# collect_data_files('volatility3.cli', include_py_files = True) + \
# collect_data_files('volatility3.schemas') + \
# collect_data_files('volatility3.plugins', include_py_files = True),
# hiddenimports = collect_submodules('volatility3.framework.automagic') + \
# collect_submodules('volatility3.framework.plugins') + \
# collect_submodules('volatility3.framework.symbols'),
# hookspath = [],
# runtime_hooks = [],
# excludes = [],
volatility/__init__.py → volatility3/__init__.py
+9 -9
View File
@@ -35,8 +35,8 @@ class WarningFindSpec(abc.MetaPathFinder):
def find_spec(fullname: str, path: Optional[List[str]], target: None = None, **kwargs) -> None:
"""Mock find_spec method that just checks the name, this must go
first."""
if fullname.startswith("volatility.framework.plugins."):
warning = "Please do not use the volatility.framework.plugins namespace directly, only use volatility.plugins"
if fullname.startswith("volatility3.framework.plugins."):
warning = "Please do not use the volatility3.framework.plugins namespace directly, only use volatility3.plugins"
# Pyinstaller uses walk_packages to import, but needs to read the modules to figure out dependencies
# As such, we only print the warning when directly imported rather than from within walk_packages
if inspect.stack()[-2].function != 'walk_packages':
@@ -46,17 +46,17 @@ class WarningFindSpec(abc.MetaPathFinder):
warning_find_spec = [WarningFindSpec()] # type: List[abc.MetaPathFinder]
sys.meta_path = warning_find_spec + sys.meta_path
# We point the volatility.plugins __path__ variable at BOTH
# volatility/plugins
# volatility/framework/plugins
# We point the volatility3.plugins __path__ variable at BOTH
# volatility3/plugins
# volatility3/framework/plugins
# in that order.
#
# This will allow our users to override any component of any plugin without monkey patching,
# but it also allows us to clear out the plugins directory to get back to proper functionality.
# This offered the greatest flexibility for users whilst allowing us to keep the core separate and clean.
#
# This means that all plugins should be imported as volatility.plugins (otherwise they'll be imported twice,
# once as volatility.plugins.NAME and once as volatility.framework.plugins.NAME). We therefore throw an error
# if anyone tries to import anything under the volatility.framework.plugins.* namespace
# This means that all plugins should be imported as volatility3.plugins (otherwise they'll be imported twice,
# once as volatility3.plugins.NAME and once as volatility3.framework.plugins.NAME). We therefore throw an error
# if anyone tries to import anything under the volatility3.framework.plugins.* namespace
#
# The remediation is to only ever import form volatility.plugins instead.
# The remediation is to only ever import form volatility3.plugins instead.
volatility/cli/__init__.py → volatility3/cli/__init__.py
+25 -24
View File
@@ -22,13 +22,13 @@ import traceback
from typing import Dict, Type, Union, Any
from urllib import parse, request
import volatility.plugins
import volatility.symbols
from volatility import framework
from volatility.cli import text_renderer, volargparse
from volatility.framework import automagic, constants, contexts, exceptions, interfaces, plugins, configuration
from volatility.framework.automagic import stacker
from volatility.framework.configuration import requirements
import volatility3.plugins
import volatility3.symbols
from volatility3 import framework
from volatility3.cli import text_renderer, volargparse
from volatility3.framework import automagic, constants, contexts, exceptions, interfaces, plugins, configuration
from volatility3.framework.automagic import stacker
from volatility3.framework.configuration import requirements
# Make sure we log everything
@@ -79,7 +79,7 @@ class CommandLine:
@classmethod
def setup_logging(cls):
# Delay the setting of vollog for those that want to import volatility.cli (issue #241)
# Delay the setting of vollog for those that want to import volatility3.cli (issue #241)
vollog.setLevel(1)
vollog.addHandler(console)
@@ -87,7 +87,7 @@ class CommandLine:
"""Executes the command line module, taking the system arguments,
determining the plugin to run and then running it."""
volatility.framework.require_interface_version(2, 0, 0)
volatility3.framework.require_interface_version(1, 0, 0)
renderers = dict([(x.name.lower(), x) for x in framework.class_subclasses(text_renderer.CLIRenderer)])
@@ -107,7 +107,7 @@ class CommandLine:
default = None,
type = str)
parser.add_argument("--parallelism",
help = "Enables parallelism (defaults to processes if no argument given)",
help = "Enables parallelism (defaults to off if no argument given)",
nargs = '?',
choices = ['processes', 'threads', 'off'],
const = 'processes',
@@ -172,12 +172,12 @@ class CommandLine:
banner_output.write("Volatility 3 Framework {}\n".format(constants.PACKAGE_VERSION))
if partial_args.plugin_dirs:
volatility.plugins.__path__ = [os.path.abspath(p)
for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH
volatility3.plugins.__path__ = [os.path.abspath(p)
for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH
if partial_args.symbol_dirs:
volatility.symbols.__path__ = [os.path.abspath(p)
for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS
volatility3.symbols.__path__ = [os.path.abspath(p)
for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS
if partial_args.log:
file_logger = logging.FileHandler(partial_args.log)
@@ -192,8 +192,8 @@ class CommandLine:
else:
console.setLevel(10 - (partial_args.verbosity - 2))
vollog.info("Volatility plugins path: {}".format(volatility.plugins.__path__))
vollog.info("Volatility symbols path: {}".format(volatility.symbols.__path__))
vollog.info("Volatility plugins path: {}".format(volatility3.plugins.__path__))
vollog.info("Volatility symbols path: {}".format(volatility3.symbols.__path__))
# Set the PARALLELISM
if partial_args.parallelism == 'processes':
@@ -208,7 +208,7 @@ class CommandLine:
# Do the initialization
ctx = contexts.Context() # Construct a blank context
failures = framework.import_files(volatility.plugins,
failures = framework.import_files(volatility3.plugins,
True) # Will not log as console's default level is WARNING
if failures:
parser.epilog = "The following plugins could not be loaded (use -vv to see why): " + \
@@ -342,7 +342,7 @@ class CommandLine:
caused_by = [
"Memory smear during acquisition (try re-acquiring if possible)",
"An intentionally invalid page lookup (operating system protection)",
"A bug in the plugin/volatility (re-run with -vvv and file a bug)"
"A bug in the plugin/volatility3 (re-run with -vvv and file a bug)"
]
else:
detail = "{} in layer {} ({})".format(hex(excp.invalid_address), excp.layer_name, excp)
@@ -350,7 +350,7 @@ class CommandLine:
"The base memory file being incomplete (try re-acquiring if possible)",
"Memory smear during acquisition (try re-acquiring if possible)",
"An intentionally invalid page lookup (operating system protection)",
"A bug in the plugin/volatility (re-run with -vvv and file a bug)"
"A bug in the plugin/volatility3 (re-run with -vvv and file a bug)"
]
elif isinstance(excp, exceptions.SymbolError):
general = "Volatility experienced a symbol-related issue:"
@@ -414,7 +414,7 @@ class CommandLine:
print("\nA translation layer requirement was not fulfilled. Please verify that:\n"
"\tA file was provided to create this layer (by -f, --single-location or by config)\n"
"\tThe file exists and is readable\n"
"\tThe necessary symbols are present and identified by volatility")
"\tThe necessary symbols are present and identified by volatility3")
def populate_config(self, context: interfaces.context.ContextInterface,
configurables_list: Dict[str, Type[interfaces.configuration.ConfigurableInterface]],
@@ -424,7 +424,7 @@ class CommandLine:
We have already determined these elements must be descended from ConfigurableInterface
Args:
context: The volatility context to operate on
context: The volatility3 context to operate on
configurables_list: A dictionary of configurable items that can be configured on the plugin
args: An object containing the arguments necessary
plugin_config_path: The path within the context's config containing the plugin's configuration
@@ -436,7 +436,8 @@ class CommandLine:
if value is not None:
if isinstance(requirement, requirements.URIRequirement):
if isinstance(value, str):
if not parse.urlparse(value).scheme:
scheme = parse.urlparse(value).scheme
if not scheme or len(scheme) <= 1:
if not os.path.exists(value):
raise FileNotFoundError(
"Non-existant file {} passed to URIRequirement".format(value))
@@ -563,11 +564,11 @@ class CommandLine:
additional["action"] = "store_true"
if "type" in additional:
del additional["type"]
elif isinstance(requirement, volatility.framework.configuration.requirements.ListRequirement):
elif isinstance(requirement, volatility3.framework.configuration.requirements.ListRequirement):
additional["type"] = requirement.element_type
nargs = '*' if requirement.optional else '+'
additional["nargs"] = nargs
elif isinstance(requirement, volatility.framework.configuration.requirements.ChoiceRequirement):
elif isinstance(requirement, volatility3.framework.configuration.requirements.ChoiceRequirement):
additional["type"] = str
additional["choices"] = requirement.choices
else:
volatility/cli/text_renderer.py → volatility3/cli/text_renderer.py
+2 -2
View File
@@ -10,8 +10,8 @@ import sys
from functools import wraps
from typing import Callable, Any, List, Tuple, Dict
from volatility.framework import interfaces, renderers
from volatility.framework.renderers import format_hints
from volatility3.framework import interfaces, renderers
from volatility3.framework.renderers import format_hints
vollog = logging.getLogger(__name__)
volatility/cli/volargparse.py → volatility3/cli/volargparse.py
View File
volatility/cli/volshell/__init__.py → volatility3/cli/volshell/__init__.py
+16 -14
View File
@@ -9,11 +9,11 @@ import os
import sys
from urllib import request
import volatility.plugins
import volatility.symbols
from volatility import cli, framework
from volatility.cli.volshell import generic, windows, linux, mac
from volatility.framework import automagic, constants, contexts, exceptions, interfaces, plugins
import volatility3.plugins
import volatility3.symbols
from volatility3 import cli, framework
from volatility3.cli.volshell import generic, windows, linux, mac
from volatility3.framework import automagic, constants, contexts, exceptions, interfaces, plugins
# Make sure we log everything
vollog = logging.getLogger()
@@ -33,6 +33,8 @@ class VolShell(cli.CommandLine):
python terminal with all the volatility support calls available.
"""
CLI_NAME = "volshell"
def __init__(self):
super().__init__()
self.output_dir = None
@@ -42,9 +44,9 @@ class VolShell(cli.CommandLine):
determining the plugin to run and then running it."""
sys.stdout.write("Volshell (Volatility 3 Framework) {}\n".format(constants.PACKAGE_VERSION))
framework.require_interface_version(2, 0, 0)
framework.require_interface_version(1, 0, 0)
parser = argparse.ArgumentParser(prog = 'volshell',
parser = argparse.ArgumentParser(prog = self.CLI_NAME,
description = "A tool for interactivate forensic analysis of memory images")
parser.add_argument("-c",
"--config",
@@ -104,15 +106,15 @@ class VolShell(cli.CommandLine):
known_args = [arg for arg in sys.argv if arg != '--help' and arg != '-h']
partial_args, _ = parser.parse_known_args(known_args)
if partial_args.plugin_dirs:
volatility.plugins.__path__ = [os.path.abspath(p)
for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH
volatility3.plugins.__path__ = [os.path.abspath(p)
for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH
if partial_args.symbol_dirs:
volatility.symbols.__path__ = [os.path.abspath(p)
for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS
volatility3.symbols.__path__ = [os.path.abspath(p)
for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS
vollog.info("Volatility plugins path: {}".format(volatility.plugins.__path__))
vollog.info("Volatility symbols path: {}".format(volatility.symbols.__path__))
vollog.info("Volatility plugins path: {}".format(volatility3.plugins.__path__))
vollog.info("Volatility symbols path: {}".format(volatility3.symbols.__path__))
if partial_args.log:
file_logger = logging.FileHandler(partial_args.log)
@@ -134,7 +136,7 @@ class VolShell(cli.CommandLine):
# Do the initialization
ctx = contexts.Context() # Construct a blank context
failures = framework.import_files(volatility.plugins,
failures = framework.import_files(volatility3.plugins,
True) # Will not log as console's default level is WARNING
if failures:
parser.epilog = "The following plugins could not be loaded (use -vv to see why): " + \
volatility/cli/volshell/generic.py → volatility3/cli/volshell/generic.py
+5 -5
View File
@@ -11,10 +11,10 @@ import sys
from typing import Any, Dict, List, Optional, Tuple, Union, Type
from urllib import request
from volatility.cli import text_renderer
from volatility.framework import renderers, interfaces, objects, plugins, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.layers import intel, physical
from volatility3.cli import text_renderer
from volatility3.framework import renderers, interfaces, objects, plugins, exceptions
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import intel, physical
try:
import capstone
@@ -26,7 +26,7 @@ except ImportError:
class Volshell(interfaces.plugins.PluginInterface):
"""Shell environment to directly interact with a memory image."""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
volatility/cli/volshell/linux.py → volatility3/cli/volshell/linux.py
+4 -4
View File
@@ -4,10 +4,10 @@
from typing import Any, List, Tuple, Union
from volatility.cli.volshell import generic
from volatility.framework import interfaces, constants
from volatility.framework.configuration import requirements
from volatility.plugins.linux import pslist
from volatility3.cli.volshell import generic
from volatility3.framework import interfaces, constants
from volatility3.framework.configuration import requirements
from volatility3.plugins.linux import pslist
class Volshell(generic.Volshell):
volatility/cli/volshell/mac.py → volatility3/cli/volshell/mac.py
+4 -4
View File
@@ -4,10 +4,10 @@
from typing import Any, List, Tuple, Union
from volatility.cli.volshell import generic
from volatility.framework import constants, interfaces
from volatility.framework.configuration import requirements
from volatility.plugins.mac import pslist
from volatility3.cli.volshell import generic
from volatility3.framework import constants, interfaces
from volatility3.framework.configuration import requirements
from volatility3.plugins.mac import pslist
class Volshell(generic.Volshell):
volatility/cli/volshell/windows.py → volatility3/cli/volshell/windows.py
+4 -4
View File
@@ -4,10 +4,10 @@
from typing import Any, List, Tuple, Union
from volatility.cli.volshell import generic
from volatility.framework import interfaces, constants
from volatility.framework.configuration import requirements
from volatility.plugins.windows import pslist
from volatility3.cli.volshell import generic
from volatility3.framework import interfaces, constants
from volatility3.framework.configuration import requirements
from volatility3.plugins.windows import pslist
class Volshell(generic.Volshell):
volatility/framework/__init__.py → volatility3/framework/__init__.py
+3 -3
View File
@@ -19,7 +19,7 @@ import logging
import os
from typing import Any, Dict, Generator, List, Tuple, Type, TypeVar
from volatility.framework import constants, interfaces
from volatility3.framework import constants, interfaces
# ##
#
@@ -120,8 +120,8 @@ def list_plugins() -> Dict[str, Type[interfaces.plugins.PluginInterface]]:
plugin_list = {}
for plugin in class_subclasses(interfaces.plugins.PluginInterface):
plugin_name = plugin.__module__ + "." + plugin.__name__
if plugin_name.startswith("volatility.plugins."):
plugin_name = plugin_name[len("volatility.plugins."):]
if plugin_name.startswith("volatility3.plugins."):
plugin_name = plugin_name[len("volatility3.plugins."):]
plugin_list[plugin_name] = plugin
return plugin_list
volatility/framework/automagic/__init__.py → volatility3/framework/automagic/__init__.py
+6 -6
View File
@@ -16,8 +16,8 @@ import sys
import traceback
from typing import List, Type, Union
from volatility.framework import class_subclasses, import_files, interfaces, constants
from volatility.framework.configuration import requirements
from volatility3.framework import class_subclasses, import_files, interfaces, constants
from volatility3.framework.configuration import requirements
vollog = logging.getLogger(__name__)
@@ -30,7 +30,7 @@ mac_automagic = ['ConstructionMagic', 'LayerStacker', 'MacBannerCache', 'MacSymb
def available(context: interfaces.context.ContextInterface) -> List[interfaces.automagic.AutomagicInterface]:
"""Returns an ordered list of all subclasses of
:class:`~volatility.framework.interfaces.automagic.AutomagicInterface`.
:class:`~volatility3.framework.interfaces.automagic.AutomagicInterface`.
The order is based on the priority attributes of the subclasses, in order to ensure the automagics are listed in
an appropriate order.
@@ -90,9 +90,9 @@ def run(automagics: List[interfaces.automagic.AutomagicInterface],
changes to the context.
Args:
automagics: A list of :class:`~volatility.framework.interfaces.automagic.AutomagicInterface` objects
context: The context (that inherits from :class:`~volatility.framework.interfaces.context.ContextInterface`) for modification
configurable: An object that inherits from :class:`~volatility.framework.interfaces.configuration.ConfigurableInterface`
automagics: A list of :class:`~volatility3.framework.interfaces.automagic.AutomagicInterface` objects
context: The context (that inherits from :class:`~volatility3.framework.interfaces.context.ContextInterface`) for modification
configurable: An object that inherits from :class:`~volatility3.framework.interfaces.configuration.ConfigurableInterface`
config_path: The path within the `context.config` for options required by the `configurable`
progress_callback: A function that takes a percentage (and an optional description) that will be called periodically
volatility/framework/automagic/construct_layers.py → volatility3/framework/automagic/construct_layers.py
+7 -7
View File
@@ -2,16 +2,16 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
"""An automagic module to use configuration data to configure and then
construct classes that fulfill the descendants of a :class:`~volatility.framewo
construct classes that fulfill the descendants of a :class:`~volatility3.framewo
rk.interfaces.configuration.ConfigurableInterface`."""
import logging
import sys
from typing import List
from volatility import framework
from volatility.framework import constants
from volatility.framework import interfaces
from volatility3 import framework
from volatility3.framework import constants
from volatility3.framework import interfaces
vollog = logging.getLogger(__name__)
@@ -19,9 +19,9 @@ vollog = logging.getLogger(__name__)
class ConstructionMagic(interfaces.automagic.AutomagicInterface):
"""Constructs underlying layers.
Class to run through the requirement tree of the :class:`~volatility.framework.interfaces.configuration.ConfigurableInterface`
Class to run through the requirement tree of the :class:`~volatility3.framework.interfaces.configuration.ConfigurableInterface`
and from the bottom of the tree upwards, attempt to construct all
:class:`~volatility.framework.interfaces.configuration.ConstructableRequirementInterface` based classes.
:class:`~volatility3.framework.interfaces.configuration.ConstructableRequirementInterface` based classes.
:warning: This `automagic` should run first to allow existing configurations to have been constructed for use by later automagic
"""
@@ -35,7 +35,7 @@ class ConstructionMagic(interfaces.automagic.AutomagicInterface):
optional = False) -> List[str]:
# Make sure we import the layers, so they can reconstructed
framework.import_files(sys.modules['volatility.framework.layers'])
framework.import_files(sys.modules['volatility3.framework.layers'])
result = [] # type: List[str]
if requirement.unsatisfied(context, config_path):
volatility/framework/automagic/linux.py → volatility3/framework/automagic/linux.py
+5 -5
View File
@@ -5,10 +5,10 @@
import logging
from typing import Optional, Tuple, Type
from volatility.framework import interfaces, constants
from volatility.framework.automagic import symbol_cache, symbol_finder
from volatility.framework.layers import intel, scanners
from volatility.framework.symbols import linux
from volatility3.framework import interfaces, constants
from volatility3.framework.automagic import symbol_cache, symbol_finder
from volatility3.framework.layers import intel, scanners
from volatility3.framework.symbols import linux
vollog = logging.getLogger(__name__)
@@ -153,5 +153,5 @@ class LinuxSymbolFinder(symbol_finder.SymbolFinder):
banner_config_key = "kernel_banner"
banner_cache = LinuxBannerCache
symbol_class = "volatility.framework.symbols.linux.LinuxKernelIntermedSymbols"
symbol_class = "volatility3.framework.symbols.linux.LinuxKernelIntermedSymbols"
find_aslr = lambda cls, *args: LinuxIntelStacker.find_aslr(*args)[1]
volatility/framework/automagic/mac.py → volatility3/framework/automagic/mac.py
+5 -5
View File
@@ -6,10 +6,10 @@ import logging
import struct
from typing import Optional
from volatility.framework import interfaces, constants, layers
from volatility.framework.automagic import symbol_cache, symbol_finder
from volatility.framework.layers import intel, scanners
from volatility.framework.symbols import mac
from volatility3.framework import interfaces, constants, layers
from volatility3.framework.automagic import symbol_cache, symbol_finder
from volatility3.framework.layers import intel, scanners
from volatility3.framework.symbols import mac
vollog = logging.getLogger(__name__)
@@ -204,4 +204,4 @@ class MacSymbolFinder(symbol_finder.SymbolFinder):
banner_config_key = 'kernel_banner'
banner_cache = MacBannerCache
find_aslr = MacIntelStacker.find_aslr
symbol_class = "volatility.framework.symbols.mac.MacKernelIntermedSymbols"
symbol_class = "volatility3.framework.symbols.mac.MacKernelIntermedSymbols"
volatility/framework/automagic/pdbscan.py → volatility3/framework/automagic/pdbscan.py
+9 -9
View File
@@ -4,19 +4,19 @@
"""A module for scanning translation layers looking for Windows PDB records
from loaded PE files.
This module contains a standalone scanner, and also a :class:`~volatility.framework.interfaces.layers.ScannerInterface`
based scanner for use within the framework by calling :func:`~volatility.framework.interfaces.layers.DataLayerInterface.scan`.
This module contains a standalone scanner, and also a :class:`~volatility3.framework.interfaces.layers.ScannerInterface`
based scanner for use within the framework by calling :func:`~volatility3.framework.interfaces.layers.DataLayerInterface.scan`.
"""
import logging
import math
import os
from typing import Any, Dict, Iterable, List, Optional, Set, Tuple, Union
from volatility.framework import constants, exceptions, interfaces, layers
from volatility.framework.configuration import requirements
from volatility.framework.layers import intel, scanners
from volatility.framework.symbols import native
from volatility.framework.symbols.windows.pdbutil import PDBUtility
from volatility3.framework import constants, exceptions, interfaces, layers
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import intel, scanners
from volatility3.framework.symbols import native
from volatility3.framework.symbols.windows.pdbutil import PDBUtility
if __name__ == "__main__":
import sys
@@ -55,7 +55,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
Args:
context: The context in which the `requirement` lives
config_path: The path within the `context` for the `requirement`'s configuration variables
requirement: The root of the requirement tree to search for :class:~`volatility.framework.interfaces.layers.TranslationLayerRequirement` objects to scan
requirement: The root of the requirement tree to search for :class:~`volatility3.framework.interfaces.layers.TranslationLayerRequirement` objects to scan
progress_callback: Means of providing the user with feedback during long processes
Returns:
@@ -105,7 +105,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
guid = kernel['GUID'],
age = kernel['age'],
pdb_name = kernel['pdb_name'],
symbol_table_class = "volatility.framework.symbols.windows.WindowsKernelIntermedSymbols",
symbol_table_class = "volatility3.framework.symbols.windows.WindowsKernelIntermedSymbols",
config_path = sub_config_path,
progress_callback = progress_callback)
else:
volatility/framework/automagic/stacker.py → volatility3/framework/automagic/stacker.py
+10 -10
View File
@@ -3,7 +3,7 @@
#
"""This module attempts to automatically stack layers.
This automagic module fulfills :class:`~volatility.framework.interfaces.configuration.TranslationLayerRequirement` that are not already fulfilled, by attempting to
This automagic module fulfills :class:`~volatility3.framework.interfaces.configuration.TranslationLayerRequirement` that are not already fulfilled, by attempting to
stack as many layers on top of each other as possible. The base/lowest layer is derived from the
"automagic.general.single_location" configuration path. Layers are then attempting in likely height order, and
once a layer successfully stacks on top of the existing layers, it is removed from the possible choices list
@@ -15,11 +15,11 @@ import sys
import traceback
from typing import Any, List, Optional, Tuple, Type
from volatility import framework
from volatility.framework import interfaces, constants
from volatility.framework.automagic import construct_layers
from volatility.framework.configuration import requirements
from volatility.framework.layers import physical
from volatility3 import framework
from volatility3.framework import interfaces, constants
from volatility3.framework.automagic import construct_layers
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import physical
vollog = logging.getLogger(__name__)
@@ -28,11 +28,11 @@ class LayerStacker(interfaces.automagic.AutomagicInterface):
"""Builds up layers in a single stack.
This class mimics the volatility 2 style of stacking address spaces. It builds up various layers based on
separate :class:`~volatility.framework.interfaces.automagic.StackerLayerInterface` classes. These classes are
separate :class:`~volatility3.framework.interfaces.automagic.StackerLayerInterface` classes. These classes are
built up based on a `stack_order` class variable each has.
This has a high priority to provide other automagic modules as complete a context/configuration tree as possible.
Upon completion it will re-call the :class:`~volatility.framework.automagic.construct_layers.ConstructionMagic`,
Upon completion it will re-call the :class:`~volatility3.framework.automagic.construct_layers.ConstructionMagic`,
so that any stacked layers are actually constructed and added to the context.
"""
# Most important automagic, must happen first!
@@ -49,7 +49,7 @@ class LayerStacker(interfaces.automagic.AutomagicInterface):
progress_callback: constants.ProgressCallback = None) -> Optional[List[str]]:
"""Runs the automagic over the configurable."""
framework.import_files(sys.modules['volatility.framework.layers'])
framework.import_files(sys.modules['volatility3.framework.layers'])
# Quick exit if we're not needed
if not requirement.unsatisfied(context, config_path):
@@ -250,7 +250,7 @@ def choose_os_stackers(plugin: Type[interfaces.plugins.PluginInterface]) -> List
plugin_first_level = plugin.__module__.split('.')[2]
# Ensure all stackers are loaded
framework.import_files(sys.modules['volatility.framework.layers'])
framework.import_files(sys.modules['volatility3.framework.layers'])
result = []
for stacker in sorted(framework.class_subclasses(interfaces.automagic.StackerLayerInterface),
volatility/framework/automagic/symbol_cache.py → volatility3/framework/automagic/symbol_cache.py
+2 -2
View File
@@ -11,8 +11,8 @@ import urllib.parse
import urllib.request
from typing import Dict, List, Optional
from volatility.framework import constants, exceptions, interfaces
from volatility.framework.symbols import intermed
from volatility3.framework import constants, exceptions, interfaces
from volatility3.framework.symbols import intermed
vollog = logging.getLogger(__name__)
volatility/framework/automagic/symbol_finder.py → volatility3/framework/automagic/symbol_finder.py
+4 -4
View File
@@ -5,10 +5,10 @@
import logging
from typing import Any, Iterable, List, Tuple, Type, Optional, Callable
from volatility.framework import interfaces, constants, layers, exceptions
from volatility.framework.automagic import symbol_cache
from volatility.framework.configuration import requirements
from volatility.framework.layers import scanners
from volatility3.framework import interfaces, constants, layers, exceptions
from volatility3.framework.automagic import symbol_cache
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import scanners
vollog = logging.getLogger(__name__)
volatility/framework/automagic/windows.py → volatility3/framework/automagic/windows.py
+6 -7
View File
@@ -30,9 +30,9 @@ import logging
import struct
from typing import Any, Generator, List, Optional, Tuple, Type
from volatility.framework import interfaces, layers, constants
from volatility.framework.configuration import requirements
from volatility.framework.layers import intel
from volatility3.framework import interfaces, layers, constants
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import intel
vollog = logging.getLogger(__name__)
@@ -225,14 +225,13 @@ class PageMapScanner(interfaces.layers.ScannerInterface):
for page_offset in range(0, len(data), 0x1000):
result = test(data, data_offset, page_offset)
if result is not None:
if result[0] < self.chunk_size:
yield (test, result[0])
yield (test, result[0])
class WintelHelper(interfaces.automagic.AutomagicInterface):
"""Windows DTB finder based on self-referential pointers.
This class adheres to the :class:`~volatility.framework.interfaces.automagic.AutomagicInterface` interface
This class adheres to the :class:`~volatility3.framework.interfaces.automagic.AutomagicInterface` interface
and both determines the directory table base of an intel layer if one hasn't been specified, and constructs
the intel layer if necessary (for example when reconstructing a pre-existing configuration).
@@ -415,7 +414,7 @@ class WinSwapLayers(interfaces.automagic.AutomagicInterface):
if swap_location:
context.config[current_layer_path] = current_layer_name
context.config[layer_loc_path] = swap_location
context.config[layer_class_path] = 'volatility.framework.layers.physical.FileLayer'
context.config[layer_class_path] = 'volatility3.framework.layers.physical.FileLayer'
# Add the requirement
new_req = requirements.TranslationLayerRequirement(name = current_layer_name,
volatility/framework/configuration/__init__.py → volatility3/framework/configuration/__init__.py
+1 -1
View File
@@ -2,4 +2,4 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
from volatility.framework.configuration import requirements
from volatility3.framework.configuration import requirements
volatility/framework/configuration/requirements.py → volatility3/framework/configuration/requirements.py
+1 -1
View File
@@ -12,7 +12,7 @@ import abc
import logging
from typing import Any, ClassVar, List, Optional, Type, Dict, Tuple
from volatility.framework import constants, interfaces
from volatility3.framework import constants, interfaces
vollog = logging.getLogger(__name__)
volatility/framework/constants/__init__.py → volatility3/framework/constants/__init__.py
+7 -7
View File
@@ -11,20 +11,20 @@ import os.path
import sys
from typing import Optional, Callable
import volatility.framework.constants.linux
import volatility.framework.constants.windows
import volatility3.framework.constants.linux
import volatility3.framework.constants.windows
PLUGINS_PATH = [
os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "plugins")),
os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "plugins"))
]
"""Default list of paths to load plugins from (volatility/plugins and volatility/framework/plugins)"""
"""Default list of paths to load plugins from (volatility3/plugins and volatility3/framework/plugins)"""
SYMBOL_BASEPATHS = [
os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "symbols")),
os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "symbols"))
]
"""Default list of paths to load symbols from (volatility/symbols and volatility/framework/symbols)"""
"""Default list of paths to load symbols from (volatility3/symbols and volatility3/framework/symbols)"""
ISF_EXTENSIONS = ['.json', '.json.xz', '.json.gz', '.json.bz2']
"""List of accepted extensions for ISF files"""
@@ -38,13 +38,13 @@ BANG = "!"
"""Constant used to delimit table names from type names when referring to a symbol"""
# We use the SemVer 2.0.0 versioning scheme
VERSION_MAJOR = 2 # Number of releases of the library with a breaking change
VERSION_MAJOR = 1 # Number of releases of the library with a breaking change
VERSION_MINOR = 0 # Number of changes that only add to the interface
VERSION_PATCH = 0 # Number of changes that do not change the interface
VERSION_SUFFIX = "-beta.1"
VERSION_SUFFIX = ""
PACKAGE_VERSION = ".".join([str(x) for x in [VERSION_MAJOR, VERSION_MINOR, VERSION_PATCH]]) + VERSION_SUFFIX
"""The canonical version of the volatility package"""
"""The canonical version of the volatility3 package"""
AUTOMAGIC_CONFIG_PATH = 'automagic'
"""The root section within the context configuration for automagic values"""
volatility/framework/constants/linux/__init__.py → volatility3/framework/constants/linux/__init__.py
View File
volatility/framework/constants/windows/__init__.py → volatility3/framework/constants/windows/__init__.py
View File
volatility/framework/contexts/__init__.py → volatility3/framework/contexts/__init__.py
+4 -4
View File
@@ -12,8 +12,8 @@ import functools
import hashlib
from typing import Callable, Dict, Iterable, List, Optional, Set, Tuple, Union
from volatility.framework import constants, interfaces, symbols, exceptions
from volatility.framework.objects import templates
from volatility3.framework import constants, interfaces, symbols, exceptions
from volatility3.framework.objects import templates
class Context(interfaces.context.ContextInterface):
@@ -25,7 +25,7 @@ class Context(interfaces.context.ContextInterface):
for creating new objects.
Other context objects can be constructed as long as they support the
:class:`~volatility.framework.interfaces.context.ContextInterface`. This is the primary context object to be used
:class:`~volatility3.framework.interfaces.context.ContextInterface`. This is the primary context object to be used
in the volatility framework. It maintains the
"""
@@ -71,7 +71,7 @@ class Context(interfaces.context.ContextInterface):
layer: The layer to be added to the memory
Raises:
volatility.framework.exceptions.LayerException: if the layer is already present, or has
volatility3.framework.exceptions.LayerException: if the layer is already present, or has
unmet dependencies
"""
self._memory.add_layer(layer)
volatility/framework/exceptions.py → volatility3/framework/exceptions.py
+1 -1
View File
@@ -10,7 +10,7 @@ size of the invalid page.
"""
from typing import Dict, Optional
from volatility.framework import interfaces
from volatility3.framework import interfaces
class VolatilityException(Exception):
volatility/framework/interfaces/__init__.py → volatility3/framework/interfaces/__init__.py
+1 -1
View File
@@ -12,5 +12,5 @@ components of volatility to write plugins.
# Import the submodules we want people to be able to use without importing them themselves
# This will also avoid namespace issues, because people can use interfaces.layers to
# avoid clashing with the layers package
from volatility.framework.interfaces import renderers, configuration, context, layers, objects, plugins, symbols, \
from volatility3.framework.interfaces import renderers, configuration, context, layers, objects, plugins, symbols, \
automagic
volatility/framework/interfaces/automagic.py → volatility3/framework/interfaces/automagic.py
+2 -2
View File
@@ -11,8 +11,8 @@ import logging
from abc import ABCMeta
from typing import Any, List, Optional, Tuple, Union, Type
from volatility.framework import interfaces, constants
from volatility.framework.configuration import requirements
from volatility3.framework import interfaces, constants
from volatility3.framework.configuration import requirements
vollog = logging.getLogger(__name__)
volatility/framework/interfaces/configuration.py → volatility3/framework/interfaces/configuration.py
+6 -6
View File
@@ -25,8 +25,8 @@ import sys
from abc import ABCMeta, abstractmethod
from typing import Any, ClassVar, Dict, Generator, Iterator, List, Optional, Type, Union, Tuple
from volatility import classproperty
from volatility.framework import constants, interfaces
from volatility3 import classproperty
from volatility3.framework import constants, interfaces
CONFIG_SEPARATOR = "."
"""Use to specify the separator between configuration hierarchies"""
@@ -292,10 +292,10 @@ class RequirementInterface(metaclass = ABCMeta):
A requirement is a means for plugins and other framework components to request specific configuration data.
Requirements can either be simple types (such as
:class:`~volatility.framework.configuration.requirements.SimpleTypeRequirement`,
:class:`~volatility.framework.configuration.requirements.IntRequirement`,
:class:`~volatility.framework.configuration.requirements.BytesRequirement` and
:class:`~volatility.framework.configuration.requirements.StringRequirement`) or complex types (such
:class:`~volatility3.framework.configuration.requirements.SimpleTypeRequirement`,
:class:`~volatility3.framework.configuration.requirements.IntRequirement`,
:class:`~volatility3.framework.configuration.requirements.BytesRequirement` and
:class:`~volatility3.framework.configuration.requirements.StringRequirement`) or complex types (such
as :class:`TranslationLayerRequirement`, :class:`SymbolTableRequirement` and :class:`ClassRequirement`
"""
volatility/framework/interfaces/context.py → volatility3/framework/interfaces/context.py
+2 -2
View File
@@ -15,7 +15,7 @@ import copy
from abc import ABCMeta, abstractmethod
from typing import Optional, Union
from volatility.framework import interfaces
from volatility3.framework import interfaces
class ContextInterface(metaclass = ABCMeta):
@@ -39,7 +39,7 @@ class ContextInterface(metaclass = ABCMeta):
def symbol_space(self) -> 'interfaces.symbols.SymbolSpaceInterface':
"""Returns the symbol_space for the context.
This object must support the :class:`~volatility.framework.interfaces.symbols.SymbolSpaceInterface`
This object must support the :class:`~volatility3.framework.interfaces.symbols.SymbolSpaceInterface`
"""
# ## Memory Functions
volatility/framework/interfaces/layers.py → volatility3/framework/interfaces/layers.py
+1 -1
View File
@@ -18,7 +18,7 @@ import types
from abc import ABCMeta, abstractmethod
from typing import Any, Callable, Dict, Iterable, List, Mapping, Optional, Tuple, Union
from volatility.framework import constants, exceptions, interfaces
from volatility3.framework import constants, exceptions, interfaces
vollog = logging.getLogger(__name__)
volatility/framework/interfaces/objects.py → volatility3/framework/interfaces/objects.py
+2 -2
View File
@@ -9,7 +9,7 @@ import collections.abc
import logging
from typing import Any, Dict, List, Mapping, Optional
from volatility.framework import constants, interfaces
from volatility3.framework import constants, interfaces
vollog = logging.getLogger(__name__)
@@ -281,7 +281,7 @@ class Template:
@property
def vol(self) -> ReadOnlyMapping:
"""Returns a volatility information object, much like the
:class:`~volatility.framework.interfaces.objects.ObjectInformation`
:class:`~volatility3.framework.interfaces.objects.ObjectInformation`
provides."""
return ReadOnlyMapping(self._vol)
volatility/framework/interfaces/plugins.py → volatility3/framework/interfaces/plugins.py
+4 -4
View File
@@ -14,8 +14,8 @@ import os
from abc import ABCMeta, abstractmethod
from typing import List, Tuple, Type
from volatility import framework
from volatility.framework import exceptions, constants, interfaces
from volatility3 import framework
from volatility3.framework import exceptions, constants, interfaces
vollog = logging.getLogger(__name__)
@@ -94,8 +94,8 @@ class PluginInterface(interfaces.configuration.ConfigurableInterface,
and configuration information in the context it is passed.
"""
# Be careful with inheritance around this
_required_framework_version = (1, 0, 0) # type: Tuple[int, int, int]
# Be careful with inheritance around this (We default to requiring a version which doesn't exist, so it must be set)
_required_framework_version = (0, 0, 0) # type: Tuple[int, int, int]
"""The _version variable is a quick way for plugins to define their current interface, it should follow SemVer rules"""
def __init__(self,
volatility/framework/interfaces/renderers.py → volatility3/framework/interfaces/renderers.py
View File
volatility/framework/interfaces/symbols.py → volatility3/framework/interfaces/symbols.py
+4 -4
View File
@@ -7,10 +7,10 @@ import collections.abc
from abc import abstractmethod, ABC
from typing import Any, Dict, Iterable, List, Optional, Tuple, Type, Mapping
from volatility.framework import constants, exceptions, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import configuration, objects
from volatility.framework.interfaces.configuration import RequirementInterface
from volatility3.framework import constants, exceptions, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import configuration, objects
from volatility3.framework.interfaces.configuration import RequirementInterface
class SymbolInterface:
volatility/framework/layers/__init__.py → volatility3/framework/layers/__init__.py
View File
volatility/framework/layers/codecs/__init__.py → volatility3/framework/layers/codecs/__init__.py
View File
volatility/framework/layers/crash.py → volatility3/framework/layers/crash.py
+3 -3
View File
@@ -6,9 +6,9 @@ import logging
import struct
from typing import Tuple, Optional
from volatility.framework import constants, exceptions, interfaces
from volatility.framework.layers import segmented
from volatility.framework.symbols import intermed
from volatility3.framework import constants, exceptions, interfaces
from volatility3.framework.layers import segmented
from volatility3.framework.symbols import intermed
vollog = logging.getLogger(__name__)
volatility/framework/layers/elf.py → volatility3/framework/layers/elf.py
+3 -3
View File
@@ -5,9 +5,9 @@ import logging
import struct
from typing import Optional
from volatility.framework import exceptions, interfaces, constants
from volatility.framework.layers import segmented
from volatility.framework.symbols import intermed
from volatility3.framework import exceptions, interfaces, constants
from volatility3.framework.layers import segmented
from volatility3.framework.symbols import intermed
vollog = logging.getLogger(__name__)
volatility/framework/layers/intel.py → volatility3/framework/layers/intel.py
+5 -4
View File
@@ -9,10 +9,10 @@ import math
import struct
from typing import Any, Dict, Iterable, List, Optional, Tuple
from volatility import classproperty
from volatility.framework import exceptions, interfaces, constants
from volatility.framework.configuration import requirements
from volatility.framework.layers import linear
from volatility3 import classproperty
from volatility3.framework import exceptions, interfaces, constants
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import linear
vollog = logging.getLogger(__name__)
@@ -247,6 +247,7 @@ class IntelPAE(Intel):
_maxphyaddr = 40
_maxvirtaddr = 32
_structure = [('page directory pointer', 2, False), ('page directory', 9, True), ('page table', 9, True)]
_direct_metadata = collections.ChainMap({'pae': True}, Intel._direct_metadata)
class Intel32e(Intel):
volatility/framework/layers/lime.py → volatility3/framework/layers/lime.py
+2 -2
View File
@@ -5,8 +5,8 @@
import struct
from typing import Optional, Tuple
from volatility.framework import exceptions, interfaces, constants
from volatility.framework.layers import segmented
from volatility3.framework import exceptions, interfaces, constants
from volatility3.framework.layers import segmented
class LimeFormatException(exceptions.LayerException):
volatility/framework/layers/linear.py → volatility3/framework/layers/linear.py
+1 -1
View File
@@ -1,7 +1,7 @@
import functools
from typing import List, Optional, Tuple, Iterable
from volatility.framework import exceptions, interfaces
from volatility3.framework import exceptions, interfaces
class LinearlyMappedLayer(interfaces.layers.TranslationLayerInterface):
volatility/framework/layers/msf.py → volatility3/framework/layers/msf.py
+5 -5
View File
@@ -4,11 +4,11 @@
import math
from typing import Optional, Dict, Any, List, Iterable, Tuple
from volatility.framework import interfaces, constants, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.layers import linear
from volatility.framework.objects import utility
from volatility.framework.symbols import intermed
from volatility3.framework import interfaces, constants, exceptions
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import linear
from volatility3.framework.objects import utility
from volatility3.framework.symbols import intermed
class PDBFormatException(exceptions.LayerException):
volatility/framework/layers/physical.py → volatility3/framework/layers/physical.py
+3 -3
View File
@@ -4,9 +4,9 @@
import threading
from typing import Any, Dict, IO, List, Optional, Union
from volatility.framework import exceptions, interfaces, constants
from volatility.framework.configuration import requirements
from volatility.framework.layers import resources
from volatility3.framework import exceptions, interfaces, constants
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import resources
class BufferDataLayer(interfaces.layers.DataLayerInterface):
volatility/framework/layers/qemu.py → volatility3/framework/layers/qemu.py
+3 -3
View File
@@ -6,9 +6,9 @@ import json
import math
from typing import Optional, Dict, Any, Tuple, List, Set
from volatility.framework import interfaces, exceptions, constants
from volatility.framework.layers import segmented
from volatility.framework.symbols import intermed
from volatility3.framework import interfaces, exceptions, constants
from volatility3.framework.layers import segmented
from volatility3.framework.symbols import intermed
class QemuSuspendLayer(segmented.NonLinearlySegmentedLayer):
volatility/framework/layers/registry.py → volatility3/framework/layers/registry.py
+7 -7
View File
@@ -5,13 +5,13 @@
import logging
from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple, Union
from volatility.framework import constants, exceptions, interfaces, objects
from volatility.framework.configuration import requirements
from volatility.framework.configuration.requirements import IntRequirement, TranslationLayerRequirement
from volatility.framework.exceptions import InvalidAddressException
from volatility.framework.layers import linear
from volatility.framework.symbols import intermed
from volatility.plugins.windows import pslist
from volatility3.framework import constants, exceptions, interfaces, objects
from volatility3.framework.configuration import requirements
from volatility3.framework.configuration.requirements import IntRequirement, TranslationLayerRequirement
from volatility3.framework.exceptions import InvalidAddressException
from volatility3.framework.layers import linear
from volatility3.framework.symbols import intermed
from volatility3.plugins.windows import pslist
vollog = logging.getLogger(__name__)
volatility/framework/layers/resources.py → volatility3/framework/layers/resources.py
+2 -2
View File
@@ -16,8 +16,8 @@ import zipfile
from typing import Optional, Any, IO
from urllib import error
from volatility import framework
from volatility.framework import constants
from volatility3 import framework
from volatility3.framework import constants
try:
import magic
volatility/framework/layers/scanners/__init__.py → volatility3/framework/layers/scanners/__init__.py
+2 -2
View File
@@ -5,8 +5,8 @@
import re
from typing import Generator, List, Tuple
from volatility.framework.interfaces import layers
from volatility.framework.layers.scanners import multiregexp
from volatility3.framework.interfaces import layers
from volatility3.framework.layers.scanners import multiregexp
class BytesScanner(layers.ScannerInterface):
volatility/framework/layers/scanners/multiregexp.py → volatility3/framework/layers/scanners/multiregexp.py
View File
volatility/framework/layers/segmented.py → volatility3/framework/layers/segmented.py
+3 -3
View File
@@ -5,9 +5,9 @@ from abc import ABCMeta, abstractmethod
from bisect import bisect_right
from typing import Any, Dict, Iterable, List, Optional, Tuple
from volatility.framework import exceptions, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.layers import linear
from volatility3.framework import exceptions, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import linear
class NonLinearlySegmentedLayer(interfaces.layers.TranslationLayerInterface, metaclass = ABCMeta):
volatility/framework/layers/vmware.py → volatility3/framework/layers/vmware.py
+4 -4
View File
@@ -5,10 +5,10 @@
import struct
from typing import Any, Dict, List, Optional
from volatility.framework import interfaces, constants, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.layers import physical, segmented, resources
from volatility.framework.symbols import native
from volatility3.framework import interfaces, constants, exceptions
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import physical, segmented, resources
from volatility3.framework.symbols import native
class VmwareFormatException(exceptions.LayerException):
volatility/framework/objects/__init__.py → volatility3/framework/objects/__init__.py
+2 -2
View File
@@ -7,8 +7,8 @@ import logging
import struct
from typing import Any, ClassVar, Dict, List, Iterable, Optional, Tuple, Type, Union as TUnion, overload
from volatility.framework import interfaces, constants
from volatility.framework.objects import templates, utility
from volatility3.framework import interfaces, constants
from volatility3.framework.objects import templates, utility
vollog = logging.getLogger(__name__)
volatility/framework/objects/templates.py → volatility3/framework/objects/templates.py
+5 -5
View File
@@ -5,7 +5,7 @@ import functools
import logging
from typing import Any, ClassVar, Dict, List, Type
from volatility.framework import interfaces, exceptions, constants
from volatility3.framework import interfaces, exceptions, constants
vollog = logging.getLogger(__name__)
@@ -44,13 +44,13 @@ class ObjectTemplate(interfaces.objects.Template):
def relative_child_offset(self, child: str) -> int:
"""Returns the relative offset of a child of the templated object (see
:class:`~volatility.framework.interfaces.objects.ObjectInterface.VolTem
:class:`~volatility3.framework.interfaces.objects.ObjectInterface.VolTem
plateProxy`)"""
return self.vol.object_class.VolTemplateProxy.relative_child_offset(self, child)
def replace_child(self, old_child: interfaces.objects.Template, new_child: interfaces.objects.Template) -> None:
"""Replaces `old_child` for `new_child` in the templated object's child
list (see :class:`~volatility.framework.interfaces.objects.ObjectInterf
list (see :class:`~volatility3.framework.interfaces.objects.ObjectInterf
ace.VolTemplateProxy`)"""
return self.vol.object_class.VolTemplateProxy.replace_child(self, old_child, new_child)
@@ -63,7 +63,7 @@ class ObjectTemplate(interfaces.objects.Template):
object_info: interfaces.objects.ObjectInformation) -> interfaces.objects.ObjectInterface:
"""Constructs the object.
Returns: an object adhereing to the :class:`~volatility.framework.interfaces.objects.ObjectInterface`
Returns: an object adhereing to the :class:`~volatility3.framework.interfaces.objects.ObjectInterface`
"""
arguments = {} # type: Dict[str, Any]
for arg in self.vol:
@@ -76,7 +76,7 @@ class ReferenceTemplate(interfaces.objects.Template):
"""Factory class that produces objects based on a delayed reference type.
Attempts to access any standard attributes of a resolved template will result in a
:class:`~volatility.framework.exceptions.SymbolError`.
:class:`~volatility3.framework.exceptions.SymbolError`.
"""
@property
volatility/framework/objects/utility.py → volatility3/framework/objects/utility.py
+1 -1
View File
@@ -4,7 +4,7 @@
from typing import Optional, Union
from volatility.framework import interfaces, objects, constants
from volatility3.framework import interfaces, objects, constants
def array_to_string(array: 'objects.Array',
volatility/framework/plugins/__init__.py → volatility3/framework/plugins/__init__.py
+3 -3
View File
@@ -3,14 +3,14 @@
#
"""All core generic plugins.
These modules should only be imported from volatility.plugins NOT
volatility.framework.plugins
These modules should only be imported from volatility3.plugins NOT
volatility3.framework.plugins
"""
import logging
from typing import List, Type
from volatility.framework import interfaces, automagic, exceptions, constants
from volatility3.framework import interfaces, automagic, exceptions, constants
vollog = logging.getLogger(__name__)
volatility/framework/plugins/banners.py → volatility3/framework/plugins/banners.py
+5 -5
View File
@@ -4,10 +4,10 @@
import logging
from typing import List
from volatility.framework import interfaces, renderers, layers
from volatility.framework.configuration import requirements
from volatility.framework.layers import scanners
from volatility.framework.renderers import format_hints
from volatility3.framework import interfaces, renderers, layers
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import scanners
from volatility3.framework.renderers import format_hints
vollog = logging.getLogger(__name__)
@@ -15,7 +15,7 @@ vollog = logging.getLogger(__name__)
class Banners(interfaces.plugins.PluginInterface):
"""Attempts to identify potential linux banners in an image"""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
volatility/framework/plugins/configwriter.py → volatility3/framework/plugins/configwriter.py
+4 -4
View File
@@ -6,9 +6,9 @@ import json
import logging
from typing import List
from volatility.framework import renderers, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility3.framework import renderers, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
vollog = logging.getLogger(__name__)
@@ -17,7 +17,7 @@ class ConfigWriter(plugins.PluginInterface):
"""Runs the automagics and both prints and outputs configuration in the
output directory."""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
volatility/framework/plugins/frameworkinfo.py → volatility3/framework/plugins/frameworkinfo.py
+4 -4
View File
@@ -1,14 +1,14 @@
from typing import List
from volatility import framework
from volatility.framework import interfaces, renderers
from volatility.framework.interfaces import plugins
from volatility3 import framework
from volatility3.framework import interfaces, renderers
from volatility3.framework.interfaces import plugins
class FrameworkInfo(plugins.PluginInterface):
"""Plugin to list the various modular components of Volatility"""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
volatility/framework/plugins/isfinfo.py → volatility3/framework/plugins/isfinfo.py
+7 -7
View File
@@ -9,12 +9,12 @@ import pathlib
import zipfile
from typing import List, Type, Any, Generator
from volatility import schemas, symbols
from volatility.framework import interfaces, renderers, constants
from volatility.framework.automagic import mac, linux, symbol_cache
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.layers import resources
from volatility3 import schemas, symbols
from volatility3.framework import interfaces, renderers, constants
from volatility3.framework.automagic import mac, linux, symbol_cache
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.layers import resources
vollog = logging.getLogger(__name__)
@@ -22,7 +22,7 @@ vollog = logging.getLogger(__name__)
class IsfInfo(plugins.PluginInterface):
"""Determines information about the currently available ISF files, or a specific one"""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
_version = (1, 0, 0)
@classmethod
volatility/framework/plugins/layerwriter.py → volatility3/framework/plugins/layerwriter.py
+11 -12
View File
@@ -5,9 +5,9 @@
import logging
from typing import List, Optional, Type
from volatility.framework import renderers, interfaces, constants, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility3.framework import renderers, interfaces, constants, exceptions
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
vollog = logging.getLogger(__name__)
@@ -17,7 +17,7 @@ class LayerWriter(plugins.PluginInterface):
default_block_size = 0x500000
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
_version = (2, 0, 0)
@classmethod
@@ -34,11 +34,12 @@ class LayerWriter(plugins.PluginInterface):
description = 'List available layers',
default = False,
optional = True),
requirements.ListRequirement(name = 'layers',
element_type = str,
description = 'Names of layer to write',
default = None,
optional = True)
requirements.ListRequirement(
name = 'layers',
element_type = str,
description = 'Names of layers to write (defaults to the highest non-mapped layer)',
default = None,
optional = True)
]
@classmethod
@@ -82,10 +83,8 @@ class LayerWriter(plugins.PluginInterface):
for name in self.context.layers:
yield 0, (name, )
else:
import pdb
pdb.set_trace()
# Choose the most recently added layer that isn't virtual
if self.config['layers'] is None:
if not self.config['layers']:
self.config['layers'] = []
for name in self.context.layers:
if not self.context.layers[name].metadata.get('mapped', False):
volatility/framework/plugins/linux/__init__.py → volatility3/framework/plugins/linux/__init__.py
+2 -2
View File
@@ -3,6 +3,6 @@
#
"""All core linux plugins.
These modules should only be imported from volatility.plugins NOT
volatility.framework.plugins
These modules should only be imported from volatility3.plugins NOT
volatility3.framework.plugins
"""
volatility/framework/plugins/linux/bash.py → volatility3/framework/plugins/linux/bash.py
+9 -9
View File
@@ -8,20 +8,20 @@ import datetime
import struct
from typing import List
from volatility.framework import constants, renderers, symbols, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.layers import scanners
from volatility.framework.objects import utility
from volatility.framework.symbols.linux.bash import BashIntermedSymbols
from volatility.plugins import timeliner
from volatility.plugins.linux import pslist
from volatility3.framework import constants, renderers, symbols, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.layers import scanners
from volatility3.framework.objects import utility
from volatility3.framework.symbols.linux.bash import BashIntermedSymbols
from volatility3.plugins import timeliner
from volatility3.plugins.linux import pslist
class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
"""Recovers bash command history from memory."""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
volatility/framework/plugins/linux/check_afinfo.py → volatility3/framework/plugins/linux/check_afinfo.py
+6 -6
View File
@@ -6,11 +6,11 @@ found in Linux's /proc file system."""
import logging
from typing import List
from volatility.framework import exceptions, interfaces, contexts
from volatility.framework import renderers
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.renderers import format_hints
from volatility3.framework import exceptions, interfaces, contexts
from volatility3.framework import renderers
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.renderers import format_hints
vollog = logging.getLogger(__name__)
@@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__)
class Check_afinfo(plugins.PluginInterface):
"""Verifies the operation function pointers of network protocols."""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
volatility/framework/plugins/linux/check_creds.py → volatility3/framework/plugins/linux/check_creds.py
+4 -4
View File
@@ -4,9 +4,9 @@
import logging
from volatility.framework import interfaces, renderers, constants
from volatility.framework.configuration import requirements
from volatility.plugins.linux import pslist
from volatility3.framework import interfaces, renderers, constants
from volatility3.framework.configuration import requirements
from volatility3.plugins.linux import pslist
vollog = logging.getLogger(__name__)
@@ -14,7 +14,7 @@ vollog = logging.getLogger(__name__)
class Check_creds(interfaces.plugins.PluginInterface):
"""Checks if any processes are sharing credential structures"""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls):
volatility/framework/plugins/linux/check_idt.py → volatility3/framework/plugins/linux/check_idt.py
+6 -6
View File
@@ -5,11 +5,11 @@
import logging
from typing import List
from volatility.framework import interfaces, renderers, contexts, symbols
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import linux
from volatility.plugins.linux import lsmod
from volatility3.framework import interfaces, renderers, contexts, symbols
from volatility3.framework.configuration import requirements
from volatility3.framework.renderers import format_hints
from volatility3.framework.symbols import linux
from volatility3.plugins.linux import lsmod
vollog = logging.getLogger(__name__)
@@ -17,7 +17,7 @@ vollog = logging.getLogger(__name__)
class Check_idt(interfaces.plugins.PluginInterface):
""" Checks if the IDT has been altered """
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
volatility/framework/plugins/linux/check_modules.py → volatility3/framework/plugins/linux/check_modules.py
+7 -7
View File
@@ -5,12 +5,12 @@
import logging
from typing import List
from volatility.framework import interfaces, renderers, exceptions, constants, contexts
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.plugins.linux import lsmod
from volatility3.framework import interfaces, renderers, exceptions, constants, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.plugins.linux import lsmod
vollog = logging.getLogger(__name__)
@@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__)
class Check_modules(plugins.PluginInterface):
"""Compares module list to sysfs info, if available"""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
volatility/framework/plugins/linux/check_syscall.py → volatility3/framework/plugins/linux/check_syscall.py
+6 -6
View File
@@ -6,11 +6,11 @@ found in Linux's /proc file system."""
import logging
from typing import List
from volatility.framework import exceptions, interfaces, contexts
from volatility.framework import renderers, constants
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.renderers import format_hints
from volatility3.framework import exceptions, interfaces, contexts
from volatility3.framework import renderers, constants
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.renderers import format_hints
vollog = logging.getLogger(__name__)
@@ -25,7 +25,7 @@ except ImportError:
class Check_syscall(plugins.PluginInterface):
"""Check system call table for hooks."""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
volatility/framework/plugins/linux/elfs.py → volatility3/framework/plugins/linux/elfs.py
+7 -7
View File
@@ -6,18 +6,18 @@ found in Linux's /proc file system."""
from typing import List
from volatility.framework import renderers, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.plugins.linux import pslist
from volatility3.framework import renderers, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.plugins.linux import pslist
class Elfs(plugins.PluginInterface):
"""Lists all memory mapped ELF files for all processes."""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
volatility/framework/plugins/linux/keyboard_notifiers.py → volatility3/framework/plugins/linux/keyboard_notifiers.py
+6 -6
View File
@@ -4,11 +4,11 @@
import logging
from volatility.framework import interfaces, renderers, contexts, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import linux
from volatility.plugins.linux import lsmod
from volatility3.framework import interfaces, renderers, contexts, exceptions
from volatility3.framework.configuration import requirements
from volatility3.framework.renderers import format_hints
from volatility3.framework.symbols import linux
from volatility3.plugins.linux import lsmod
vollog = logging.getLogger(__name__)
@@ -16,7 +16,7 @@ vollog = logging.getLogger(__name__)
class Keyboard_notifiers(interfaces.plugins.PluginInterface):
"""Parses the keyboard notifier call chain"""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls):
volatility/framework/plugins/linux/lsmod.py → volatility3/framework/plugins/linux/lsmod.py
+7 -7
View File
@@ -7,12 +7,12 @@ found in Linux's /proc file system."""
import logging
from typing import List, Iterable
from volatility.framework import contexts
from volatility.framework import exceptions, renderers, constants, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility3.framework import contexts
from volatility3.framework import exceptions, renderers, constants, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
vollog = logging.getLogger(__name__)
@@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__)
class Lsmod(plugins.PluginInterface):
"""Lists loaded kernel modules."""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
_version = (1, 0, 0)
@classmethod
volatility/framework/plugins/linux/lsof.py → volatility3/framework/plugins/linux/lsof.py
+7 -7
View File
@@ -6,12 +6,12 @@ found in Linux's /proc file system."""
import logging
from typing import List
from volatility.framework import renderers, interfaces, constants
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.symbols import linux
from volatility.plugins.linux import pslist
from volatility3.framework import renderers, interfaces, constants
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.symbols import linux
from volatility3.plugins.linux import pslist
vollog = logging.getLogger(__name__)
@@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__)
class Lsof(plugins.PluginInterface):
"""Lists all memory maps for all processes."""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
volatility/framework/plugins/linux/malfind.py → volatility3/framework/plugins/linux/malfind.py
+7 -7
View File
@@ -4,18 +4,18 @@
from typing import List
from volatility.framework import constants, interfaces
from volatility.framework import renderers
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.plugins.linux import pslist
from volatility3.framework import constants, interfaces
from volatility3.framework import renderers
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.plugins.linux import pslist
class Malfind(interfaces.plugins.PluginInterface):
"""Lists process memory ranges that potentially contain injected code."""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
volatility/framework/plugins/linux/proc.py → volatility3/framework/plugins/linux/proc.py
+7 -7
View File
@@ -4,18 +4,18 @@
"""A module containing a collection of plugins that produce data typically
found in Linux's /proc file system."""
from volatility.framework import renderers
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.plugins.linux import pslist
from volatility3.framework import renderers
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.plugins.linux import pslist
class Maps(plugins.PluginInterface):
"""Lists all memory maps for all processes."""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls):
volatility/framework/plugins/linux/pslist.py → volatility3/framework/plugins/linux/pslist.py
+4 -4
View File
@@ -4,15 +4,15 @@
from typing import Callable, Iterable, List, Any
from volatility.framework import renderers, interfaces, contexts
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
from volatility3.framework import renderers, interfaces, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
class PsList(interfaces.plugins.PluginInterface):
"""Lists the processes present in a particular linux memory image."""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
_version = (1, 0, 0)
volatility/framework/plugins/linux/pstree.py → volatility3/framework/plugins/linux/pstree.py
+3 -3
View File
@@ -2,15 +2,15 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
from volatility.framework.objects import utility
from volatility.plugins.linux import pslist
from volatility3.framework.objects import utility
from volatility3.plugins.linux import pslist
class PsTree(pslist.PsList):
"""Plugin for listing processes in a tree based on their parent process
ID."""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
volatility/framework/plugins/linux/tty_check.py → volatility3/framework/plugins/linux/tty_check.py
+8 -8
View File
@@ -5,13 +5,13 @@
import logging
from typing import List
from volatility.framework import interfaces, renderers, exceptions, constants, contexts
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import linux
from volatility.plugins.linux import lsmod
from volatility3.framework import interfaces, renderers, exceptions, constants, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.framework.symbols import linux
from volatility3.plugins.linux import lsmod
vollog = logging.getLogger(__name__)
@@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__)
class tty_check(plugins.PluginInterface):
"""Checks tty devices for hooks"""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
volatility/framework/plugins/mac/__init__.py → volatility3/framework/plugins/mac/__init__.py
View File
volatility/framework/plugins/mac/bash.py → volatility3/framework/plugins/mac/bash.py
+9 -9
View File
@@ -7,20 +7,20 @@ found in mac's /proc file system."""
import datetime
import struct
from volatility.framework import constants, renderers, symbols
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.layers import scanners
from volatility.framework.objects import utility
from volatility.framework.symbols.linux.bash import BashIntermedSymbols
from volatility.plugins import timeliner
from volatility.plugins.mac import pslist
from volatility3.framework import constants, renderers, symbols
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.layers import scanners
from volatility3.framework.objects import utility
from volatility3.framework.symbols.linux.bash import BashIntermedSymbols
from volatility3.plugins import timeliner
from volatility3.plugins.mac import pslist
class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
"""Recovers bash command history from memory."""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls):
volatility/framework/plugins/mac/check_syscall.py → volatility3/framework/plugins/mac/check_syscall.py
+8 -8
View File
@@ -4,13 +4,13 @@
import logging
from typing import List
from volatility.framework import exceptions, interfaces
from volatility.framework import renderers, contexts
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import mac
from volatility.plugins.mac import lsmod
from volatility3.framework import exceptions, interfaces
from volatility3.framework import renderers, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.renderers import format_hints
from volatility3.framework.symbols import mac
from volatility3.plugins.mac import lsmod
vollog = logging.getLogger(__name__)
@@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__)
class Check_syscall(plugins.PluginInterface):
"""Check system call table for hooks."""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
volatility/framework/plugins/mac/check_sysctl.py → volatility3/framework/plugins/mac/check_sysctl.py
+11 -11
View File
@@ -4,15 +4,15 @@
import logging
from typing import List
import volatility
from volatility.framework import exceptions, interfaces
from volatility.framework import renderers, contexts
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import mac
from volatility.plugins.mac import lsmod
import volatility3
from volatility3.framework import exceptions, interfaces
from volatility3.framework import renderers, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.framework.symbols import mac
from volatility3.plugins.mac import lsmod
vollog = logging.getLogger(__name__)
@@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__)
class Check_sysctl(plugins.PluginInterface):
"""Check sysctl handlers for hooks."""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -55,7 +55,7 @@ class Check_sysctl(plugins.PluginInterface):
return var_str
def _process_sysctl_list(self, kernel, sysctl_list, recursive = 0):
if type(sysctl_list) == volatility.framework.objects.Pointer:
if type(sysctl_list) == volatility3.framework.objects.Pointer:
sysctl_list = sysctl_list.dereference().cast("sysctl_oid_list")
sysctl = sysctl_list.slh_first
volatility/framework/plugins/mac/check_trap_table.py → volatility3/framework/plugins/mac/check_trap_table.py
+8 -8
View File
@@ -5,13 +5,13 @@
import logging
from typing import List
from volatility.framework import exceptions, interfaces
from volatility.framework import renderers, contexts
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import mac
from volatility.plugins.mac import lsmod
from volatility3.framework import exceptions, interfaces
from volatility3.framework import renderers, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.renderers import format_hints
from volatility3.framework.symbols import mac
from volatility3.plugins.mac import lsmod
vollog = logging.getLogger(__name__)
@@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__)
class Check_trap_table(plugins.PluginInterface):
"""Check mach trap table for hooks."""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
volatility/framework/plugins/mac/ifconfig.py → volatility3/framework/plugins/mac/ifconfig.py
+6 -6
View File
@@ -1,17 +1,17 @@
# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
from volatility.framework import exceptions, renderers, contexts
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.symbols import mac
from volatility3.framework import exceptions, renderers, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.symbols import mac
class Ifconfig(plugins.PluginInterface):
"""Lists loaded kernel modules"""
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls):
volatility/framework/plugins/mac/kauth_listeners.py → volatility3/framework/plugins/mac/kauth_listeners.py
+7 -7
View File
@@ -2,18 +2,18 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
from volatility.framework import renderers, interfaces, contexts
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import mac
from volatility.plugins.mac import lsmod, kauth_scopes
from volatility3.framework import renderers, interfaces, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.framework.symbols import mac
from volatility3.plugins.mac import lsmod, kauth_scopes
class Kauth_listeners(interfaces.plugins.PluginInterface):
""" Lists kauth listeners and their status """
_required_framework_version = (2, 0, 0)
_required_framework_version = (1, 0, 0)
@classmethod
def get_requirements(cls):

Some files were not shown because too many files have changed in this diff Show More