diff --git a/.github/workflows/build-pypi.yml b/.github/workflows/build-pypi.yml new file mode 100644 index 000000000..77fe26931 --- /dev/null +++ b/.github/workflows/build-pypi.yml @@ -0,0 +1,42 @@ +name: build-pypi + +on: + push: + branches: + - stable + - develop + - 'release/**' + + pull_request: + branches: + - stable + - 'release/**' + +jobs: + + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v2 + + - name: Set up Python 3.x + uses: actions/setup-python@v2 + with: + python-version: '3.x' + + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install setuptools wheel + + - name: Build PyPi packages + run: | + python setup.py sdist --formats=gztar,zip + python setup.py bdist_wheel + + - name: Archive dist + uses: actions/upload-artifact@v2 + with: + name: volatility3-pypi + path: | + dist/ diff --git a/.gitignore b/.gitignore index 448d08dbd..c6da33754 100644 --- a/.gitignore +++ b/.gitignore @@ -4,7 +4,7 @@ __pycache__ # Sphinx generated files doc/build -doc/source/volatility.* +doc/source/volatility3.* # Pycharm/PyDev development files workspace.xml @@ -14,14 +14,14 @@ workspace.xml # Manually generated files .mypy_cache stubs -volatility/symbols/linux* -volatility/symbols/windows* -volatility/symbols/mac* +volatility3/symbols/linux* +volatility3/symbols/windows* +volatility3/symbols/mac* # Mac metadata files .DS_Store -# Volatility's config +# Volatility's config config*.json # Pyinstaller files diff --git a/MANIFEST.in b/MANIFEST.in index 4e5bbf6a1..504c7d89a 100644 --- a/MANIFEST.in +++ b/MANIFEST.in @@ -2,5 +2,5 @@ prune development include * .* include doc/make.bat doc/Makefile recursive-include doc/source * -recursive-include volatility *.json -recursive-exclude doc/source volatility*.rst +recursive-include volatility3 *.json +recursive-exclude doc/source volatility3.*.rst diff --git a/README.md b/README.md index 1da1d4bdf..f48bf728f 100644 --- a/README.md +++ b/README.md @@ -77,7 +77,7 @@ The hashes to verify whether any of the symbol pack files have downloaded succes -Symbol tables zip files must be placed, as named, into the `volatility/symbols` directory (or just the symbols directory next to the executable file). +Symbol tables zip files must be placed, as named, into the `volatility3/symbols` directory (or just the symbols directory next to the executable file). Windows symbols that cannot be found will be queried, downloaded, generated and cached. Mac and Linux symbol tables must be manually produced by a tool such as [dwarf2json](https://github.com/volatilityfoundation/dwarf2json). diff --git a/development/schema_validate.py b/development/schema_validate.py index 00a74868a..ece56cdec 100644 --- a/development/schema_validate.py +++ b/development/schema_validate.py @@ -17,7 +17,7 @@ logger = logging.getLogger("") logger.addHandler(console) logger.setLevel(logging.DEBUG) -from volatility import schemas +from volatility3 import schemas if __name__ == '__main__': parser = argparse.ArgumentParser("Validates ") diff --git a/doc/Makefile b/doc/Makefile index ffbbdf26e..2e1d1408a 100644 --- a/doc/Makefile +++ b/doc/Makefile @@ -15,7 +15,7 @@ help: # Ensure we clean the autodoc files when we clean clean: - -rm source/volatility.*.rst + -rm source/volatility3.*.rst @$(SPHINXBUILD) -M clean "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O) # Catch-all target: route all unknown targets to Sphinx using the new diff --git a/doc/source/basics.rst b/doc/source/basics.rst index 77dedf63b..d493c61b3 100644 --- a/doc/source/basics.rst +++ b/doc/source/basics.rst @@ -7,7 +7,7 @@ Volatility splits memory analysis down to several components: * Templates and Objects * Symbol Tables -Volatility 3 stores all of these within a :py:class:`Context `, +Volatility 3 stores all of these within a :py:class:`Context `, which acts as a container for all the various layers and tables necessary to conduct memory analysis. Memory layers @@ -21,8 +21,8 @@ two other sources. These are typically handled by programs that process file fo processor, but these are all translations (either in the geometric or linguistic sense) of the original data. In Volatility 3 this is represented by a directed graph, whose end nodes are -:py:class:`DataLayers ` and whose internal nodes are -specifically called a :py:class:`TranslationLayer `. +:py:class:`DataLayers ` and whose internal nodes are +specifically called a :py:class:`TranslationLayer `. In this way, a raw memory image in the LiME file format and a page file can be combined to form a single Intel virtual memory layer. When requesting addresses from the Intel layer, it will use the Intel memory mapping algorithm, along with the address of the directory table base or page table map, to translate that @@ -39,17 +39,17 @@ Templates and Objects Once we can address contiguous chunks of memory with a means to translate a virtual address (as seen by the programs) into the actual data used by the processor, we can start pulling out -:py:class:`Objects ` by taking a -:py:class:`~volatility.framework.interfaces.objects.Template` and constructing -it on the memory layer at a specific offset. A :py:class:`~volatility.framework.interfaces.objects.Template` contains +:py:class:`Objects ` by taking a +:py:class:`~volatility3.framework.interfaces.objects.Template` and constructing +it on the memory layer at a specific offset. A :py:class:`~volatility3.framework.interfaces.objects.Template` contains all the information you can know about the structure of the object without actually being populated by any data. -As such a :py:class:`~volatility.framework.interfaces.objects.Template` can tell you the size of a structure and its +As such a :py:class:`~volatility3.framework.interfaces.objects.Template` can tell you the size of a structure and its members, how far into the structure a particular member lives and potentially what various values in that field would mean, but not what resides in a particular member. -Using a :py:class:`~volatility.framework.interfaces.objects.Template` on a memory layer at a particular offset, an -:py:class:`Object ` can be constructed. In Volatility 3, once an -:py:class:`Object ` has been created, the data has been read from the +Using a :py:class:`~volatility3.framework.interfaces.objects.Template` on a memory layer at a particular offset, an +:py:class:`Object ` can be constructed. In Volatility 3, once an +:py:class:`Object ` has been created, the data has been read from the layer and is not read again. An object allows its members to be interrogated and in particular allows pointers to be followed, providing easy access to the data contained in the object. @@ -62,23 +62,23 @@ Symbol Tables ------------- Most compiled programs know of their own templates, and define the structure (and location within the program) of these -templates as a :py:class:`Symbol `. A -:py:class:`Symbol ` is often an address and a template and can +templates as a :py:class:`Symbol `. A +:py:class:`Symbol ` is often an address and a template and can be used to refer to either independently. Lookup tables of these symbols are often produced as debugging information alongside the compilation of the program. Volatility 3 provides access to these through a -:py:class:`SymbolTable `, many of which can be collected -within a :py:class:`~volatility.framework.contexts.Context` as a :py:class:`SymbolSpace `. -A :py:class:`~volatility.framework.contexts.Context` can store only one :py:class:`~volatility.framework.symbols.SymbolSpace` -at a time, although a :py:class:`~volatility.framework.symbols.SymbolSpace` can store as -many :py:class:`~volatility.framework.symbols.SymbolTable` items as necessary. +:py:class:`SymbolTable `, many of which can be collected +within a :py:class:`~volatility3.framework.contexts.Context` as a :py:class:`SymbolSpace `. +A :py:class:`~volatility3.framework.contexts.Context` can store only one :py:class:`~volatility.framework.symbols.SymbolSpace` +at a time, although a :py:class:`~volatility3.framework.symbols.SymbolSpace` can store as +many :py:class:`~volatility3.framework.symbols.SymbolTable` items as necessary. Volatility 3 uses the de facto naming convention for symbols of `module!symbol` to refer to them. It reads them from its own JSON formatted file, which acts as a common intermediary between Windows PDB files, Linux DWARF files, other symbol formats and the internal Python format that Volatility 3 uses to represent -a :py:class:`~volatility.framework.interfaces.objects.Template` or -a :py:class:`Symbol `. +a :py:class:`~volatility3.framework.interfaces.objects.Template` or +a :py:class:`Symbol `. -.. note:: Volatility 2's name for a :py:class:`~volatility.framework.symbols.SymbolSpace` was a profile, but it could +.. note:: Volatility 2's name for a :py:class:`~volatility3.framework.symbols.SymbolSpace` was a profile, but it could not differentiate between symbols from different modules and required special handling for 32-bit programs that used Wow64 on Windows. This meant that all symbols lived in a single namespace with the possibility of symbol name collisions. It read the symbols using a format called *vtypes*, written in Python code directly. @@ -88,18 +88,18 @@ Plugins ------- A plugin acts as a means of requesting data from the user interface (and so the user) and then using it to carry out a -specific form of analysis on the :py:class:`Context ` +specific form of analysis on the :py:class:`Context ` (containing whatever symbol tables and memory layers it may). The means of communication between the user interface and -the library is the configuration tree, which is used by components within the :py:class:`~volatility.framework.contexts.Context` +the library is the configuration tree, which is used by components within the :py:class:`~volatility3.framework.contexts.Context` to store configurable data. After the plugin has been run, it then returns the results in a specific format known as a -:py:class:`~volatility.framework.interfaces.renderers.TreeGrid`. This ensures that the data can be handled by consumers of +:py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`. This ensures that the data can be handled by consumers of the library, without knowing exactly what the data is or how it's formatted. Output Renderers ---------------- User interfaces can choose how best to present the output of the results to their users. The library always responds from -every plugin with a :py:class:`~volatility.framework.renderers.TreeGrid`, and the user interface can then determine how +every plugin with a :py:class:`~volatility3.framework.renderers.TreeGrid`, and the user interface can then determine how best to display it. For the Command Line Interface, that might be via text output as a table, or it might output to an SQLite database or a CSV file. For a web interface, the best output is probably as JSON where it could be displayed as a table, or inserted into a database like Elastic Search and trawled using an existing frontend such as Kibana. @@ -111,9 +111,9 @@ Configuration Tree ------------------ The configuration tree acts as the interface between the calling program and Volatility 3 library. Elements of the -library (such as a :py:class:`Plugin `, -a :py:class:`TranslationLayer `, -an :py:class:`Automagic `, etc.) can use the configuration +library (such as a :py:class:`Plugin `, +a :py:class:`TranslationLayer `, +an :py:class:`Automagic `, etc.) can use the configuration tree to inform the calling program of the options they require and/or optionally support, and allows the calling program to provide that information when the library is then called. @@ -122,7 +122,7 @@ Automagic There are certain setup tasks that establish the context in a way favorable to a plugin before it runs, removing several tasks that are repetitive and also easy to get wrong. These are called -:py:class:`Automagic `, since they do things like magically +:py:class:`Automagic `, since they do things like magically taking a raw memory image and automatically providing the plugin with an appropriate Intel translation layer and an accurate symbol table without either the plugin or the calling program having to specify all the necessary details. diff --git a/doc/source/complex-plugin.rst b/doc/source/complex-plugin.rst index 81a3fdc00..f06b398e8 100644 --- a/doc/source/complex-plugin.rst +++ b/doc/source/complex-plugin.rst @@ -6,17 +6,17 @@ which are discussed below. Writing Reusable Methods ------------------------ -Classes which inherit from :py:class:`~volatility.framework.interfaces.plugins.PluginInterface` all have a :py:meth:`run()` method -which takes no parameters and will return a :py:class:`~volatility.framework.interfaces.renderers.TreeGrid`. Since most useful +Classes which inherit from :py:class:`~volatility3.framework.interfaces.plugins.PluginInterface` all have a :py:meth:`run()` method +which takes no parameters and will return a :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`. Since most useful functions are parameterized, to provide parameters to a plugin the `configuration` for the context must be appropriately manipulated. There is scope for this, in order to run multiple plugins (see `Writing plugins that run other plugins`) but a much simpler method is to provide a parameterized `classmethod` within the plugin, which will allow the method to yield whatever kind of output it will generate and take whatever parameters it might need. This is how processes are listed, which is an often used function. The code lives within the -:py:class:`~volatility.plugins.windows.pslist.PsList` plugin but can be used by other plugins by providing the +:py:class:`~volatility3.plugins.windows.pslist.PsList` plugin but can be used by other plugins by providing the appropriate parameters (see -:py:meth:`~volatility.plugins.windows.pslist.PsList.list_processes`). +:py:meth:`~volatility3.plugins.windows.pslist.PsList.list_processes`). It is up to the author of a plugin to validate that any required plugins are present and are the appropriate version. Writing plugins that run other plugins @@ -34,7 +34,7 @@ available plugins that feature a Timeliner interface). This can be achieved wit This code will first generate suitable automagics for running against the context. Unfortunately this must be re-run for each plugin in order to populate the context's configuration correctly based on the plugin's requirements (which may vary between plugins). Once the automagics have been constructed, the plugin can be instantiated using the helper function -:py:func:`~volatility.framework.plugins.construct_plugin` providing: +:py:func:`~volatility3.framework.plugins.construct_plugin` providing: * the base context (containing the configuration and any already loaded layers or symbol tables), * the plugin class to run, @@ -43,7 +43,7 @@ between plugins). Once the automagics have been constructed, the plugin can be * an open method for the plugin to create files during the run With the constructed plugin, it can either be run by calling its -:py:meth:`~volatility.framework.interfaces.plugins.PluginInterface.run` method, or any other known method can +:py:meth:`~volatility3.framework.interfaces.plugins.PluginInterface.run` method, or any other known method can be invoked on it. Writing plugins that output files @@ -55,7 +55,7 @@ an abstraction layer is used. The user interface specifies an open_method (which is actually a class constructor that can double as a python ContextManager, so it can be used by the python `with` keyword). This is set on the plugin using `plugin.set_open_method` and can then be called or accessed using `plugin.open(preferred_filename)`. There are no additional options -that can be set on the filename, and a :py:class:`~volatility.framework.interfaces.plugins.FileHandlerInterface` is the result. +that can be set on the filename, and a :py:class:`~volatility3.framework.interfaces.plugins.FileHandlerInterface` is the result. This mimics an `IO[bytes]` object, which closely mimics a standard python file-like object. As such code for outputting to a file would be expected to look something like: @@ -73,10 +73,10 @@ closed to allow the preferred filename to be changed (or data to be added/modifi Writing Scanners ---------------- -Scanners are objects that adhere to the :py:class:`~volatility.framework.interfaces.layers.ScannerInterface`. They are -passed to the :py:meth:`~volatility.framework.interfaces.layers.TranslationLayerInterface.scan` method on layers which will +Scanners are objects that adhere to the :py:class:`~volatility3.framework.interfaces.layers.ScannerInterface`. They are +passed to the :py:meth:`~volatility3.framework.interfaces.layers.TranslationLayerInterface.scan` method on layers which will divide the provided range of sections (or the entire layer -if none are provided) and call the :py:meth:`~volatility.framework.interfaces.layers.ScannerInterface`'s call method +if none are provided) and call the :py:meth:`~volatility3.framework.interfaces.layers.ScannerInterface`'s call method method with each chunk as a parameter, ensuring a suitable amount of overlap (as defined by the scanner). The offset of the chunk, within the layer, is also provided as a parameter. @@ -96,7 +96,7 @@ Writing/Using Intermediate Symbol Format Files ---------------------------------------------- It can occasionally be useful to create a data file containing the static structures that can create a -:py:class:`~volatility.framework.interfaces.objects.Template` to be instantiated on a layer. +:py:class:`~volatility3.framework.interfaces.objects.Template` to be instantiated on a layer. Volatility has all the machinery necessary to construct these for you from properly formatted JSON data. The JSON format is documented by the JSON schema files located in schemas. These are versioned using standard .so @@ -115,7 +115,7 @@ Constructing an appropriate file, the file can be loaded into a symbol table as table_name = intermed.IntermediateSymbolTable.create(context, config_path, 'sub_path', 'filename') -This code will load a JSON file from one of the standard symbol paths (volatility/symbols and volatility/framework/symbols) +This code will load a JSON file from one of the standard symbol paths (volatility3/symbols and volatility3/framework/symbols) under the additional directory sub_path, with a name matching filename.json (the extension should not be included in the filename). @@ -136,7 +136,7 @@ Another useful parameter is `table_mapping` which allows for type referenced ins table_mapping = {'one_table': 'another_table'}) The last parameter that can be used is called `class_types` which allows a particular structure to be instantiated on -a class other than :py:class:`~volatility.framework.objects.StructType`, allowing for additional methods to be defined +a class other than :py:class:`~volatility3.framework.objects.StructType`, allowing for additional methods to be defined and associated with the type. The table name can then by used to access the constructed table from the context, such as: @@ -152,7 +152,7 @@ Translation layers offer a way for data to be translated from a higher (domain) The main method that must be overloaded for a translation layer is the `mapping` method. Usually this is a linear mapping whereby a value at an offset in the domain maps directly to an offset in the range. -Most new layers should inherit from :py:class:`~volatility.framework.layers.linear.LinearlyMappedLayer` where they +Most new layers should inherit from :py:class:`~volatility3.framework.layers.linear.LinearlyMappedLayer` where they can define a mapping method as follows: .. code-block:: python @@ -182,8 +182,8 @@ of data. Each chunk contains the following information, in order: An example (and the most common layer encountered in memory forensics) would be an Intel layer, which models the intel page mapping system. Based on a series of tables stored within the layer itself, an intel layer can convert a virtual -address to a physical address. It should be noted that intel layers are surjective in that a single virtual address can -map to multiple physical addresses, but a single virtual address can only ever map to a single physical address. +address to a physical address. It should be noted that intel layers allow multiple virtual addresses to map to the +same physical address (but a single virtual address cannot ever map to more than one physical address). As a simple example, in a virtual layer which looks like `abracadabra` but maps to a physical layer that looks like `abcdr`, requesting `mapping(5, 4)` would return: @@ -205,7 +205,7 @@ This mechanism also allowed for some minor optimization in scanning such a layer scanning of layers be needed, please refer to the Layer Scanning page. Whilst it may seem as though some of the data seems redundant (the length values are always the same) this is not the -case for :py:class:`~volatility.framework.layers.segmented.NonLinearlySegmentedLayer`. These layers do not guarantee +case for :py:class:`~volatility3.framework.layers.segmented.NonLinearlySegmentedLayer`. These layers do not guarantee that each domain address maps directly to a range address, and in fact can carry out processing on the data. These layers are most commonly encountered as compression or encryption layers (whereby a domain address may map into a chunk of the range, but not directly). In this instance, the mapping will likely define additional methods that can @@ -285,8 +285,8 @@ Writing new Templates and Objects --------------------------------- In most cases, a whole new type of object is unnecessary. It will usually be derived from an -:py:class:`~volatility.framework.objects.StructType` (which is itself just another name for a -:py:class:`~volatility.framework.objects.AggregateType`, but it's better to use `StructType` for readability). +:py:class:`~volatility3.framework.objects.StructType` (which is itself just another name for a +:py:class:`~volatility3.framework.objects.AggregateType`, but it's better to use `StructType` for readability). This can be used as a class override for a particular symbol table, so that an existing structure can be augmented with additional methods. An example of this would be: @@ -300,27 +300,27 @@ This will mean that when a specific structure is loaded from the symbol_space, i `StructType`, but instead is instantiated using the NewStructureClass, meaning new methods can be called directly on it. If the situation really calls for an entirely new object, that isn't covered by one of the existing -:py:class:`~volatility.framework.objects.PrimativeObject` objects (such as -:py:class:`~volatility.framework.objects.Integer`, -:py:class:`~volatility.framework.objects.Boolean`, -:py:class:`~volatility.framework.objects.Float`, -:py:class:`~volatility.framework.objects.Char`, -:py:class:`~volatility.framework.objects.Bytes`) +:py:class:`~volatility3.framework.objects.PrimativeObject` objects (such as +:py:class:`~volatility3.framework.objects.Integer`, +:py:class:`~volatility3.framework.objects.Boolean`, +:py:class:`~volatility3.framework.objects.Float`, +:py:class:`~volatility3.framework.objects.Char`, +:py:class:`~volatility3.framework.objects.Bytes`) or the other builtins (such as -:py:class:`~volatility.framework.objects.Array`, -:py:class:`~volatility.framework.objects.Bitfield`, -:py:class:`~volatility.framework.objects.Enumeration`, -:py:class:`~volatility.framework.objects.Pointer`, -:py:class:`~volatility.framework.objects.String`, -:py:class:`~volatility.framework.objects.Void`) then you can review the following information about defining an entirely +:py:class:`~volatility3.framework.objects.Array`, +:py:class:`~volatility3.framework.objects.Bitfield`, +:py:class:`~volatility3.framework.objects.Enumeration`, +:py:class:`~volatility3.framework.objects.Pointer`, +:py:class:`~volatility3.framework.objects.String`, +:py:class:`~volatility3.framework.objects.Void`) then you can review the following information about defining an entirely new object. -All objects must inherit from :py:class:`~volatility.framework.interfaces.objects.ObjectInterface` which defines a -constructor that takes a context, a `type_name`, an :py:class:`~volatility.framework.interfaces.objects.ObjectInformation` +All objects must inherit from :py:class:`~volatility3.framework.interfaces.objects.ObjectInterface` which defines a +constructor that takes a context, a `type_name`, an :py:class:`~volatility3.framework.interfaces.objects.ObjectInformation` object and then can accept additional keywords (which will not necessarily be provided if the object is constructed from a JSON reference). -The :py:class:`~volatility.framework.interfaces.objects.ObjectInformation` class contains all the basic elements that +The :py:class:`~volatility3.framework.interfaces.objects.ObjectInformation` class contains all the basic elements that define an object, which include: * layer_name @@ -345,10 +345,10 @@ should be. Note, the size can change throughout the lifespan of the object, and it compensates for such a change. Objects must also contain a specific class called `VolTemplateProxy` which must inherit from -:py:class:`~volatility.framework.interfaces.objects.ObjectInterface`. This is used to access information about +:py:class:`~volatility3.framework.interfaces.objects.ObjectInterface`. This is used to access information about a structure before it has been associated with data and becomes an Object. The -:py:class:`~volatility.framework.interfaces.objects.ObjectInterface.VolTemplateProxy` class contains a number of -abstract classmethods, which take a :py:class:`~volatility.framework.interfaces.objects.Template`. The main method +:py:class:`~volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy` class contains a number of +abstract classmethods, which take a :py:class:`~volatility3.framework.interfaces.objects.Template`. The main method that is likely to need overwriting is the `size` method, which should return the size of the object (for the template of a dynamically-sized object, this should be a suitable value, and calculated based on the best available information). For most objects, this can be determined from the JSON data used to construct a normal `Struct` and therefore only needs diff --git a/doc/source/conf.py b/doc/source/conf.py index 2fa2c1b5b..eab5c2c94 100644 --- a/doc/source/conf.py +++ b/doc/source/conf.py @@ -21,18 +21,18 @@ import sphinx.ext.apidoc def setup(app): - volatility_directory = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..', 'volatility')) + volatility_directory = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..', 'volatility3')) source_dir = os.path.abspath(os.path.dirname(__file__)) sphinx.ext.apidoc.main(argv = ['-e', '-M', '-f', '-T', '-o', source_dir, volatility_directory]) - # Go through the volatility.framework.plugins files and change them to volatility.plugins + # Go through the volatility3.framework.plugins files and change them to volatility3.plugins for dir, _, files in os.walk(os.path.dirname(__file__)): for filename in files: - if filename.startswith('volatility.framework.plugins') and filename != 'volatility.framework.plugins.rst': - # Change all volatility.framework.plugins to volatility.plugins in the file + if filename.startswith('volatility3.framework.plugins') and filename != 'volatility3.framework.plugins.rst': + # Change all volatility3.framework.plugins to volatility3.plugins in the file # Rename the file - new_filename = filename.replace('volatility.framework.plugins', 'volatility.plugins') + new_filename = filename.replace('volatility3.framework.plugins', 'volatility3.plugins') replace_string = b"Submodules\n----------\n\n.. toctree::\n\n" submodules = replace_string @@ -48,25 +48,25 @@ def setup(app): with open(os.path.join(dir, new_filename), 'wb') as newfile: with open(os.path.join(dir, filename), "rb") as oldfile: line = oldfile.read() - correct_plugins = line.replace(b'volatility.framework.plugins', b'volatility.plugins') + correct_plugins = line.replace(b'volatility3.framework.plugins', b'volatility3.plugins') correct_submodules = correct_plugins.replace(replace_string, submodules) newfile.write(correct_submodules) os.remove(os.path.join(dir, filename)) - elif filename == 'volatility.framework.rst': + elif filename == 'volatility3.framework.rst': with open(os.path.join(dir, filename), "rb") as contents: lines = contents.readlines() plugins_seen = False with open(os.path.join(dir, filename), "wb") as contents: for line in lines: - if b'volatility.framework.plugins' in line: + if b'volatility3.framework.plugins' in line: plugins_seen = True if plugins_seen and line == b'': - contents.write(b' volatility.plugins') + contents.write(b' volatility3.plugins') contents.write(line) - elif filename == 'volatility.plugins.rst': + elif filename == 'volatility3.plugins.rst': with open(os.path.join(dir, filename), "rb") as contents: lines = contents.readlines() - with open(os.path.join(dir, 'volatility.framework.plugins.rst'), "rb") as contents: + with open(os.path.join(dir, 'volatility3.framework.plugins.rst'), "rb") as contents: real_lines = contents.readlines() # Process real_lines @@ -75,14 +75,14 @@ def setup(app): break else: line_index = len(real_lines) - submodule_lines = real_lines[line_index:] + submodule_lines = [b"\n"] + real_lines[line_index:] plugins_seen = False with open(os.path.join(dir, filename), "wb") as contents: for line in lines: contents.write(line) for line in submodule_lines: - contents.write(line.replace(b'volatility.framework.plugins', b'volatility.plugins')) + contents.write(line.replace(b'volatility3.framework.plugins', b'volatility3.plugins')) # If extensions (or modules to document with autodoc) are in another directory, @@ -90,7 +90,7 @@ def setup(app): # documentation root, use os.path.abspath to make it absolute, like shown here. sys.path.insert(0, os.path.abspath('../..')) -from volatility.framework import constants +from volatility3.framework import constants # -- General configuration ------------------------------------------------ diff --git a/doc/source/index.rst b/doc/source/index.rst index c61e6e847..f8cdb690f 100644 --- a/doc/source/index.rst +++ b/doc/source/index.rst @@ -5,7 +5,7 @@ This is the documentation for Volatility 3, the most advanced memory forensics framework in the world. Like previous versions of the Volatility framework, Volatility 3 is Open Source. -:doc:`List of plugins ` +:doc:`List of plugins ` Here are some guidelines for using Volatility 3 effectively: @@ -22,7 +22,7 @@ Python Packages =============== .. toctree:: - volatility + volatility3 Indices and tables ================== diff --git a/doc/source/simple-plugin.rst b/doc/source/simple-plugin.rst index e857e830c..52dabfd4f 100644 --- a/doc/source/simple-plugin.rst +++ b/doc/source/simple-plugin.rst @@ -3,19 +3,19 @@ How to Write a Simple Plugin This guide will step through how to construct a simple plugin using Volatility 3. -The example plugin we'll use is :py:class:`~volatility.plugins.windows.dlllist.DllList`, which features the main traits +The example plugin we'll use is :py:class:`~volatility3.plugins.windows.dlllist.DllList`, which features the main traits of a normal plugin, and reuses other plugins appropriately. Inherit from PluginInterface ---------------------------- -The first step is to define a class that inherits from :py:class:`~volatility.framework.interfaces.plugins.PluginInterface`. +The first step is to define a class that inherits from :py:class:`~volatility3.framework.interfaces.plugins.PluginInterface`. Volatility automatically finds all plugins defined under the various plugin directories by importing them and then -making use of any classes that inherit from :py:class:`~volatility.framework.interfaces.plugins.PluginInterface`. +making use of any classes that inherit from :py:class:`~volatility3.framework.interfaces.plugins.PluginInterface`. :: - from volatility.framework import interfaces + from volatility3.framework import interfaces class DllList(interfaces.plugins.PluginInterface): @@ -56,7 +56,7 @@ to instantiate the plugin). At the moment these requirements are fairly straigh architectures = ["Intel32", "Intel64"]), This requirement indicates that the plugin will operate on a single -:py:class:`TranslationLayer `. The name of the +:py:class:`TranslationLayer `. The name of the loaded layer will appear in the plugin's configuration under the name ``primary``. Requirement values can be accessed within the plugin through the plugin's `config` attribute (for example ``self.config['pid']``). @@ -71,7 +71,7 @@ layers, for example a plugin that carries out some form of difference or statist This requirement (and the next two) are known as Complex Requirements, and user interfaces will likely not directly request a value for this from a user. The value stored in the configuration tree for a -:py:class:`~volatility.framework.configuration.requirements.TranslationLayerRequirement` is +:py:class:`~volatility3.framework.configuration.requirements.TranslationLayerRequirement` is the string name of a layer present in the context's memory that satisfies the requirement. :: @@ -80,14 +80,14 @@ the string name of a layer present in the context's memory that satisfies the re description = "Windows kernel symbols"), This requirement specifies the need for a particular -:py:class:`SymbolTable ` +:py:class:`SymbolTable ` to be loaded. This gets populated by various -:py:class:`Automagic ` as the nearest sibling to a particular -:py:class:`~volatility.framework.configuration.requirements.TranslationLayerRequirement`. -This means that if the :py:class:`~volatility.framework.configuration.requirements.TranslationLayerRequirement` -is satisfied and the :py:class:`Automagic ` can determine -the appropriate :py:class:`SymbolTable `, the -name of the :py:class:`SymbolTable ` will be stored in the configuration. +:py:class:`Automagic ` as the nearest sibling to a particular +:py:class:`~volatility3.framework.configuration.requirements.TranslationLayerRequirement`. +This means that if the :py:class:`~volatility3.framework.configuration.requirements.TranslationLayerRequirement` +is satisfied and the :py:class:`Automagic ` can determine +the appropriate :py:class:`SymbolTable `, the +name of the :py:class:`SymbolTable ` will be stored in the configuration. This requirement is also a Complex Requirement and therefore will not be requested directly from the user. @@ -119,10 +119,10 @@ Define the `run` method The run method is the primary method called on a plugin. It takes no parameters (these have been passed through the context's configuration tree, and the context is provided at plugin initialization time) and returns an unpopulated -:py:class:`~volatility.framework.interfaces.renderers.TreeGrid` object. These are typically constructed based on a +:py:class:`~volatility3.framework.interfaces.renderers.TreeGrid` object. These are typically constructed based on a generator that carries out the bulk of the plugin's processing. The -:py:class:`~volatility.framework.interfaces.renderers.TreeGrid` also specifies the column names and types -that will be output as part of the :py:class:`~volatility.framework.interfaces.renderers.TreeGrid`. +:py:class:`~volatility3.framework.interfaces.renderers.TreeGrid` also specifies the column names and types +that will be output as part of the :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`. :: @@ -143,28 +143,28 @@ that will be output as part of the :py:class:`~volatility.framework.interfaces.r In this instance, the plugin constructs a filter (using the PsList plugin's *classmethod* for creating filters). It checks the plugin's configuration for the ``pid`` value, and passes it in as a list if it finds it, or None if -it does not. The :py:func:`~volatility.plugins.windows.pslist.PsList.create_pid_filter` method accepts a list of process +it does not. The :py:func:`~volatility3.plugins.windows.pslist.PsList.create_pid_filter` method accepts a list of process identifiers that are included in the list. If the list is empty, all processes are returned. The next line specifies the columns by their name and type. The types are simple types (int, str, bytes, float, and bool) but can also provide hints as to how the output should be displayed (such as a hexidecimal number, using -:py:class:`volatility.framework.renderers.format_hints.Hex`). +:py:class:`volatility3.framework.renderers.format_hints.Hex`). This indicates to user interfaces that the value should be displayed in a particular way, but does not guarantee that the value will be displayed that way (for example, if it doesn't make sense to do so in a particular interface). Finally, the generator is provided. The generator accepts a list of processes, which is gathered using a different plugin, -the :py:class:`~volatility.plugins.windows.pslist.PsList` plugin. That plugin features a *classmethod*, +the :py:class:`~volatility3.plugins.windows.pslist.PsList` plugin. That plugin features a *classmethod*, so that other plugins can call it. As such, it takes all the necessary parameters rather than accessing them from a configuration. Since it must be portable code, it takes a context, as well as the layer name, symbol table and optionally a filter. In this instance we unconditionally pass it the values from the configuration for the ``primary`` and ``nt_symbols`` requirements. This will generate a list -of :py:class:`~volatility.framework.symbols.windows.extensions.EPROCESS` objects, as provided by the :py:class:`~volatility.plugins.windows.pslist.PsList` plugin, +of :py:class:`~volatility3.framework.symbols.windows.extensions.EPROCESS` objects, as provided by the :py:class:`~volatility.plugins.windows.pslist.PsList` plugin, and is not covered here but is used as an example for how to share code across plugins (both as the provider and the consumer of the shared code). Define the generator -------------------- -The :py:class:`~volatility.framework.interfaces.renderers.TreeGrid` can be populated without a generator, +The :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid` can be populated without a generator, but it is quite a common model to use. This is where the main processing for this plugin lives. :: @@ -189,10 +189,10 @@ but it is quite a common model to use. This is where the main processing for th format_hints.Hex(entry.DllBase), format_hints.Hex(entry.SizeOfImage), BaseDllName, FullDllName)) -This iterates through the list of processes and for each one calls the :py:meth:`~volatility.framework.symbols.windows.extensions.EPROCESS.load_order_modules` method on it. This provides +This iterates through the list of processes and for each one calls the :py:meth:`~volatility3.framework.symbols.windows.extensions.EPROCESS.load_order_modules` method on it. This provides a list of the loaded modules within the process. -The plugin then defaults the ``BaseDllName`` and ``FullDllName`` variables to an :py:class:`~volatility.framework.renderers.UnreadableValue`, +The plugin then defaults the ``BaseDllName`` and ``FullDllName`` variables to an :py:class:`~volatility3.framework.renderers.UnreadableValue`, which is a way of indicating to the user interface that the value couldn't be read for some reason (but that it isn't fatal). There are currently four different reasons a value may be unreadable: @@ -204,7 +204,7 @@ There are currently four different reasons a value may be unreadable: This is a safety provision to ensure that the data returned by the Volatility library is accurate and describes why information may not be provided. -The plugin then takes the process's ``BaseDllName`` value, and calls :py:meth:`~volatility.framework.symbols.windows.extensions.UNICODE_STRING.get_string` on it. All structure attributes, +The plugin then takes the process's ``BaseDllName`` value, and calls :py:meth:`~volatility3.framework.symbols.windows.extensions.UNICODE_STRING.get_string` on it. All structure attributes, as defined by the symbols, are directly accessible and use the case-style of the symbol library it came from (in Windows, attributes are CamelCase), such as ``entry.BaseDllName`` in this instance. Any attribtues not defined by the symbol but added by Volatility extensions cannot be properties (in case they overlap with the attributes defined in the symbol libraries) @@ -215,16 +215,16 @@ read the data at a particular offset. This will cause an exception to be thrown as a means of communicating when something exceptional happens. It is the responsibility of the plugin developer to appropriately catch and handle any non-fatal exceptions and otherwise allow the exception to be thrown by the user interface. -In this instance, the :py:class:`~volatility.framework.exceptions.InvalidAddressException` class is caught, which is thrown +In this instance, the :py:class:`~volatility3.framework.exceptions.InvalidAddressException` class is caught, which is thrown by any layer which cannot access an offset requested of it. Since we have already populated both values with ``UnreadableValue`` we do not need to write code for the exception handler. -Finally, we yield the record in the format required by the :py:class:`~volatility.framework.interfaces.renderers.TreeGrid`, +Finally, we yield the record in the format required by the :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`, a tuple, listing the indentation level (for trees) and then the list of values for each column. This plugin demonstrates casting a value ``ImageFileName`` to ensure it's returned as a string with a specific maximum length, rather than its original type (potentially an array of characters, etc). -This is carried out using the :py:meth:`~volatility.framework.interfaces.objects.ObjectInterface.cast` method which takes a type (either a native type, such as string or pointer, or a -structure type defined in a :py:class:`SymbolTable ` +This is carried out using the :py:meth:`~volatility3.framework.interfaces.objects.ObjectInterface.cast` method which takes a type (either a native type, such as string or pointer, or a +structure type defined in a :py:class:`SymbolTable ` such as ``!_UNICODE``) and the parameters to that type. Since the cast value must populate a string typed column, it had to be a Python string (such as being cast to the native diff --git a/doc/source/symbol-tables.rst b/doc/source/symbol-tables.rst index 4e44e8368..fd94dea4d 100644 --- a/doc/source/symbol-tables.rst +++ b/doc/source/symbol-tables.rst @@ -12,7 +12,7 @@ Volatility will automatically decompress them on use. It will also cache their under the user's home directory, in :file:`.cache/volatility3`, along with other useful data. The cache directory currently cannot be altered. -Symbol table JSON files live, by default, under the :file:`volatility/symbols`, underneath an operating system directory +Symbol table JSON files live, by default, under the :file:`volatility3/symbols`, underneath an operating system directory (currently one of :file:`windows`, :file:`mac` or :file:`linux`). The symbols directory is configurable within the framework and can usually be set within the user interface. @@ -33,7 +33,7 @@ Windows symbol tables can be manually constructed from an appropriate PDB file. is built into Volatility 3, called :file:`pdbconv.py`. It can be run from the top-level Volatility path, using the following command: -:command:`PYTHONPATH="." python volatility/framework/symbols/windows/pdbconv.py` +:command:`PYTHONPATH="." python volatility3/framework/symbols/windows/pdbconv.py` The :envvar:`PYTHONPATH` environment variable is not required if the Volatility library is installed in the system's library path or a virtual environment. diff --git a/doc/source/using-as-a-library.rst b/doc/source/using-as-a-library.rst index abed65225..ded861de4 100644 --- a/doc/source/using-as-a-library.rst +++ b/doc/source/using-as-a-library.rst @@ -25,7 +25,7 @@ from versions 1.1 or 1.2: :: - volatility.framework.require_interface_version(1, 0, 0) + volatility3.framework.require_interface_version(1, 0, 0) Contexts can be spun up quite easily, just construct one. It's not a singleton, so multiple contexts can be constructed and operate independently, but be aware of which context you're handing where and make sure to use @@ -42,20 +42,20 @@ Determine what plugins are available ------------------------------------ You can also interrogate the framework to see which plugins are available. First we have to try to load all -available plugins. The :py:func:`~volatility.framework.import_files` method will automatically use the module -paths for the provided module (in this case, volatility.plugins) and walk the directory (or directories) loading up +available plugins. The :py:func:`~volatility3.framework.import_files` method will automatically use the module +paths for the provided module (in this case, volatility3.plugins) and walk the directory (or directories) loading up all python files. Any import failures will be provided in the failures return value, unless the second parameter is False in which case the call will raise any exceptions encountered. Any additional directories containing plugins -should be added to the `__path__` attribute for the `volatility.plugins` module. The standard paths should generally -also be included, which can be found in `volatility.constants.PLUGINS_PATH`. +should be added to the `__path__` attribute for the `volatility3.plugins` module. The standard paths should generally +also be included, which can be found in `volatility3.constants.PLUGINS_PATH`. :: - volatility.plugins.__path__ = + constants.PLUGINS_PATH - failures = framework.import_files(volatility.plugins, True) + volatility3.plugins.__path__ = + constants.PLUGINS_PATH + failures = framework.import_files(volatility3.plugins, True) Once the plugins have been imported, we can interrogate which plugins are available. The -:py:func:`~volatility.framework.list_plugins` call will +:py:func:`~volatility3.framework.list_plugins` call will return a dictionary of plugin names and the plugin classes. :: @@ -68,9 +68,9 @@ Determine what configuration options a plugin requires ------------------------------------------------------ For each plugin class, we can call the classmethod `requirements` on it, which will return a list of objects that -adhere to the :py:class:`~volatility.framework.interfaces.configuration.RequirementInterface` method. The various +adhere to the :py:class:`~volatility3.framework.interfaces.configuration.RequirementInterface` method. The various types of Requirement are split roughly in two, -:py:class:`~volatility.framework.interfaces.configuration.SimpleTypeRequirement` (such as integers, booleans, floats +:py:class:`~volatility3.framework.interfaces.configuration.SimpleTypeRequirement` (such as integers, booleans, floats and strings) and more complex requirements (such as lists, choices, multiple requirements, translation layer requirements or symbol table requirements). A requirement just specifies a type of data and a name, and must be combined with a configuration hierarchy to have meaning. @@ -98,7 +98,7 @@ underneaths its own branch). To set the hierarchy, you'll need to know where th For this example, we'll assume plugins' base_config_path is set as `plugins`, and that automagics are configured under the `automagic` tree. We'll see later how to ensure this matches up with the plugins and automagic when they're constructed. Joining configuration options should always be carried out using -:py:func:`~volatility.framework.interfaces.configuration.path_join` +:py:func:`~volatility3.framework.interfaces.configuration.path_join` in case the separator value gets changed in the future. Configuration items can then be set as follows: :: @@ -170,7 +170,7 @@ be called whenever a plugin produces an auxiliary file. constructed = plugin(context, plugin_config_path, progress_callback = progress_callback) constructed.set_open_method(file_handler) -The file_handler must adhere to the :py:class:`~volatility.framework.interfaces.plugins.FileHandlerInterface`, +The file_handler must adhere to the :py:class:`~volatility3.framework.interfaces.plugins.FileHandlerInterface`, which represents an IO[bytes] object but also contains a `preferred_filename` attribute as a hint. All of this functionality has been condensed into a framework method called `construct_plugin` which will @@ -181,7 +181,7 @@ accepts an optional progress_callback and an optional file_consumer. constructed = plugins.construct_plugin(ctx, automagics, plugin, base_config_path, progress_callback, file_consumer) -Finally the plugin can be run, and will return a :py:class:`~volatility.framework.interfaces.renderers.TreeGrid`. +Finally the plugin can be run, and will return a :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`. :: @@ -201,22 +201,22 @@ does the actual work. This can return an exception if one occurs during the run The results can be accessed either as the results are being processed, or by visiting the nodes in the tree once it is fully populated. In either case, a visitor method will be required. The visitor method -should accept a :py:class:`~volatility.framework.interfaces.renderers.TreeNode` and an `accumulator`. It will +should accept a :py:class:`~volatility3.framework.interfaces.renderers.TreeNode` and an `accumulator`. It will return an updated accumulator. -When provided a :py:class:`~volatility.framework.interfaces.renderers.TreeNode`, it can be accessed as a dictionary +When provided a :py:class:`~volatility3.framework.interfaces.renderers.TreeNode`, it can be accessed as a dictionary based on the column names that the treegrid contains. It should be noted that each column can contain only the type specified in the `column.type` field (which can be a simple type like string, integer, float, bytes or a more complex type, like a DateTime, a Disassembly or a descendant of -:py:class:`~volatility.framework.interfaces.renderers.BaseAbsentValue`). The various fields may also be wrapped in +:py:class:`~volatility3.framework.interfaces.renderers.BaseAbsentValue`). The various fields may also be wrapped in `format_hints` designed to tell the user interface how to render the data. These hints can be things like Bin, Hex or HexBytes, so that fields like offsets are displayed in hex form or so that bytes are displayed in their hex form rather -than their raw form. Descendants of :py:class:`~volatility.framework.interfaces.renderers.BaseAbsentValue` can currently +than their raw form. Descendants of :py:class:`~volatility3.framework.interfaces.renderers.BaseAbsentValue` can currently be one of -:py:class:`~volatility.framework.renderers.UnreadableValue`, -:py:class:`~volatility.framework.renderers.UnparsableValue`, -:py:class:`~volatility.framework.renderers.NotApplicableValue` or -:py:class:`~volatility.framework.renderers.NotAvailableValue`. These indicate that data could not be read from the +:py:class:`~volatility3.framework.renderers.UnreadableValue`, +:py:class:`~volatility3.framework.renderers.UnparsableValue`, +:py:class:`~volatility3.framework.renderers.NotApplicableValue` or +:py:class:`~volatility3.framework.renderers.NotAvailableValue`. These indicate that data could not be read from the memory for some reason, could not be parsed properly, was not applicable or was not available. A simple text renderer (that returns output immediately) would appear as follows. This doesn't use @@ -240,5 +240,5 @@ the accumulator, but instead uses print to directly produce the output. This is grid.populate(visitor, None) More complex examples of renderers can be found in the default CLI implementation, such as the -:py:class:`~volatility.cli.text_renderer.QuickTextRenderer` or the -:py:class:`~volatility.cli.text_renderer.PrettyTextRenderer`. +:py:class:`~volatility3.cli.text_renderer.QuickTextRenderer` or the +:py:class:`~volatility3.cli.text_renderer.PrettyTextRenderer`. diff --git a/doc/source/vol2to3.rst b/doc/source/vol2to3.rst index 8e82ba8a2..bc1733dcf 100644 --- a/doc/source/vol2to3.rst +++ b/doc/source/vol2to3.rst @@ -6,7 +6,7 @@ Library and Context Volatility 3 has been designed from the ground up to be a library, this means the components are independent and all state required to run a particular plugin at a particular time is self-contained in an object derived from -a :py:class:`~volatility.framework.interfaces.context.ContextInterface`. +a :py:class:`~volatility3.framework.interfaces.context.ContextInterface`. The context contains the two core components that make up Volatility, layers of data and the available symbols. @@ -14,7 +14,7 @@ Symbols and Types ----------------- Volatility 3 no longer uses profiles, it comes with an extensive library of -:py:class:`symbol tables `, and can generate new symbol +:py:class:`symbol tables `, and can generate new symbol tables for most windows memory images, based on the memory image itself. This allows symbol tables to include specific offsets for locations (symbol locations) based on that operating system in particular. This means it is easier and quicker to identify structures within an operating system, by having known offsets for those structures provided by the official @@ -37,11 +37,11 @@ re-read many times over for no benefit (particularly since each re-read could re from following page table translations). Finally, in order to provide Volatility specific information without impact on the ability for structures to have members -with arbitrary names, all the metadata about the object (such as its layer or offset) have been moved to a read-only :py:meth:`~volatility.framework.interfaces.objects.ObjectInterface.vol` +with arbitrary names, all the metadata about the object (such as its layer or offset) have been moved to a read-only :py:meth:`~volatility3.framework.interfaces.objects.ObjectInterface.vol` dictionary. -Further the distinction between a :py:class:`~volatility.framework.interfaces.objects.Template` (the thing that -constructs an object) and the :py:class:`Object ` itself has +Further the distinction between a :py:class:`~volatility3.framework.interfaces.objects.Template` (the thing that +constructs an object) and the :py:class:`Object ` itself has been made more explicit. In Volatility 2, some information (such as size) could only be determined from a constructed object, leading to instantiating a template on an empty buffer, just to determine the size. In Volatility 3, templates contain information such as their size, which can be queried directly without constructing the object. @@ -49,7 +49,7 @@ information such as their size, which can be queried directly without constructi Layer and Layer dependencies ---------------------------- Address spaces in Volatility 2, are now more accurately referred to as -:py:class:`Translation Layers `, since each one typically sits +:py:class:`Translation Layers `, since each one typically sits atop another and can translate addresses between the higher logical layer and the lower physical layer. Address spaces in Volatility 2 were strictly limited to a stack, one on top of one other. In Volatility 3, layers can have multiple "dependencies" (lower layers), which allows for the integration of features such as swap space. @@ -65,13 +65,13 @@ included a stacker automagic to emulate the most common feature of Volatility 2, Searching and Scanning ---------------------- Scanning is very similar to scanning in Volatility 2, a scanner object (such as a -:py:class:`~volatility.framework.layers.scanners.BytesScanner` or :py:class:`~volatility.framework.layers.scanners.RegExScanner`) is -primed with the data to be searched for, and the :py:meth:`~volatility.framework.interfaces.layers.DataLayerInterface.scan` method is called on the layer to be searched. +:py:class:`~volatility3.framework.layers.scanners.BytesScanner` or :py:class:`~volatility.framework.layers.scanners.RegExScanner`) is +primed with the data to be searched for, and the :py:meth:`~volatility3.framework.interfaces.layers.DataLayerInterface.scan` method is called on the layer to be searched. Output Rendering ---------------- This is extremely similar to Volatility 2, because we were developing it for Volatility 3 when we added it to Volatility 2. -We now require that all plugins produce output in a :py:class:`~volatility.framework.interfaces.renderers.TreeGrid` object, +We now require that all plugins produce output in a :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid` object, which ensure that the library can be used regardless of which interface is driving it. An example web GUI is also available called Volumetric which allows all the plugins that can be run from the command line to be run from a webpage, and offers features such as automatic formatting and sorting of the data, which previously couldn't be provided easily from the CLI. diff --git a/setup.py b/setup.py index 737deb4a9..64d9bf2d1 100644 --- a/setup.py +++ b/setup.py @@ -4,9 +4,9 @@ import setuptools -from volatility.framework import constants +from volatility3.framework import constants -setuptools.setup(name = "volatility", +setuptools.setup(name = "volatility3", description = "Memory forensics framework", version = constants.PACKAGE_VERSION, license = "VSL", @@ -16,7 +16,7 @@ setuptools.setup(name = "volatility", url = "https://volatilityfoundation.org/volatility/", project_urls = { "Bug Tracker": "https://github.com/volatilityfoundation/volatility3/issues", - "Documentation": "https://volatilityfoundation.org/volatility/docs/", + "Documentation": "https://volatility3.readthedocs.io/", "Source Code": "https://github.com/volatilityfoundation/volatility3", }, include_package_data = True, @@ -27,8 +27,8 @@ setuptools.setup(name = "volatility", packages = setuptools.find_packages(exclude = ["development", "development.*"]), entry_points = { 'console_scripts': [ - 'vol = volatility.cli:main', - 'volshell = volatility.cli.volshell:main', + 'vol = volatility3.cli:main', + 'volshell = volatility3.cli.volshell:main', ], }, install_requires = ["pefile"], diff --git a/vol.py b/vol.py index 802915386..080413545 100755 --- a/vol.py +++ b/vol.py @@ -4,7 +4,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import volatility.cli +import volatility3.cli if __name__ == '__main__': - volatility.cli.main() + volatility3.cli.main() diff --git a/vol.spec b/vol.spec index 6d7b67662..42b69af3f 100644 --- a/vol.spec +++ b/vol.spec @@ -31,15 +31,15 @@ sys.path.append(os.getcwd()) vol_analysis = Analysis(['vol.py'], pathex = [], binaries = binaries, - datas = collect_data_files('volatility.framework') + \ - collect_data_files('volatility.framework.automagic', include_py_files = True) + \ - collect_data_files('volatility.framework.plugins', include_py_files = True) + \ - collect_data_files('volatility.framework.layers', include_py_files = True) + \ - collect_data_files('volatility.schemas') + \ - collect_data_files('volatility.plugins', include_py_files = True), - hiddenimports = collect_submodules('volatility.framework.automagic') + \ - collect_submodules('volatility.framework.plugins') + \ - collect_submodules('volatility.framework.symbols'), + datas = collect_data_files('volatility3.framework') + \ + collect_data_files('volatility3.framework.automagic', include_py_files = True) + \ + collect_data_files('volatility3.framework.plugins', include_py_files = True) + \ + collect_data_files('volatility3.framework.layers', include_py_files = True) + \ + collect_data_files('volatility3.schemas') + \ + collect_data_files('volatility3.plugins', include_py_files = True), + hiddenimports = collect_submodules('volatility3.framework.automagic') + \ + collect_submodules('volatility3.framework.plugins') + \ + collect_submodules('volatility3.framework.symbols'), hookspath = [], runtime_hooks = [], excludes = [], @@ -55,16 +55,16 @@ vol_analysis = Analysis(['vol.py'], # volshell_analysis = Analysis(['volshell.py'], # pathex = [], # binaries = [], -# datas = collect_data_files('volatility.framework') + \ -# collect_data_files('volatility.framework.automagic', include_py_files = True) + \ -# collect_data_files('volatility.framework.plugins', include_py_files = True) + \ -# collect_data_files('volatility.framework.layers', include_py_files = True) + \ -# collect_data_files('volatility.cli', include_py_files = True) + \ -# collect_data_files('volatility.schemas') + \ -# collect_data_files('volatility.plugins', include_py_files = True), -# hiddenimports = collect_submodules('volatility.framework.automagic') + \ -# collect_submodules('volatility.framework.plugins') + \ -# collect_submodules('volatility.framework.symbols'), +# datas = collect_data_files('volatility3.framework') + \ +# collect_data_files('volatility3.framework.automagic', include_py_files = True) + \ +# collect_data_files('volatility3.framework.plugins', include_py_files = True) + \ +# collect_data_files('volatility3.framework.layers', include_py_files = True) + \ +# collect_data_files('volatility3.cli', include_py_files = True) + \ +# collect_data_files('volatility3.schemas') + \ +# collect_data_files('volatility3.plugins', include_py_files = True), +# hiddenimports = collect_submodules('volatility3.framework.automagic') + \ +# collect_submodules('volatility3.framework.plugins') + \ +# collect_submodules('volatility3.framework.symbols'), # hookspath = [], # runtime_hooks = [], # excludes = [], diff --git a/volatility/__init__.py b/volatility3/__init__.py similarity index 73% rename from volatility/__init__.py rename to volatility3/__init__.py index f766a4ba2..5d3c34e43 100644 --- a/volatility/__init__.py +++ b/volatility3/__init__.py @@ -35,8 +35,8 @@ class WarningFindSpec(abc.MetaPathFinder): def find_spec(fullname: str, path: Optional[List[str]], target: None = None, **kwargs) -> None: """Mock find_spec method that just checks the name, this must go first.""" - if fullname.startswith("volatility.framework.plugins."): - warning = "Please do not use the volatility.framework.plugins namespace directly, only use volatility.plugins" + if fullname.startswith("volatility3.framework.plugins."): + warning = "Please do not use the volatility3.framework.plugins namespace directly, only use volatility3.plugins" # Pyinstaller uses walk_packages to import, but needs to read the modules to figure out dependencies # As such, we only print the warning when directly imported rather than from within walk_packages if inspect.stack()[-2].function != 'walk_packages': @@ -46,17 +46,17 @@ class WarningFindSpec(abc.MetaPathFinder): warning_find_spec = [WarningFindSpec()] # type: List[abc.MetaPathFinder] sys.meta_path = warning_find_spec + sys.meta_path -# We point the volatility.plugins __path__ variable at BOTH -# volatility/plugins -# volatility/framework/plugins +# We point the volatility3.plugins __path__ variable at BOTH +# volatility3/plugins +# volatility3/framework/plugins # in that order. # # This will allow our users to override any component of any plugin without monkey patching, # but it also allows us to clear out the plugins directory to get back to proper functionality. # This offered the greatest flexibility for users whilst allowing us to keep the core separate and clean. # -# This means that all plugins should be imported as volatility.plugins (otherwise they'll be imported twice, -# once as volatility.plugins.NAME and once as volatility.framework.plugins.NAME). We therefore throw an error -# if anyone tries to import anything under the volatility.framework.plugins.* namespace +# This means that all plugins should be imported as volatility3.plugins (otherwise they'll be imported twice, +# once as volatility3.plugins.NAME and once as volatility3.framework.plugins.NAME). We therefore throw an error +# if anyone tries to import anything under the volatility3.framework.plugins.* namespace # -# The remediation is to only ever import form volatility.plugins instead. +# The remediation is to only ever import form volatility3.plugins instead. diff --git a/volatility/cli/__init__.py b/volatility3/cli/__init__.py similarity index 94% rename from volatility/cli/__init__.py rename to volatility3/cli/__init__.py index 04af5b0de..27d85a22b 100644 --- a/volatility/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -22,13 +22,13 @@ import traceback from typing import Dict, Type, Union, Any from urllib import parse, request -import volatility.plugins -import volatility.symbols -from volatility import framework -from volatility.cli import text_renderer, volargparse -from volatility.framework import automagic, constants, contexts, exceptions, interfaces, plugins, configuration -from volatility.framework.automagic import stacker -from volatility.framework.configuration import requirements +import volatility3.plugins +import volatility3.symbols +from volatility3 import framework +from volatility3.cli import text_renderer, volargparse +from volatility3.framework import automagic, constants, contexts, exceptions, interfaces, plugins, configuration +from volatility3.framework.automagic import stacker +from volatility3.framework.configuration import requirements # Make sure we log everything @@ -79,7 +79,7 @@ class CommandLine: @classmethod def setup_logging(cls): - # Delay the setting of vollog for those that want to import volatility.cli (issue #241) + # Delay the setting of vollog for those that want to import volatility3.cli (issue #241) vollog.setLevel(1) vollog.addHandler(console) @@ -87,7 +87,7 @@ class CommandLine: """Executes the command line module, taking the system arguments, determining the plugin to run and then running it.""" - volatility.framework.require_interface_version(2, 0, 0) + volatility3.framework.require_interface_version(1, 0, 0) renderers = dict([(x.name.lower(), x) for x in framework.class_subclasses(text_renderer.CLIRenderer)]) @@ -107,7 +107,7 @@ class CommandLine: default = None, type = str) parser.add_argument("--parallelism", - help = "Enables parallelism (defaults to processes if no argument given)", + help = "Enables parallelism (defaults to off if no argument given)", nargs = '?', choices = ['processes', 'threads', 'off'], const = 'processes', @@ -172,12 +172,12 @@ class CommandLine: banner_output.write("Volatility 3 Framework {}\n".format(constants.PACKAGE_VERSION)) if partial_args.plugin_dirs: - volatility.plugins.__path__ = [os.path.abspath(p) - for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH + volatility3.plugins.__path__ = [os.path.abspath(p) + for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH if partial_args.symbol_dirs: - volatility.symbols.__path__ = [os.path.abspath(p) - for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS + volatility3.symbols.__path__ = [os.path.abspath(p) + for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS if partial_args.log: file_logger = logging.FileHandler(partial_args.log) @@ -192,8 +192,8 @@ class CommandLine: else: console.setLevel(10 - (partial_args.verbosity - 2)) - vollog.info("Volatility plugins path: {}".format(volatility.plugins.__path__)) - vollog.info("Volatility symbols path: {}".format(volatility.symbols.__path__)) + vollog.info("Volatility plugins path: {}".format(volatility3.plugins.__path__)) + vollog.info("Volatility symbols path: {}".format(volatility3.symbols.__path__)) # Set the PARALLELISM if partial_args.parallelism == 'processes': @@ -208,7 +208,7 @@ class CommandLine: # Do the initialization ctx = contexts.Context() # Construct a blank context - failures = framework.import_files(volatility.plugins, + failures = framework.import_files(volatility3.plugins, True) # Will not log as console's default level is WARNING if failures: parser.epilog = "The following plugins could not be loaded (use -vv to see why): " + \ @@ -342,7 +342,7 @@ class CommandLine: caused_by = [ "Memory smear during acquisition (try re-acquiring if possible)", "An intentionally invalid page lookup (operating system protection)", - "A bug in the plugin/volatility (re-run with -vvv and file a bug)" + "A bug in the plugin/volatility3 (re-run with -vvv and file a bug)" ] else: detail = "{} in layer {} ({})".format(hex(excp.invalid_address), excp.layer_name, excp) @@ -350,7 +350,7 @@ class CommandLine: "The base memory file being incomplete (try re-acquiring if possible)", "Memory smear during acquisition (try re-acquiring if possible)", "An intentionally invalid page lookup (operating system protection)", - "A bug in the plugin/volatility (re-run with -vvv and file a bug)" + "A bug in the plugin/volatility3 (re-run with -vvv and file a bug)" ] elif isinstance(excp, exceptions.SymbolError): general = "Volatility experienced a symbol-related issue:" @@ -414,7 +414,7 @@ class CommandLine: print("\nA translation layer requirement was not fulfilled. Please verify that:\n" "\tA file was provided to create this layer (by -f, --single-location or by config)\n" "\tThe file exists and is readable\n" - "\tThe necessary symbols are present and identified by volatility") + "\tThe necessary symbols are present and identified by volatility3") def populate_config(self, context: interfaces.context.ContextInterface, configurables_list: Dict[str, Type[interfaces.configuration.ConfigurableInterface]], @@ -424,7 +424,7 @@ class CommandLine: We have already determined these elements must be descended from ConfigurableInterface Args: - context: The volatility context to operate on + context: The volatility3 context to operate on configurables_list: A dictionary of configurable items that can be configured on the plugin args: An object containing the arguments necessary plugin_config_path: The path within the context's config containing the plugin's configuration @@ -436,7 +436,8 @@ class CommandLine: if value is not None: if isinstance(requirement, requirements.URIRequirement): if isinstance(value, str): - if not parse.urlparse(value).scheme: + scheme = parse.urlparse(value).scheme + if not scheme or len(scheme) <= 1: if not os.path.exists(value): raise FileNotFoundError( "Non-existant file {} passed to URIRequirement".format(value)) @@ -563,11 +564,11 @@ class CommandLine: additional["action"] = "store_true" if "type" in additional: del additional["type"] - elif isinstance(requirement, volatility.framework.configuration.requirements.ListRequirement): + elif isinstance(requirement, volatility3.framework.configuration.requirements.ListRequirement): additional["type"] = requirement.element_type nargs = '*' if requirement.optional else '+' additional["nargs"] = nargs - elif isinstance(requirement, volatility.framework.configuration.requirements.ChoiceRequirement): + elif isinstance(requirement, volatility3.framework.configuration.requirements.ChoiceRequirement): additional["type"] = str additional["choices"] = requirement.choices else: diff --git a/volatility/cli/text_renderer.py b/volatility3/cli/text_renderer.py similarity index 99% rename from volatility/cli/text_renderer.py rename to volatility3/cli/text_renderer.py index d1d2663fe..f40a5d323 100644 --- a/volatility/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -10,8 +10,8 @@ import sys from functools import wraps from typing import Callable, Any, List, Tuple, Dict -from volatility.framework import interfaces, renderers -from volatility.framework.renderers import format_hints +from volatility3.framework import interfaces, renderers +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) diff --git a/volatility/cli/volargparse.py b/volatility3/cli/volargparse.py similarity index 100% rename from volatility/cli/volargparse.py rename to volatility3/cli/volargparse.py diff --git a/volatility/cli/volshell/__init__.py b/volatility3/cli/volshell/__init__.py similarity index 92% rename from volatility/cli/volshell/__init__.py rename to volatility3/cli/volshell/__init__.py index 4441d4b7b..6dde83905 100644 --- a/volatility/cli/volshell/__init__.py +++ b/volatility3/cli/volshell/__init__.py @@ -9,11 +9,11 @@ import os import sys from urllib import request -import volatility.plugins -import volatility.symbols -from volatility import cli, framework -from volatility.cli.volshell import generic, windows, linux, mac -from volatility.framework import automagic, constants, contexts, exceptions, interfaces, plugins +import volatility3.plugins +import volatility3.symbols +from volatility3 import cli, framework +from volatility3.cli.volshell import generic, windows, linux, mac +from volatility3.framework import automagic, constants, contexts, exceptions, interfaces, plugins # Make sure we log everything vollog = logging.getLogger() @@ -33,6 +33,8 @@ class VolShell(cli.CommandLine): python terminal with all the volatility support calls available. """ + CLI_NAME = "volshell" + def __init__(self): super().__init__() self.output_dir = None @@ -42,9 +44,9 @@ class VolShell(cli.CommandLine): determining the plugin to run and then running it.""" sys.stdout.write("Volshell (Volatility 3 Framework) {}\n".format(constants.PACKAGE_VERSION)) - framework.require_interface_version(2, 0, 0) + framework.require_interface_version(1, 0, 0) - parser = argparse.ArgumentParser(prog = 'volshell', + parser = argparse.ArgumentParser(prog = self.CLI_NAME, description = "A tool for interactivate forensic analysis of memory images") parser.add_argument("-c", "--config", @@ -104,15 +106,15 @@ class VolShell(cli.CommandLine): known_args = [arg for arg in sys.argv if arg != '--help' and arg != '-h'] partial_args, _ = parser.parse_known_args(known_args) if partial_args.plugin_dirs: - volatility.plugins.__path__ = [os.path.abspath(p) - for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH + volatility3.plugins.__path__ = [os.path.abspath(p) + for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH if partial_args.symbol_dirs: - volatility.symbols.__path__ = [os.path.abspath(p) - for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS + volatility3.symbols.__path__ = [os.path.abspath(p) + for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS - vollog.info("Volatility plugins path: {}".format(volatility.plugins.__path__)) - vollog.info("Volatility symbols path: {}".format(volatility.symbols.__path__)) + vollog.info("Volatility plugins path: {}".format(volatility3.plugins.__path__)) + vollog.info("Volatility symbols path: {}".format(volatility3.symbols.__path__)) if partial_args.log: file_logger = logging.FileHandler(partial_args.log) @@ -134,7 +136,7 @@ class VolShell(cli.CommandLine): # Do the initialization ctx = contexts.Context() # Construct a blank context - failures = framework.import_files(volatility.plugins, + failures = framework.import_files(volatility3.plugins, True) # Will not log as console's default level is WARNING if failures: parser.epilog = "The following plugins could not be loaded (use -vv to see why): " + \ diff --git a/volatility/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py similarity index 98% rename from volatility/cli/volshell/generic.py rename to volatility3/cli/volshell/generic.py index 18d76ae04..19d398ba9 100644 --- a/volatility/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -11,10 +11,10 @@ import sys from typing import Any, Dict, List, Optional, Tuple, Union, Type from urllib import request -from volatility.cli import text_renderer -from volatility.framework import renderers, interfaces, objects, plugins, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import intel, physical +from volatility3.cli import text_renderer +from volatility3.framework import renderers, interfaces, objects, plugins, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import intel, physical try: import capstone @@ -26,7 +26,7 @@ except ImportError: class Volshell(interfaces.plugins.PluginInterface): """Shell environment to directly interact with a memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility/cli/volshell/linux.py b/volatility3/cli/volshell/linux.py similarity index 93% rename from volatility/cli/volshell/linux.py rename to volatility3/cli/volshell/linux.py index 03c54bda9..73d5481aa 100644 --- a/volatility/cli/volshell/linux.py +++ b/volatility3/cli/volshell/linux.py @@ -4,10 +4,10 @@ from typing import Any, List, Tuple, Union -from volatility.cli.volshell import generic -from volatility.framework import interfaces, constants -from volatility.framework.configuration import requirements -from volatility.plugins.linux import pslist +from volatility3.cli.volshell import generic +from volatility3.framework import interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.plugins.linux import pslist class Volshell(generic.Volshell): diff --git a/volatility/cli/volshell/mac.py b/volatility3/cli/volshell/mac.py similarity index 93% rename from volatility/cli/volshell/mac.py rename to volatility3/cli/volshell/mac.py index d0ae4cb13..662f8dcb4 100644 --- a/volatility/cli/volshell/mac.py +++ b/volatility3/cli/volshell/mac.py @@ -4,10 +4,10 @@ from typing import Any, List, Tuple, Union -from volatility.cli.volshell import generic -from volatility.framework import constants, interfaces -from volatility.framework.configuration import requirements -from volatility.plugins.mac import pslist +from volatility3.cli.volshell import generic +from volatility3.framework import constants, interfaces +from volatility3.framework.configuration import requirements +from volatility3.plugins.mac import pslist class Volshell(generic.Volshell): diff --git a/volatility/cli/volshell/windows.py b/volatility3/cli/volshell/windows.py similarity index 92% rename from volatility/cli/volshell/windows.py rename to volatility3/cli/volshell/windows.py index 7f4c4fcc1..d9de5a92f 100644 --- a/volatility/cli/volshell/windows.py +++ b/volatility3/cli/volshell/windows.py @@ -4,10 +4,10 @@ from typing import Any, List, Tuple, Union -from volatility.cli.volshell import generic -from volatility.framework import interfaces, constants -from volatility.framework.configuration import requirements -from volatility.plugins.windows import pslist +from volatility3.cli.volshell import generic +from volatility3.framework import interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.plugins.windows import pslist class Volshell(generic.Volshell): diff --git a/volatility/framework/__init__.py b/volatility3/framework/__init__.py similarity index 96% rename from volatility/framework/__init__.py rename to volatility3/framework/__init__.py index b0a9feeae..e8c67588c 100644 --- a/volatility/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -19,7 +19,7 @@ import logging import os from typing import Any, Dict, Generator, List, Tuple, Type, TypeVar -from volatility.framework import constants, interfaces +from volatility3.framework import constants, interfaces # ## # @@ -120,8 +120,8 @@ def list_plugins() -> Dict[str, Type[interfaces.plugins.PluginInterface]]: plugin_list = {} for plugin in class_subclasses(interfaces.plugins.PluginInterface): plugin_name = plugin.__module__ + "." + plugin.__name__ - if plugin_name.startswith("volatility.plugins."): - plugin_name = plugin_name[len("volatility.plugins."):] + if plugin_name.startswith("volatility3.plugins."): + plugin_name = plugin_name[len("volatility3.plugins."):] plugin_list[plugin_name] = plugin return plugin_list diff --git a/volatility/framework/automagic/__init__.py b/volatility3/framework/automagic/__init__.py similarity index 92% rename from volatility/framework/automagic/__init__.py rename to volatility3/framework/automagic/__init__.py index 2541214a0..be1badb6b 100644 --- a/volatility/framework/automagic/__init__.py +++ b/volatility3/framework/automagic/__init__.py @@ -16,8 +16,8 @@ import sys import traceback from typing import List, Type, Union -from volatility.framework import class_subclasses, import_files, interfaces, constants -from volatility.framework.configuration import requirements +from volatility3.framework import class_subclasses, import_files, interfaces, constants +from volatility3.framework.configuration import requirements vollog = logging.getLogger(__name__) @@ -30,7 +30,7 @@ mac_automagic = ['ConstructionMagic', 'LayerStacker', 'MacBannerCache', 'MacSymb def available(context: interfaces.context.ContextInterface) -> List[interfaces.automagic.AutomagicInterface]: """Returns an ordered list of all subclasses of - :class:`~volatility.framework.interfaces.automagic.AutomagicInterface`. + :class:`~volatility3.framework.interfaces.automagic.AutomagicInterface`. The order is based on the priority attributes of the subclasses, in order to ensure the automagics are listed in an appropriate order. @@ -90,9 +90,9 @@ def run(automagics: List[interfaces.automagic.AutomagicInterface], changes to the context. Args: - automagics: A list of :class:`~volatility.framework.interfaces.automagic.AutomagicInterface` objects - context: The context (that inherits from :class:`~volatility.framework.interfaces.context.ContextInterface`) for modification - configurable: An object that inherits from :class:`~volatility.framework.interfaces.configuration.ConfigurableInterface` + automagics: A list of :class:`~volatility3.framework.interfaces.automagic.AutomagicInterface` objects + context: The context (that inherits from :class:`~volatility3.framework.interfaces.context.ContextInterface`) for modification + configurable: An object that inherits from :class:`~volatility3.framework.interfaces.configuration.ConfigurableInterface` config_path: The path within the `context.config` for options required by the `configurable` progress_callback: A function that takes a percentage (and an optional description) that will be called periodically diff --git a/volatility/framework/automagic/construct_layers.py b/volatility3/framework/automagic/construct_layers.py similarity index 88% rename from volatility/framework/automagic/construct_layers.py rename to volatility3/framework/automagic/construct_layers.py index 66288db69..15e6af4bd 100644 --- a/volatility/framework/automagic/construct_layers.py +++ b/volatility3/framework/automagic/construct_layers.py @@ -2,16 +2,16 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """An automagic module to use configuration data to configure and then -construct classes that fulfill the descendants of a :class:`~volatility.framewo +construct classes that fulfill the descendants of a :class:`~volatility3.framewo rk.interfaces.configuration.ConfigurableInterface`.""" import logging import sys from typing import List -from volatility import framework -from volatility.framework import constants -from volatility.framework import interfaces +from volatility3 import framework +from volatility3.framework import constants +from volatility3.framework import interfaces vollog = logging.getLogger(__name__) @@ -19,9 +19,9 @@ vollog = logging.getLogger(__name__) class ConstructionMagic(interfaces.automagic.AutomagicInterface): """Constructs underlying layers. - Class to run through the requirement tree of the :class:`~volatility.framework.interfaces.configuration.ConfigurableInterface` + Class to run through the requirement tree of the :class:`~volatility3.framework.interfaces.configuration.ConfigurableInterface` and from the bottom of the tree upwards, attempt to construct all - :class:`~volatility.framework.interfaces.configuration.ConstructableRequirementInterface` based classes. + :class:`~volatility3.framework.interfaces.configuration.ConstructableRequirementInterface` based classes. :warning: This `automagic` should run first to allow existing configurations to have been constructed for use by later automagic """ @@ -35,7 +35,7 @@ class ConstructionMagic(interfaces.automagic.AutomagicInterface): optional = False) -> List[str]: # Make sure we import the layers, so they can reconstructed - framework.import_files(sys.modules['volatility.framework.layers']) + framework.import_files(sys.modules['volatility3.framework.layers']) result = [] # type: List[str] if requirement.unsatisfied(context, config_path): diff --git a/volatility/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py similarity index 95% rename from volatility/framework/automagic/linux.py rename to volatility3/framework/automagic/linux.py index 3590f18b5..34d6e7936 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -5,10 +5,10 @@ import logging from typing import Optional, Tuple, Type -from volatility.framework import interfaces, constants -from volatility.framework.automagic import symbol_cache, symbol_finder -from volatility.framework.layers import intel, scanners -from volatility.framework.symbols import linux +from volatility3.framework import interfaces, constants +from volatility3.framework.automagic import symbol_cache, symbol_finder +from volatility3.framework.layers import intel, scanners +from volatility3.framework.symbols import linux vollog = logging.getLogger(__name__) @@ -153,5 +153,5 @@ class LinuxSymbolFinder(symbol_finder.SymbolFinder): banner_config_key = "kernel_banner" banner_cache = LinuxBannerCache - symbol_class = "volatility.framework.symbols.linux.LinuxKernelIntermedSymbols" + symbol_class = "volatility3.framework.symbols.linux.LinuxKernelIntermedSymbols" find_aslr = lambda cls, *args: LinuxIntelStacker.find_aslr(*args)[1] diff --git a/volatility/framework/automagic/mac.py b/volatility3/framework/automagic/mac.py similarity index 96% rename from volatility/framework/automagic/mac.py rename to volatility3/framework/automagic/mac.py index e88de792f..3ba179068 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility3/framework/automagic/mac.py @@ -6,10 +6,10 @@ import logging import struct from typing import Optional -from volatility.framework import interfaces, constants, layers -from volatility.framework.automagic import symbol_cache, symbol_finder -from volatility.framework.layers import intel, scanners -from volatility.framework.symbols import mac +from volatility3.framework import interfaces, constants, layers +from volatility3.framework.automagic import symbol_cache, symbol_finder +from volatility3.framework.layers import intel, scanners +from volatility3.framework.symbols import mac vollog = logging.getLogger(__name__) @@ -204,4 +204,4 @@ class MacSymbolFinder(symbol_finder.SymbolFinder): banner_config_key = 'kernel_banner' banner_cache = MacBannerCache find_aslr = MacIntelStacker.find_aslr - symbol_class = "volatility.framework.symbols.mac.MacKernelIntermedSymbols" + symbol_class = "volatility3.framework.symbols.mac.MacKernelIntermedSymbols" diff --git a/volatility/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py similarity index 96% rename from volatility/framework/automagic/pdbscan.py rename to volatility3/framework/automagic/pdbscan.py index 8ad750737..59b78c3ca 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -4,19 +4,19 @@ """A module for scanning translation layers looking for Windows PDB records from loaded PE files. -This module contains a standalone scanner, and also a :class:`~volatility.framework.interfaces.layers.ScannerInterface` -based scanner for use within the framework by calling :func:`~volatility.framework.interfaces.layers.DataLayerInterface.scan`. +This module contains a standalone scanner, and also a :class:`~volatility3.framework.interfaces.layers.ScannerInterface` +based scanner for use within the framework by calling :func:`~volatility3.framework.interfaces.layers.DataLayerInterface.scan`. """ import logging import math import os from typing import Any, Dict, Iterable, List, Optional, Set, Tuple, Union -from volatility.framework import constants, exceptions, interfaces, layers -from volatility.framework.configuration import requirements -from volatility.framework.layers import intel, scanners -from volatility.framework.symbols import native -from volatility.framework.symbols.windows.pdbutil import PDBUtility +from volatility3.framework import constants, exceptions, interfaces, layers +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import intel, scanners +from volatility3.framework.symbols import native +from volatility3.framework.symbols.windows.pdbutil import PDBUtility if __name__ == "__main__": import sys @@ -55,7 +55,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): Args: context: The context in which the `requirement` lives config_path: The path within the `context` for the `requirement`'s configuration variables - requirement: The root of the requirement tree to search for :class:~`volatility.framework.interfaces.layers.TranslationLayerRequirement` objects to scan + requirement: The root of the requirement tree to search for :class:~`volatility3.framework.interfaces.layers.TranslationLayerRequirement` objects to scan progress_callback: Means of providing the user with feedback during long processes Returns: @@ -105,7 +105,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): guid = kernel['GUID'], age = kernel['age'], pdb_name = kernel['pdb_name'], - symbol_table_class = "volatility.framework.symbols.windows.WindowsKernelIntermedSymbols", + symbol_table_class = "volatility3.framework.symbols.windows.WindowsKernelIntermedSymbols", config_path = sub_config_path, progress_callback = progress_callback) else: diff --git a/volatility/framework/automagic/stacker.py b/volatility3/framework/automagic/stacker.py similarity index 93% rename from volatility/framework/automagic/stacker.py rename to volatility3/framework/automagic/stacker.py index 1c24384ad..78fbab76c 100644 --- a/volatility/framework/automagic/stacker.py +++ b/volatility3/framework/automagic/stacker.py @@ -3,7 +3,7 @@ # """This module attempts to automatically stack layers. -This automagic module fulfills :class:`~volatility.framework.interfaces.configuration.TranslationLayerRequirement` that are not already fulfilled, by attempting to +This automagic module fulfills :class:`~volatility3.framework.interfaces.configuration.TranslationLayerRequirement` that are not already fulfilled, by attempting to stack as many layers on top of each other as possible. The base/lowest layer is derived from the "automagic.general.single_location" configuration path. Layers are then attempting in likely height order, and once a layer successfully stacks on top of the existing layers, it is removed from the possible choices list @@ -15,11 +15,11 @@ import sys import traceback from typing import Any, List, Optional, Tuple, Type -from volatility import framework -from volatility.framework import interfaces, constants -from volatility.framework.automagic import construct_layers -from volatility.framework.configuration import requirements -from volatility.framework.layers import physical +from volatility3 import framework +from volatility3.framework import interfaces, constants +from volatility3.framework.automagic import construct_layers +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import physical vollog = logging.getLogger(__name__) @@ -28,11 +28,11 @@ class LayerStacker(interfaces.automagic.AutomagicInterface): """Builds up layers in a single stack. This class mimics the volatility 2 style of stacking address spaces. It builds up various layers based on - separate :class:`~volatility.framework.interfaces.automagic.StackerLayerInterface` classes. These classes are + separate :class:`~volatility3.framework.interfaces.automagic.StackerLayerInterface` classes. These classes are built up based on a `stack_order` class variable each has. This has a high priority to provide other automagic modules as complete a context/configuration tree as possible. - Upon completion it will re-call the :class:`~volatility.framework.automagic.construct_layers.ConstructionMagic`, + Upon completion it will re-call the :class:`~volatility3.framework.automagic.construct_layers.ConstructionMagic`, so that any stacked layers are actually constructed and added to the context. """ # Most important automagic, must happen first! @@ -49,7 +49,7 @@ class LayerStacker(interfaces.automagic.AutomagicInterface): progress_callback: constants.ProgressCallback = None) -> Optional[List[str]]: """Runs the automagic over the configurable.""" - framework.import_files(sys.modules['volatility.framework.layers']) + framework.import_files(sys.modules['volatility3.framework.layers']) # Quick exit if we're not needed if not requirement.unsatisfied(context, config_path): @@ -250,7 +250,7 @@ def choose_os_stackers(plugin: Type[interfaces.plugins.PluginInterface]) -> List plugin_first_level = plugin.__module__.split('.')[2] # Ensure all stackers are loaded - framework.import_files(sys.modules['volatility.framework.layers']) + framework.import_files(sys.modules['volatility3.framework.layers']) result = [] for stacker in sorted(framework.class_subclasses(interfaces.automagic.StackerLayerInterface), diff --git a/volatility/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py similarity index 97% rename from volatility/framework/automagic/symbol_cache.py rename to volatility3/framework/automagic/symbol_cache.py index 89d72718f..b2407f8e9 100644 --- a/volatility/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -11,8 +11,8 @@ import urllib.parse import urllib.request from typing import Dict, List, Optional -from volatility.framework import constants, exceptions, interfaces -from volatility.framework.symbols import intermed +from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework.symbols import intermed vollog = logging.getLogger(__name__) diff --git a/volatility/framework/automagic/symbol_finder.py b/volatility3/framework/automagic/symbol_finder.py similarity index 96% rename from volatility/framework/automagic/symbol_finder.py rename to volatility3/framework/automagic/symbol_finder.py index 50844d0fa..f29976769 100644 --- a/volatility/framework/automagic/symbol_finder.py +++ b/volatility3/framework/automagic/symbol_finder.py @@ -5,10 +5,10 @@ import logging from typing import Any, Iterable, List, Tuple, Type, Optional, Callable -from volatility.framework import interfaces, constants, layers, exceptions -from volatility.framework.automagic import symbol_cache -from volatility.framework.configuration import requirements -from volatility.framework.layers import scanners +from volatility3.framework import interfaces, constants, layers, exceptions +from volatility3.framework.automagic import symbol_cache +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import scanners vollog = logging.getLogger(__name__) diff --git a/volatility/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py similarity index 98% rename from volatility/framework/automagic/windows.py rename to volatility3/framework/automagic/windows.py index 3f33f1c58..198e64e99 100644 --- a/volatility/framework/automagic/windows.py +++ b/volatility3/framework/automagic/windows.py @@ -30,9 +30,9 @@ import logging import struct from typing import Any, Generator, List, Optional, Tuple, Type -from volatility.framework import interfaces, layers, constants -from volatility.framework.configuration import requirements -from volatility.framework.layers import intel +from volatility3.framework import interfaces, layers, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import intel vollog = logging.getLogger(__name__) @@ -225,14 +225,13 @@ class PageMapScanner(interfaces.layers.ScannerInterface): for page_offset in range(0, len(data), 0x1000): result = test(data, data_offset, page_offset) if result is not None: - if result[0] < self.chunk_size: - yield (test, result[0]) + yield (test, result[0]) class WintelHelper(interfaces.automagic.AutomagicInterface): """Windows DTB finder based on self-referential pointers. - This class adheres to the :class:`~volatility.framework.interfaces.automagic.AutomagicInterface` interface + This class adheres to the :class:`~volatility3.framework.interfaces.automagic.AutomagicInterface` interface and both determines the directory table base of an intel layer if one hasn't been specified, and constructs the intel layer if necessary (for example when reconstructing a pre-existing configuration). @@ -415,7 +414,7 @@ class WinSwapLayers(interfaces.automagic.AutomagicInterface): if swap_location: context.config[current_layer_path] = current_layer_name context.config[layer_loc_path] = swap_location - context.config[layer_class_path] = 'volatility.framework.layers.physical.FileLayer' + context.config[layer_class_path] = 'volatility3.framework.layers.physical.FileLayer' # Add the requirement new_req = requirements.TranslationLayerRequirement(name = current_layer_name, diff --git a/volatility/framework/configuration/__init__.py b/volatility3/framework/configuration/__init__.py similarity index 75% rename from volatility/framework/configuration/__init__.py rename to volatility3/framework/configuration/__init__.py index 175dcf295..7a84ee455 100644 --- a/volatility/framework/configuration/__init__.py +++ b/volatility3/framework/configuration/__init__.py @@ -2,4 +2,4 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework.configuration import requirements +from volatility3.framework.configuration import requirements diff --git a/volatility/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py similarity index 99% rename from volatility/framework/configuration/requirements.py rename to volatility3/framework/configuration/requirements.py index 2b5042d43..2a8881ace 100644 --- a/volatility/framework/configuration/requirements.py +++ b/volatility3/framework/configuration/requirements.py @@ -12,7 +12,7 @@ import abc import logging from typing import Any, ClassVar, List, Optional, Type, Dict, Tuple -from volatility.framework import constants, interfaces +from volatility3.framework import constants, interfaces vollog = logging.getLogger(__name__) diff --git a/volatility/framework/constants/__init__.py b/volatility3/framework/constants/__init__.py similarity index 88% rename from volatility/framework/constants/__init__.py rename to volatility3/framework/constants/__init__.py index b39fc2b7a..5a5e5f1c5 100644 --- a/volatility/framework/constants/__init__.py +++ b/volatility3/framework/constants/__init__.py @@ -11,20 +11,20 @@ import os.path import sys from typing import Optional, Callable -import volatility.framework.constants.linux -import volatility.framework.constants.windows +import volatility3.framework.constants.linux +import volatility3.framework.constants.windows PLUGINS_PATH = [ os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "plugins")), os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "plugins")) ] -"""Default list of paths to load plugins from (volatility/plugins and volatility/framework/plugins)""" +"""Default list of paths to load plugins from (volatility3/plugins and volatility3/framework/plugins)""" SYMBOL_BASEPATHS = [ os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "symbols")), os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "symbols")) ] -"""Default list of paths to load symbols from (volatility/symbols and volatility/framework/symbols)""" +"""Default list of paths to load symbols from (volatility3/symbols and volatility3/framework/symbols)""" ISF_EXTENSIONS = ['.json', '.json.xz', '.json.gz', '.json.bz2'] """List of accepted extensions for ISF files""" @@ -38,13 +38,13 @@ BANG = "!" """Constant used to delimit table names from type names when referring to a symbol""" # We use the SemVer 2.0.0 versioning scheme -VERSION_MAJOR = 2 # Number of releases of the library with a breaking change +VERSION_MAJOR = 1 # Number of releases of the library with a breaking change VERSION_MINOR = 0 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface -VERSION_SUFFIX = "-beta.1" +VERSION_SUFFIX = "" PACKAGE_VERSION = ".".join([str(x) for x in [VERSION_MAJOR, VERSION_MINOR, VERSION_PATCH]]) + VERSION_SUFFIX -"""The canonical version of the volatility package""" +"""The canonical version of the volatility3 package""" AUTOMAGIC_CONFIG_PATH = 'automagic' """The root section within the context configuration for automagic values""" diff --git a/volatility/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py similarity index 100% rename from volatility/framework/constants/linux/__init__.py rename to volatility3/framework/constants/linux/__init__.py diff --git a/volatility/framework/constants/windows/__init__.py b/volatility3/framework/constants/windows/__init__.py similarity index 100% rename from volatility/framework/constants/windows/__init__.py rename to volatility3/framework/constants/windows/__init__.py diff --git a/volatility/framework/contexts/__init__.py b/volatility3/framework/contexts/__init__.py similarity index 97% rename from volatility/framework/contexts/__init__.py rename to volatility3/framework/contexts/__init__.py index ba23847ba..c082a29dd 100644 --- a/volatility/framework/contexts/__init__.py +++ b/volatility3/framework/contexts/__init__.py @@ -12,8 +12,8 @@ import functools import hashlib from typing import Callable, Dict, Iterable, List, Optional, Set, Tuple, Union -from volatility.framework import constants, interfaces, symbols, exceptions -from volatility.framework.objects import templates +from volatility3.framework import constants, interfaces, symbols, exceptions +from volatility3.framework.objects import templates class Context(interfaces.context.ContextInterface): @@ -25,7 +25,7 @@ class Context(interfaces.context.ContextInterface): for creating new objects. Other context objects can be constructed as long as they support the - :class:`~volatility.framework.interfaces.context.ContextInterface`. This is the primary context object to be used + :class:`~volatility3.framework.interfaces.context.ContextInterface`. This is the primary context object to be used in the volatility framework. It maintains the """ @@ -71,7 +71,7 @@ class Context(interfaces.context.ContextInterface): layer: The layer to be added to the memory Raises: - volatility.framework.exceptions.LayerException: if the layer is already present, or has + volatility3.framework.exceptions.LayerException: if the layer is already present, or has unmet dependencies """ self._memory.add_layer(layer) diff --git a/volatility/framework/exceptions.py b/volatility3/framework/exceptions.py similarity index 98% rename from volatility/framework/exceptions.py rename to volatility3/framework/exceptions.py index c92b65af5..117933bbd 100644 --- a/volatility/framework/exceptions.py +++ b/volatility3/framework/exceptions.py @@ -10,7 +10,7 @@ size of the invalid page. """ from typing import Dict, Optional -from volatility.framework import interfaces +from volatility3.framework import interfaces class VolatilityException(Exception): diff --git a/volatility/framework/interfaces/__init__.py b/volatility3/framework/interfaces/__init__.py similarity index 85% rename from volatility/framework/interfaces/__init__.py rename to volatility3/framework/interfaces/__init__.py index 17fd6f011..05cf7d837 100644 --- a/volatility/framework/interfaces/__init__.py +++ b/volatility3/framework/interfaces/__init__.py @@ -12,5 +12,5 @@ components of volatility to write plugins. # Import the submodules we want people to be able to use without importing them themselves # This will also avoid namespace issues, because people can use interfaces.layers to # avoid clashing with the layers package -from volatility.framework.interfaces import renderers, configuration, context, layers, objects, plugins, symbols, \ +from volatility3.framework.interfaces import renderers, configuration, context, layers, objects, plugins, symbols, \ automagic diff --git a/volatility/framework/interfaces/automagic.py b/volatility3/framework/interfaces/automagic.py similarity index 98% rename from volatility/framework/interfaces/automagic.py rename to volatility3/framework/interfaces/automagic.py index ee4dad053..c6eb2e5ce 100644 --- a/volatility/framework/interfaces/automagic.py +++ b/volatility3/framework/interfaces/automagic.py @@ -11,8 +11,8 @@ import logging from abc import ABCMeta from typing import Any, List, Optional, Tuple, Union, Type -from volatility.framework import interfaces, constants -from volatility.framework.configuration import requirements +from volatility3.framework import interfaces, constants +from volatility3.framework.configuration import requirements vollog = logging.getLogger(__name__) diff --git a/volatility/framework/interfaces/configuration.py b/volatility3/framework/interfaces/configuration.py similarity index 98% rename from volatility/framework/interfaces/configuration.py rename to volatility3/framework/interfaces/configuration.py index a52b9984f..418763d6d 100644 --- a/volatility/framework/interfaces/configuration.py +++ b/volatility3/framework/interfaces/configuration.py @@ -25,8 +25,8 @@ import sys from abc import ABCMeta, abstractmethod from typing import Any, ClassVar, Dict, Generator, Iterator, List, Optional, Type, Union, Tuple -from volatility import classproperty -from volatility.framework import constants, interfaces +from volatility3 import classproperty +from volatility3.framework import constants, interfaces CONFIG_SEPARATOR = "." """Use to specify the separator between configuration hierarchies""" @@ -292,10 +292,10 @@ class RequirementInterface(metaclass = ABCMeta): A requirement is a means for plugins and other framework components to request specific configuration data. Requirements can either be simple types (such as - :class:`~volatility.framework.configuration.requirements.SimpleTypeRequirement`, - :class:`~volatility.framework.configuration.requirements.IntRequirement`, - :class:`~volatility.framework.configuration.requirements.BytesRequirement` and - :class:`~volatility.framework.configuration.requirements.StringRequirement`) or complex types (such + :class:`~volatility3.framework.configuration.requirements.SimpleTypeRequirement`, + :class:`~volatility3.framework.configuration.requirements.IntRequirement`, + :class:`~volatility3.framework.configuration.requirements.BytesRequirement` and + :class:`~volatility3.framework.configuration.requirements.StringRequirement`) or complex types (such as :class:`TranslationLayerRequirement`, :class:`SymbolTableRequirement` and :class:`ClassRequirement` """ diff --git a/volatility/framework/interfaces/context.py b/volatility3/framework/interfaces/context.py similarity index 98% rename from volatility/framework/interfaces/context.py rename to volatility3/framework/interfaces/context.py index 0dff023c1..6fede426a 100644 --- a/volatility/framework/interfaces/context.py +++ b/volatility3/framework/interfaces/context.py @@ -15,7 +15,7 @@ import copy from abc import ABCMeta, abstractmethod from typing import Optional, Union -from volatility.framework import interfaces +from volatility3.framework import interfaces class ContextInterface(metaclass = ABCMeta): @@ -39,7 +39,7 @@ class ContextInterface(metaclass = ABCMeta): def symbol_space(self) -> 'interfaces.symbols.SymbolSpaceInterface': """Returns the symbol_space for the context. - This object must support the :class:`~volatility.framework.interfaces.symbols.SymbolSpaceInterface` + This object must support the :class:`~volatility3.framework.interfaces.symbols.SymbolSpaceInterface` """ # ## Memory Functions diff --git a/volatility/framework/interfaces/layers.py b/volatility3/framework/interfaces/layers.py similarity index 99% rename from volatility/framework/interfaces/layers.py rename to volatility3/framework/interfaces/layers.py index 49d6920aa..56426331e 100644 --- a/volatility/framework/interfaces/layers.py +++ b/volatility3/framework/interfaces/layers.py @@ -18,7 +18,7 @@ import types from abc import ABCMeta, abstractmethod from typing import Any, Callable, Dict, Iterable, List, Mapping, Optional, Tuple, Union -from volatility.framework import constants, exceptions, interfaces +from volatility3.framework import constants, exceptions, interfaces vollog = logging.getLogger(__name__) diff --git a/volatility/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py similarity index 99% rename from volatility/framework/interfaces/objects.py rename to volatility3/framework/interfaces/objects.py index 88e6c061f..2f794b565 100644 --- a/volatility/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -9,7 +9,7 @@ import collections.abc import logging from typing import Any, Dict, List, Mapping, Optional -from volatility.framework import constants, interfaces +from volatility3.framework import constants, interfaces vollog = logging.getLogger(__name__) @@ -281,7 +281,7 @@ class Template: @property def vol(self) -> ReadOnlyMapping: """Returns a volatility information object, much like the - :class:`~volatility.framework.interfaces.objects.ObjectInformation` + :class:`~volatility3.framework.interfaces.objects.ObjectInformation` provides.""" return ReadOnlyMapping(self._vol) diff --git a/volatility/framework/interfaces/plugins.py b/volatility3/framework/interfaces/plugins.py similarity index 95% rename from volatility/framework/interfaces/plugins.py rename to volatility3/framework/interfaces/plugins.py index c3fbbf65a..5649629ca 100644 --- a/volatility/framework/interfaces/plugins.py +++ b/volatility3/framework/interfaces/plugins.py @@ -14,8 +14,8 @@ import os from abc import ABCMeta, abstractmethod from typing import List, Tuple, Type -from volatility import framework -from volatility.framework import exceptions, constants, interfaces +from volatility3 import framework +from volatility3.framework import exceptions, constants, interfaces vollog = logging.getLogger(__name__) @@ -94,8 +94,8 @@ class PluginInterface(interfaces.configuration.ConfigurableInterface, and configuration information in the context it is passed. """ - # Be careful with inheritance around this - _required_framework_version = (1, 0, 0) # type: Tuple[int, int, int] + # Be careful with inheritance around this (We default to requiring a version which doesn't exist, so it must be set) + _required_framework_version = (0, 0, 0) # type: Tuple[int, int, int] """The _version variable is a quick way for plugins to define their current interface, it should follow SemVer rules""" def __init__(self, diff --git a/volatility/framework/interfaces/renderers.py b/volatility3/framework/interfaces/renderers.py similarity index 100% rename from volatility/framework/interfaces/renderers.py rename to volatility3/framework/interfaces/renderers.py diff --git a/volatility/framework/interfaces/symbols.py b/volatility3/framework/interfaces/symbols.py similarity index 98% rename from volatility/framework/interfaces/symbols.py rename to volatility3/framework/interfaces/symbols.py index 77d00337d..8f427d233 100644 --- a/volatility/framework/interfaces/symbols.py +++ b/volatility3/framework/interfaces/symbols.py @@ -7,10 +7,10 @@ import collections.abc from abc import abstractmethod, ABC from typing import Any, Dict, Iterable, List, Optional, Tuple, Type, Mapping -from volatility.framework import constants, exceptions, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import configuration, objects -from volatility.framework.interfaces.configuration import RequirementInterface +from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import configuration, objects +from volatility3.framework.interfaces.configuration import RequirementInterface class SymbolInterface: diff --git a/volatility/framework/layers/__init__.py b/volatility3/framework/layers/__init__.py similarity index 100% rename from volatility/framework/layers/__init__.py rename to volatility3/framework/layers/__init__.py diff --git a/volatility/framework/layers/codecs/__init__.py b/volatility3/framework/layers/codecs/__init__.py similarity index 100% rename from volatility/framework/layers/codecs/__init__.py rename to volatility3/framework/layers/codecs/__init__.py diff --git a/volatility/framework/layers/crash.py b/volatility3/framework/layers/crash.py similarity index 98% rename from volatility/framework/layers/crash.py rename to volatility3/framework/layers/crash.py index 9f239fd13..8909eceb8 100644 --- a/volatility/framework/layers/crash.py +++ b/volatility3/framework/layers/crash.py @@ -6,9 +6,9 @@ import logging import struct from typing import Tuple, Optional -from volatility.framework import constants, exceptions, interfaces -from volatility.framework.layers import segmented -from volatility.framework.symbols import intermed +from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework.layers import segmented +from volatility3.framework.symbols import intermed vollog = logging.getLogger(__name__) diff --git a/volatility/framework/layers/elf.py b/volatility3/framework/layers/elf.py similarity index 95% rename from volatility/framework/layers/elf.py rename to volatility3/framework/layers/elf.py index 022fc4968..48876c286 100644 --- a/volatility/framework/layers/elf.py +++ b/volatility3/framework/layers/elf.py @@ -5,9 +5,9 @@ import logging import struct from typing import Optional -from volatility.framework import exceptions, interfaces, constants -from volatility.framework.layers import segmented -from volatility.framework.symbols import intermed +from volatility3.framework import exceptions, interfaces, constants +from volatility3.framework.layers import segmented +from volatility3.framework.symbols import intermed vollog = logging.getLogger(__name__) diff --git a/volatility/framework/layers/intel.py b/volatility3/framework/layers/intel.py similarity index 97% rename from volatility/framework/layers/intel.py rename to volatility3/framework/layers/intel.py index cc5aa98aa..cf78bbcd1 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -9,10 +9,10 @@ import math import struct from typing import Any, Dict, Iterable, List, Optional, Tuple -from volatility import classproperty -from volatility.framework import exceptions, interfaces, constants -from volatility.framework.configuration import requirements -from volatility.framework.layers import linear +from volatility3 import classproperty +from volatility3.framework import exceptions, interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import linear vollog = logging.getLogger(__name__) @@ -247,6 +247,7 @@ class IntelPAE(Intel): _maxphyaddr = 40 _maxvirtaddr = 32 _structure = [('page directory pointer', 2, False), ('page directory', 9, True), ('page table', 9, True)] + _direct_metadata = collections.ChainMap({'pae': True}, Intel._direct_metadata) class Intel32e(Intel): diff --git a/volatility/framework/layers/lime.py b/volatility3/framework/layers/lime.py similarity index 96% rename from volatility/framework/layers/lime.py rename to volatility3/framework/layers/lime.py index 45e2ac9dc..ae93f7b7a 100644 --- a/volatility/framework/layers/lime.py +++ b/volatility3/framework/layers/lime.py @@ -5,8 +5,8 @@ import struct from typing import Optional, Tuple -from volatility.framework import exceptions, interfaces, constants -from volatility.framework.layers import segmented +from volatility3.framework import exceptions, interfaces, constants +from volatility3.framework.layers import segmented class LimeFormatException(exceptions.LayerException): diff --git a/volatility/framework/layers/linear.py b/volatility3/framework/layers/linear.py similarity index 98% rename from volatility/framework/layers/linear.py rename to volatility3/framework/layers/linear.py index 84ec081ea..80f71ec35 100644 --- a/volatility/framework/layers/linear.py +++ b/volatility3/framework/layers/linear.py @@ -1,7 +1,7 @@ import functools from typing import List, Optional, Tuple, Iterable -from volatility.framework import exceptions, interfaces +from volatility3.framework import exceptions, interfaces class LinearlyMappedLayer(interfaces.layers.TranslationLayerInterface): diff --git a/volatility/framework/layers/msf.py b/volatility3/framework/layers/msf.py similarity index 97% rename from volatility/framework/layers/msf.py rename to volatility3/framework/layers/msf.py index c030b5354..442ba8728 100644 --- a/volatility/framework/layers/msf.py +++ b/volatility3/framework/layers/msf.py @@ -4,11 +4,11 @@ import math from typing import Optional, Dict, Any, List, Iterable, Tuple -from volatility.framework import interfaces, constants, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import linear -from volatility.framework.objects import utility -from volatility.framework.symbols import intermed +from volatility3.framework import interfaces, constants, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import linear +from volatility3.framework.objects import utility +from volatility3.framework.symbols import intermed class PDBFormatException(exceptions.LayerException): diff --git a/volatility/framework/layers/physical.py b/volatility3/framework/layers/physical.py similarity index 97% rename from volatility/framework/layers/physical.py rename to volatility3/framework/layers/physical.py index a75e08065..7e4e76a6e 100644 --- a/volatility/framework/layers/physical.py +++ b/volatility3/framework/layers/physical.py @@ -4,9 +4,9 @@ import threading from typing import Any, Dict, IO, List, Optional, Union -from volatility.framework import exceptions, interfaces, constants -from volatility.framework.configuration import requirements -from volatility.framework.layers import resources +from volatility3.framework import exceptions, interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import resources class BufferDataLayer(interfaces.layers.DataLayerInterface): diff --git a/volatility/framework/layers/qemu.py b/volatility3/framework/layers/qemu.py similarity index 98% rename from volatility/framework/layers/qemu.py rename to volatility3/framework/layers/qemu.py index d5f926639..8a2621fa8 100644 --- a/volatility/framework/layers/qemu.py +++ b/volatility3/framework/layers/qemu.py @@ -6,9 +6,9 @@ import json import math from typing import Optional, Dict, Any, Tuple, List, Set -from volatility.framework import interfaces, exceptions, constants -from volatility.framework.layers import segmented -from volatility.framework.symbols import intermed +from volatility3.framework import interfaces, exceptions, constants +from volatility3.framework.layers import segmented +from volatility3.framework.symbols import intermed class QemuSuspendLayer(segmented.NonLinearlySegmentedLayer): diff --git a/volatility/framework/layers/registry.py b/volatility3/framework/layers/registry.py similarity index 96% rename from volatility/framework/layers/registry.py rename to volatility3/framework/layers/registry.py index 82128b4f4..32acbc4a9 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -5,13 +5,13 @@ import logging from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple, Union -from volatility.framework import constants, exceptions, interfaces, objects -from volatility.framework.configuration import requirements -from volatility.framework.configuration.requirements import IntRequirement, TranslationLayerRequirement -from volatility.framework.exceptions import InvalidAddressException -from volatility.framework.layers import linear -from volatility.framework.symbols import intermed -from volatility.plugins.windows import pslist +from volatility3.framework import constants, exceptions, interfaces, objects +from volatility3.framework.configuration import requirements +from volatility3.framework.configuration.requirements import IntRequirement, TranslationLayerRequirement +from volatility3.framework.exceptions import InvalidAddressException +from volatility3.framework.layers import linear +from volatility3.framework.symbols import intermed +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/layers/resources.py b/volatility3/framework/layers/resources.py similarity index 99% rename from volatility/framework/layers/resources.py rename to volatility3/framework/layers/resources.py index 1a2402008..d99f7135c 100644 --- a/volatility/framework/layers/resources.py +++ b/volatility3/framework/layers/resources.py @@ -16,8 +16,8 @@ import zipfile from typing import Optional, Any, IO from urllib import error -from volatility import framework -from volatility.framework import constants +from volatility3 import framework +from volatility3.framework import constants try: import magic diff --git a/volatility/framework/layers/scanners/__init__.py b/volatility3/framework/layers/scanners/__init__.py similarity index 94% rename from volatility/framework/layers/scanners/__init__.py rename to volatility3/framework/layers/scanners/__init__.py index 45208161d..3b57d32e4 100644 --- a/volatility/framework/layers/scanners/__init__.py +++ b/volatility3/framework/layers/scanners/__init__.py @@ -5,8 +5,8 @@ import re from typing import Generator, List, Tuple -from volatility.framework.interfaces import layers -from volatility.framework.layers.scanners import multiregexp +from volatility3.framework.interfaces import layers +from volatility3.framework.layers.scanners import multiregexp class BytesScanner(layers.ScannerInterface): diff --git a/volatility/framework/layers/scanners/multiregexp.py b/volatility3/framework/layers/scanners/multiregexp.py similarity index 100% rename from volatility/framework/layers/scanners/multiregexp.py rename to volatility3/framework/layers/scanners/multiregexp.py diff --git a/volatility/framework/layers/segmented.py b/volatility3/framework/layers/segmented.py similarity index 97% rename from volatility/framework/layers/segmented.py rename to volatility3/framework/layers/segmented.py index d2f80ec32..8334c722d 100644 --- a/volatility/framework/layers/segmented.py +++ b/volatility3/framework/layers/segmented.py @@ -5,9 +5,9 @@ from abc import ABCMeta, abstractmethod from bisect import bisect_right from typing import Any, Dict, Iterable, List, Optional, Tuple -from volatility.framework import exceptions, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.layers import linear +from volatility3.framework import exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import linear class NonLinearlySegmentedLayer(interfaces.layers.TranslationLayerInterface, metaclass = ABCMeta): diff --git a/volatility/framework/layers/vmware.py b/volatility3/framework/layers/vmware.py similarity index 96% rename from volatility/framework/layers/vmware.py rename to volatility3/framework/layers/vmware.py index fc412fb2e..e0d6b172d 100644 --- a/volatility/framework/layers/vmware.py +++ b/volatility3/framework/layers/vmware.py @@ -5,10 +5,10 @@ import struct from typing import Any, Dict, List, Optional -from volatility.framework import interfaces, constants, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import physical, segmented, resources -from volatility.framework.symbols import native +from volatility3.framework import interfaces, constants, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import physical, segmented, resources +from volatility3.framework.symbols import native class VmwareFormatException(exceptions.LayerException): diff --git a/volatility/framework/objects/__init__.py b/volatility3/framework/objects/__init__.py similarity index 99% rename from volatility/framework/objects/__init__.py rename to volatility3/framework/objects/__init__.py index 30bbcbe74..6504b1259 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility3/framework/objects/__init__.py @@ -7,8 +7,8 @@ import logging import struct from typing import Any, ClassVar, Dict, List, Iterable, Optional, Tuple, Type, Union as TUnion, overload -from volatility.framework import interfaces, constants -from volatility.framework.objects import templates, utility +from volatility3.framework import interfaces, constants +from volatility3.framework.objects import templates, utility vollog = logging.getLogger(__name__) diff --git a/volatility/framework/objects/templates.py b/volatility3/framework/objects/templates.py similarity index 91% rename from volatility/framework/objects/templates.py rename to volatility3/framework/objects/templates.py index c19bc07e7..05938ff9c 100644 --- a/volatility/framework/objects/templates.py +++ b/volatility3/framework/objects/templates.py @@ -5,7 +5,7 @@ import functools import logging from typing import Any, ClassVar, Dict, List, Type -from volatility.framework import interfaces, exceptions, constants +from volatility3.framework import interfaces, exceptions, constants vollog = logging.getLogger(__name__) @@ -44,13 +44,13 @@ class ObjectTemplate(interfaces.objects.Template): def relative_child_offset(self, child: str) -> int: """Returns the relative offset of a child of the templated object (see - :class:`~volatility.framework.interfaces.objects.ObjectInterface.VolTem + :class:`~volatility3.framework.interfaces.objects.ObjectInterface.VolTem plateProxy`)""" return self.vol.object_class.VolTemplateProxy.relative_child_offset(self, child) def replace_child(self, old_child: interfaces.objects.Template, new_child: interfaces.objects.Template) -> None: """Replaces `old_child` for `new_child` in the templated object's child - list (see :class:`~volatility.framework.interfaces.objects.ObjectInterf + list (see :class:`~volatility3.framework.interfaces.objects.ObjectInterf ace.VolTemplateProxy`)""" return self.vol.object_class.VolTemplateProxy.replace_child(self, old_child, new_child) @@ -63,7 +63,7 @@ class ObjectTemplate(interfaces.objects.Template): object_info: interfaces.objects.ObjectInformation) -> interfaces.objects.ObjectInterface: """Constructs the object. - Returns: an object adhereing to the :class:`~volatility.framework.interfaces.objects.ObjectInterface` + Returns: an object adhereing to the :class:`~volatility3.framework.interfaces.objects.ObjectInterface` """ arguments = {} # type: Dict[str, Any] for arg in self.vol: @@ -76,7 +76,7 @@ class ReferenceTemplate(interfaces.objects.Template): """Factory class that produces objects based on a delayed reference type. Attempts to access any standard attributes of a resolved template will result in a - :class:`~volatility.framework.exceptions.SymbolError`. + :class:`~volatility3.framework.exceptions.SymbolError`. """ @property diff --git a/volatility/framework/objects/utility.py b/volatility3/framework/objects/utility.py similarity index 97% rename from volatility/framework/objects/utility.py rename to volatility3/framework/objects/utility.py index e3795aa78..9c4b59575 100644 --- a/volatility/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -4,7 +4,7 @@ from typing import Optional, Union -from volatility.framework import interfaces, objects, constants +from volatility3.framework import interfaces, objects, constants def array_to_string(array: 'objects.Array', diff --git a/volatility/framework/plugins/__init__.py b/volatility3/framework/plugins/__init__.py similarity index 93% rename from volatility/framework/plugins/__init__.py rename to volatility3/framework/plugins/__init__.py index b00b4ea47..aa9701a4c 100644 --- a/volatility/framework/plugins/__init__.py +++ b/volatility3/framework/plugins/__init__.py @@ -3,14 +3,14 @@ # """All core generic plugins. -These modules should only be imported from volatility.plugins NOT -volatility.framework.plugins +These modules should only be imported from volatility3.plugins NOT +volatility3.framework.plugins """ import logging from typing import List, Type -from volatility.framework import interfaces, automagic, exceptions, constants +from volatility3.framework import interfaces, automagic, exceptions, constants vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/banners.py b/volatility3/framework/plugins/banners.py similarity index 87% rename from volatility/framework/plugins/banners.py rename to volatility3/framework/plugins/banners.py index b7b439aa8..c907497ed 100644 --- a/volatility/framework/plugins/banners.py +++ b/volatility3/framework/plugins/banners.py @@ -4,10 +4,10 @@ import logging from typing import List -from volatility.framework import interfaces, renderers, layers -from volatility.framework.configuration import requirements -from volatility.framework.layers import scanners -from volatility.framework.renderers import format_hints +from volatility3.framework import interfaces, renderers, layers +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import scanners +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) @@ -15,7 +15,7 @@ vollog = logging.getLogger(__name__) class Banners(interfaces.plugins.PluginInterface): """Attempts to identify potential linux banners in an image""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/configwriter.py b/volatility3/framework/plugins/configwriter.py similarity index 89% rename from volatility/framework/plugins/configwriter.py rename to volatility3/framework/plugins/configwriter.py index 3d44edfe5..6dc504fb5 100644 --- a/volatility/framework/plugins/configwriter.py +++ b/volatility3/framework/plugins/configwriter.py @@ -6,9 +6,9 @@ import json import logging from typing import List -from volatility.framework import renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins +from volatility3.framework import renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins vollog = logging.getLogger(__name__) @@ -17,7 +17,7 @@ class ConfigWriter(plugins.PluginInterface): """Runs the automagics and both prints and outputs configuration in the output directory.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/frameworkinfo.py b/volatility3/framework/plugins/frameworkinfo.py similarity index 85% rename from volatility/framework/plugins/frameworkinfo.py rename to volatility3/framework/plugins/frameworkinfo.py index 52e85d0a2..8d9f3b013 100644 --- a/volatility/framework/plugins/frameworkinfo.py +++ b/volatility3/framework/plugins/frameworkinfo.py @@ -1,14 +1,14 @@ from typing import List -from volatility import framework -from volatility.framework import interfaces, renderers -from volatility.framework.interfaces import plugins +from volatility3 import framework +from volatility3.framework import interfaces, renderers +from volatility3.framework.interfaces import plugins class FrameworkInfo(plugins.PluginInterface): """Plugin to list the various modular components of Volatility""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/isfinfo.py b/volatility3/framework/plugins/isfinfo.py similarity index 93% rename from volatility/framework/plugins/isfinfo.py rename to volatility3/framework/plugins/isfinfo.py index 41cecc1e9..c1f5daef1 100644 --- a/volatility/framework/plugins/isfinfo.py +++ b/volatility3/framework/plugins/isfinfo.py @@ -9,12 +9,12 @@ import pathlib import zipfile from typing import List, Type, Any, Generator -from volatility import schemas, symbols -from volatility.framework import interfaces, renderers, constants -from volatility.framework.automagic import mac, linux, symbol_cache -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.layers import resources +from volatility3 import schemas, symbols +from volatility3.framework import interfaces, renderers, constants +from volatility3.framework.automagic import mac, linux, symbol_cache +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.layers import resources vollog = logging.getLogger(__name__) @@ -22,7 +22,7 @@ vollog = logging.getLogger(__name__) class IsfInfo(plugins.PluginInterface): """Determines information about the currently available ISF files, or a specific one""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/layerwriter.py b/volatility3/framework/plugins/layerwriter.py similarity index 88% rename from volatility/framework/plugins/layerwriter.py rename to volatility3/framework/plugins/layerwriter.py index 1bd6b0a7c..721845fd3 100644 --- a/volatility/framework/plugins/layerwriter.py +++ b/volatility3/framework/plugins/layerwriter.py @@ -5,9 +5,9 @@ import logging from typing import List, Optional, Type -from volatility.framework import renderers, interfaces, constants, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins +from volatility3.framework import renderers, interfaces, constants, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins vollog = logging.getLogger(__name__) @@ -17,7 +17,7 @@ class LayerWriter(plugins.PluginInterface): default_block_size = 0x500000 - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (2, 0, 0) @classmethod @@ -34,11 +34,12 @@ class LayerWriter(plugins.PluginInterface): description = 'List available layers', default = False, optional = True), - requirements.ListRequirement(name = 'layers', - element_type = str, - description = 'Names of layer to write', - default = None, - optional = True) + requirements.ListRequirement( + name = 'layers', + element_type = str, + description = 'Names of layers to write (defaults to the highest non-mapped layer)', + default = None, + optional = True) ] @classmethod @@ -82,10 +83,8 @@ class LayerWriter(plugins.PluginInterface): for name in self.context.layers: yield 0, (name, ) else: - import pdb - pdb.set_trace() # Choose the most recently added layer that isn't virtual - if self.config['layers'] is None: + if not self.config['layers']: self.config['layers'] = [] for name in self.context.layers: if not self.context.layers[name].metadata.get('mapped', False): diff --git a/volatility/framework/plugins/linux/__init__.py b/volatility3/framework/plugins/linux/__init__.py similarity index 69% rename from volatility/framework/plugins/linux/__init__.py rename to volatility3/framework/plugins/linux/__init__.py index 24e0d3c1e..3932a6f51 100644 --- a/volatility/framework/plugins/linux/__init__.py +++ b/volatility3/framework/plugins/linux/__init__.py @@ -3,6 +3,6 @@ # """All core linux plugins. -These modules should only be imported from volatility.plugins NOT -volatility.framework.plugins +These modules should only be imported from volatility3.plugins NOT +volatility3.framework.plugins """ diff --git a/volatility/framework/plugins/linux/bash.py b/volatility3/framework/plugins/linux/bash.py similarity index 90% rename from volatility/framework/plugins/linux/bash.py rename to volatility3/framework/plugins/linux/bash.py index 82fdd90dc..8e6de7241 100644 --- a/volatility/framework/plugins/linux/bash.py +++ b/volatility3/framework/plugins/linux/bash.py @@ -8,20 +8,20 @@ import datetime import struct from typing import List -from volatility.framework import constants, renderers, symbols, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.layers import scanners -from volatility.framework.objects import utility -from volatility.framework.symbols.linux.bash import BashIntermedSymbols -from volatility.plugins import timeliner -from volatility.plugins.linux import pslist +from volatility3.framework import constants, renderers, symbols, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.layers import scanners +from volatility3.framework.objects import utility +from volatility3.framework.symbols.linux.bash import BashIntermedSymbols +from volatility3.plugins import timeliner +from volatility3.plugins.linux import pslist class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): """Recovers bash command history from memory.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/linux/check_afinfo.py b/volatility3/framework/plugins/linux/check_afinfo.py similarity index 91% rename from volatility/framework/plugins/linux/check_afinfo.py rename to volatility3/framework/plugins/linux/check_afinfo.py index c3361b966..29e697540 100644 --- a/volatility/framework/plugins/linux/check_afinfo.py +++ b/volatility3/framework/plugins/linux/check_afinfo.py @@ -6,11 +6,11 @@ found in Linux's /proc file system.""" import logging from typing import List -from volatility.framework import exceptions, interfaces, contexts -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints +from volatility3.framework import exceptions, interfaces, contexts +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class Check_afinfo(plugins.PluginInterface): """Verifies the operation function pointers of network protocols.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/linux/check_creds.py b/volatility3/framework/plugins/linux/check_creds.py similarity index 91% rename from volatility/framework/plugins/linux/check_creds.py rename to volatility3/framework/plugins/linux/check_creds.py index 7d68bf644..2333eb123 100644 --- a/volatility/framework/plugins/linux/check_creds.py +++ b/volatility3/framework/plugins/linux/check_creds.py @@ -4,9 +4,9 @@ import logging -from volatility.framework import interfaces, renderers, constants -from volatility.framework.configuration import requirements -from volatility.plugins.linux import pslist +from volatility3.framework import interfaces, renderers, constants +from volatility3.framework.configuration import requirements +from volatility3.plugins.linux import pslist vollog = logging.getLogger(__name__) @@ -14,7 +14,7 @@ vollog = logging.getLogger(__name__) class Check_creds(interfaces.plugins.PluginInterface): """Checks if any processes are sharing credential structures""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility/framework/plugins/linux/check_idt.py b/volatility3/framework/plugins/linux/check_idt.py similarity index 91% rename from volatility/framework/plugins/linux/check_idt.py rename to volatility3/framework/plugins/linux/check_idt.py index 4da33e8d8..f171ab846 100644 --- a/volatility/framework/plugins/linux/check_idt.py +++ b/volatility3/framework/plugins/linux/check_idt.py @@ -5,11 +5,11 @@ import logging from typing import List -from volatility.framework import interfaces, renderers, contexts, symbols -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import linux -from volatility.plugins.linux import lsmod +from volatility3.framework import interfaces, renderers, contexts, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import linux +from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) @@ -17,7 +17,7 @@ vollog = logging.getLogger(__name__) class Check_idt(interfaces.plugins.PluginInterface): """ Checks if the IDT has been altered """ - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py similarity index 87% rename from volatility/framework/plugins/linux/check_modules.py rename to volatility3/framework/plugins/linux/check_modules.py index 470ce0a2f..449046e86 100644 --- a/volatility/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -5,12 +5,12 @@ import logging from typing import List -from volatility.framework import interfaces, renderers, exceptions, constants, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.linux import lsmod +from volatility3.framework import interfaces, renderers, exceptions, constants, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class Check_modules(plugins.PluginInterface): """Compares module list to sysfs info, if available""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/linux/check_syscall.py b/volatility3/framework/plugins/linux/check_syscall.py similarity index 95% rename from volatility/framework/plugins/linux/check_syscall.py rename to volatility3/framework/plugins/linux/check_syscall.py index 30843077a..b845ad4aa 100644 --- a/volatility/framework/plugins/linux/check_syscall.py +++ b/volatility3/framework/plugins/linux/check_syscall.py @@ -6,11 +6,11 @@ found in Linux's /proc file system.""" import logging from typing import List -from volatility.framework import exceptions, interfaces, contexts -from volatility.framework import renderers, constants -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints +from volatility3.framework import exceptions, interfaces, contexts +from volatility3.framework import renderers, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) @@ -25,7 +25,7 @@ except ImportError: class Check_syscall(plugins.PluginInterface): """Check system call table for hooks.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/linux/elfs.py b/volatility3/framework/plugins/linux/elfs.py similarity index 88% rename from volatility/framework/plugins/linux/elfs.py rename to volatility3/framework/plugins/linux/elfs.py index da9281ec3..89909f4ff 100644 --- a/volatility/framework/plugins/linux/elfs.py +++ b/volatility3/framework/plugins/linux/elfs.py @@ -6,18 +6,18 @@ found in Linux's /proc file system.""" from typing import List -from volatility.framework import renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.linux import pslist +from volatility3.framework import renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.linux import pslist class Elfs(plugins.PluginInterface): """Lists all memory mapped ELF files for all processes.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/linux/keyboard_notifiers.py b/volatility3/framework/plugins/linux/keyboard_notifiers.py similarity index 88% rename from volatility/framework/plugins/linux/keyboard_notifiers.py rename to volatility3/framework/plugins/linux/keyboard_notifiers.py index 7580b368b..290c0a180 100644 --- a/volatility/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility3/framework/plugins/linux/keyboard_notifiers.py @@ -4,11 +4,11 @@ import logging -from volatility.framework import interfaces, renderers, contexts, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import linux -from volatility.plugins.linux import lsmod +from volatility3.framework import interfaces, renderers, contexts, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import linux +from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) @@ -16,7 +16,7 @@ vollog = logging.getLogger(__name__) class Keyboard_notifiers(interfaces.plugins.PluginInterface): """Parses the keyboard notifier call chain""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py similarity index 87% rename from volatility/framework/plugins/linux/lsmod.py rename to volatility3/framework/plugins/linux/lsmod.py index ada3002a4..2d390cc82 100644 --- a/volatility/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -7,12 +7,12 @@ found in Linux's /proc file system.""" import logging from typing import List, Iterable -from volatility.framework import contexts -from volatility.framework import exceptions, renderers, constants, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints +from volatility3.framework import contexts +from volatility3.framework import exceptions, renderers, constants, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/linux/lsof.py b/volatility3/framework/plugins/linux/lsof.py similarity index 87% rename from volatility/framework/plugins/linux/lsof.py rename to volatility3/framework/plugins/linux/lsof.py index 1ea348b19..153d28f6a 100644 --- a/volatility/framework/plugins/linux/lsof.py +++ b/volatility3/framework/plugins/linux/lsof.py @@ -6,12 +6,12 @@ found in Linux's /proc file system.""" import logging from typing import List -from volatility.framework import renderers, interfaces, constants -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.symbols import linux -from volatility.plugins.linux import pslist +from volatility3.framework import renderers, interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.symbols import linux +from volatility3.plugins.linux import pslist vollog = logging.getLogger(__name__) @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Lsof(plugins.PluginInterface): """Lists all memory maps for all processes.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py similarity index 90% rename from volatility/framework/plugins/linux/malfind.py rename to volatility3/framework/plugins/linux/malfind.py index 0da89025f..149222f37 100644 --- a/volatility/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -4,18 +4,18 @@ from typing import List -from volatility.framework import constants, interfaces -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.linux import pslist +from volatility3.framework import constants, interfaces +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.linux import pslist class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/linux/proc.py b/volatility3/framework/plugins/linux/proc.py similarity index 89% rename from volatility/framework/plugins/linux/proc.py rename to volatility3/framework/plugins/linux/proc.py index 6b73f2352..8bd0db538 100644 --- a/volatility/framework/plugins/linux/proc.py +++ b/volatility3/framework/plugins/linux/proc.py @@ -4,18 +4,18 @@ """A module containing a collection of plugins that produce data typically found in Linux's /proc file system.""" -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.linux import pslist +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.linux import pslist class Maps(plugins.PluginInterface): """Lists all memory maps for all processes.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py similarity index 93% rename from volatility/framework/plugins/linux/pslist.py rename to volatility3/framework/plugins/linux/pslist.py index 8a60d58c4..78fce978b 100644 --- a/volatility/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -4,15 +4,15 @@ from typing import Callable, Iterable, List, Any -from volatility.framework import renderers, interfaces, contexts -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility +from volatility3.framework import renderers, interfaces, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility class PsList(interfaces.plugins.PluginInterface): """Lists the processes present in a particular linux memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) diff --git a/volatility/framework/plugins/linux/pstree.py b/volatility3/framework/plugins/linux/pstree.py similarity index 92% rename from volatility/framework/plugins/linux/pstree.py rename to volatility3/framework/plugins/linux/pstree.py index c1e832950..a187ea907 100644 --- a/volatility/framework/plugins/linux/pstree.py +++ b/volatility3/framework/plugins/linux/pstree.py @@ -2,15 +2,15 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework.objects import utility -from volatility.plugins.linux import pslist +from volatility3.framework.objects import utility +from volatility3.plugins.linux import pslist class PsTree(pslist.PsList): """Plugin for listing processes in a tree based on their parent process ID.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility/framework/plugins/linux/tty_check.py b/volatility3/framework/plugins/linux/tty_check.py similarity index 87% rename from volatility/framework/plugins/linux/tty_check.py rename to volatility3/framework/plugins/linux/tty_check.py index 90959d6a2..fe35d8fa3 100644 --- a/volatility/framework/plugins/linux/tty_check.py +++ b/volatility3/framework/plugins/linux/tty_check.py @@ -5,13 +5,13 @@ import logging from typing import List -from volatility.framework import interfaces, renderers, exceptions, constants, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import linux -from volatility.plugins.linux import lsmod +from volatility3.framework import interfaces, renderers, exceptions, constants, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import linux +from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class tty_check(plugins.PluginInterface): """Checks tty devices for hooks""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/mac/__init__.py b/volatility3/framework/plugins/mac/__init__.py similarity index 100% rename from volatility/framework/plugins/mac/__init__.py rename to volatility3/framework/plugins/mac/__init__.py diff --git a/volatility/framework/plugins/mac/bash.py b/volatility3/framework/plugins/mac/bash.py similarity index 91% rename from volatility/framework/plugins/mac/bash.py rename to volatility3/framework/plugins/mac/bash.py index 9c923d33c..6b453759e 100644 --- a/volatility/framework/plugins/mac/bash.py +++ b/volatility3/framework/plugins/mac/bash.py @@ -7,20 +7,20 @@ found in mac's /proc file system.""" import datetime import struct -from volatility.framework import constants, renderers, symbols -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.layers import scanners -from volatility.framework.objects import utility -from volatility.framework.symbols.linux.bash import BashIntermedSymbols -from volatility.plugins import timeliner -from volatility.plugins.mac import pslist +from volatility3.framework import constants, renderers, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.layers import scanners +from volatility3.framework.objects import utility +from volatility3.framework.symbols.linux.bash import BashIntermedSymbols +from volatility3.plugins import timeliner +from volatility3.plugins.mac import pslist class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): """Recovers bash command history from memory.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility/framework/plugins/mac/check_syscall.py b/volatility3/framework/plugins/mac/check_syscall.py similarity index 85% rename from volatility/framework/plugins/mac/check_syscall.py rename to volatility3/framework/plugins/mac/check_syscall.py index f1e0dc5d1..4f367001e 100644 --- a/volatility/framework/plugins/mac/check_syscall.py +++ b/volatility3/framework/plugins/mac/check_syscall.py @@ -4,13 +4,13 @@ import logging from typing import List -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class Check_syscall(plugins.PluginInterface): """Check system call table for hooks.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/mac/check_sysctl.py b/volatility3/framework/plugins/mac/check_sysctl.py similarity index 89% rename from volatility/framework/plugins/mac/check_sysctl.py rename to volatility3/framework/plugins/mac/check_sysctl.py index 5923430bb..4ea1d8af0 100644 --- a/volatility/framework/plugins/mac/check_sysctl.py +++ b/volatility3/framework/plugins/mac/check_sysctl.py @@ -4,15 +4,15 @@ import logging from typing import List -import volatility -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +import volatility3 +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class Check_sysctl(plugins.PluginInterface): """Check sysctl handlers for hooks.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -55,7 +55,7 @@ class Check_sysctl(plugins.PluginInterface): return var_str def _process_sysctl_list(self, kernel, sysctl_list, recursive = 0): - if type(sysctl_list) == volatility.framework.objects.Pointer: + if type(sysctl_list) == volatility3.framework.objects.Pointer: sysctl_list = sysctl_list.dereference().cast("sysctl_oid_list") sysctl = sysctl_list.slh_first diff --git a/volatility/framework/plugins/mac/check_trap_table.py b/volatility3/framework/plugins/mac/check_trap_table.py similarity index 85% rename from volatility/framework/plugins/mac/check_trap_table.py rename to volatility3/framework/plugins/mac/check_trap_table.py index 99b509f40..0584d9ff7 100644 --- a/volatility/framework/plugins/mac/check_trap_table.py +++ b/volatility3/framework/plugins/mac/check_trap_table.py @@ -5,13 +5,13 @@ import logging from typing import List -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Check_trap_table(plugins.PluginInterface): """Check mach trap table for hooks.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/mac/ifconfig.py b/volatility3/framework/plugins/mac/ifconfig.py similarity index 86% rename from volatility/framework/plugins/mac/ifconfig.py rename to volatility3/framework/plugins/mac/ifconfig.py index 8bcfe7377..5c4e5728e 100644 --- a/volatility/framework/plugins/mac/ifconfig.py +++ b/volatility3/framework/plugins/mac/ifconfig.py @@ -1,17 +1,17 @@ # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import exceptions, renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.symbols import mac +from volatility3.framework import exceptions, renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.symbols import mac class Ifconfig(plugins.PluginInterface): """Lists loaded kernel modules""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility/framework/plugins/mac/kauth_listeners.py b/volatility3/framework/plugins/mac/kauth_listeners.py similarity index 86% rename from volatility/framework/plugins/mac/kauth_listeners.py rename to volatility3/framework/plugins/mac/kauth_listeners.py index ec784f585..930239db9 100644 --- a/volatility/framework/plugins/mac/kauth_listeners.py +++ b/volatility3/framework/plugins/mac/kauth_listeners.py @@ -2,18 +2,18 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import renderers, interfaces, contexts -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod, kauth_scopes +from volatility3.framework import renderers, interfaces, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod, kauth_scopes class Kauth_listeners(interfaces.plugins.PluginInterface): """ Lists kauth listeners and their status """ - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility/framework/plugins/mac/kauth_scopes.py b/volatility3/framework/plugins/mac/kauth_scopes.py similarity index 89% rename from volatility/framework/plugins/mac/kauth_scopes.py rename to volatility3/framework/plugins/mac/kauth_scopes.py index 9a9db6909..a5f57d9a1 100644 --- a/volatility/framework/plugins/mac/kauth_scopes.py +++ b/volatility3/framework/plugins/mac/kauth_scopes.py @@ -4,19 +4,19 @@ from typing import Iterable, Callable, Tuple -from volatility.framework import renderers, interfaces, contexts -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +from volatility3.framework import renderers, interfaces, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod class Kauth_scopes(interfaces.plugins.PluginInterface): """ Lists kauth scopes and their status """ _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility/framework/plugins/mac/kevents.py b/volatility3/framework/plugins/mac/kevents.py similarity index 95% rename from volatility/framework/plugins/mac/kevents.py rename to volatility3/framework/plugins/mac/kevents.py index b3826ccfd..a6d905102 100644 --- a/volatility/framework/plugins/mac/kevents.py +++ b/volatility3/framework/plugins/mac/kevents.py @@ -4,17 +4,17 @@ from typing import Iterable, Callable, Tuple -from volatility.framework import renderers, interfaces, exceptions, contexts -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.symbols import mac -from volatility.plugins.mac import pslist +from volatility3.framework import renderers, interfaces, exceptions, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import pslist class Kevents(interfaces.plugins.PluginInterface): """ Lists event handlers registered by processes """ - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) event_types = { 1: "EVFILT_READ", diff --git a/volatility/framework/plugins/mac/list_files.py b/volatility3/framework/plugins/mac/list_files.py similarity index 92% rename from volatility/framework/plugins/mac/list_files.py rename to volatility3/framework/plugins/mac/list_files.py index a1a062113..557e735ed 100644 --- a/volatility/framework/plugins/mac/list_files.py +++ b/volatility3/framework/plugins/mac/list_files.py @@ -4,13 +4,13 @@ import logging from typing import Iterable, Optional -from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import mount +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import mount vollog = logging.getLogger(__name__) @@ -18,6 +18,8 @@ vollog = logging.getLogger(__name__) class List_Files(plugins.PluginInterface): """Lists all open file descriptors for all processes.""" + _required_framework_version = (1, 0, 0) + @classmethod def get_requirements(cls): return [ diff --git a/volatility/framework/plugins/mac/lsmod.py b/volatility3/framework/plugins/mac/lsmod.py similarity index 86% rename from volatility/framework/plugins/mac/lsmod.py rename to volatility3/framework/plugins/mac/lsmod.py index 129dbda9a..b536a112b 100644 --- a/volatility/framework/plugins/mac/lsmod.py +++ b/volatility3/framework/plugins/mac/lsmod.py @@ -3,17 +3,17 @@ # """A module containing a collection of plugins that produce data typically found in Mac's lsmod command.""" -from volatility.framework import renderers, interfaces, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints +from volatility3.framework import renderers, interfaces, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) diff --git a/volatility/framework/plugins/mac/lsof.py b/volatility3/framework/plugins/mac/lsof.py similarity index 88% rename from volatility/framework/plugins/mac/lsof.py rename to volatility3/framework/plugins/mac/lsof.py index 0307b2217..f4fb725a0 100644 --- a/volatility/framework/plugins/mac/lsof.py +++ b/volatility3/framework/plugins/mac/lsof.py @@ -4,11 +4,11 @@ import logging -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.symbols import mac -from volatility.plugins.mac import pslist +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import pslist vollog = logging.getLogger(__name__) @@ -16,7 +16,7 @@ vollog = logging.getLogger(__name__) class Lsof(plugins.PluginInterface): """Lists all open file descriptors for all processes.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility/framework/plugins/mac/malfind.py b/volatility3/framework/plugins/mac/malfind.py similarity index 89% rename from volatility/framework/plugins/mac/malfind.py rename to volatility3/framework/plugins/mac/malfind.py index 3a920a8a5..20b46528b 100644 --- a/volatility/framework/plugins/mac/malfind.py +++ b/volatility3/framework/plugins/mac/malfind.py @@ -2,19 +2,19 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import constants -from volatility.framework import interfaces -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.mac import pslist +from volatility3.framework import constants +from volatility3.framework import interfaces +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.mac import pslist class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility/framework/plugins/mac/mount.py b/volatility3/framework/plugins/mac/mount.py similarity index 88% rename from volatility/framework/plugins/mac/mount.py rename to volatility3/framework/plugins/mac/mount.py index 55193fac4..3500e5ff1 100644 --- a/volatility/framework/plugins/mac/mount.py +++ b/volatility3/framework/plugins/mac/mount.py @@ -3,18 +3,18 @@ # """A module containing a collection of plugins that produce data typically found in Mac's mount command.""" -from volatility.framework import renderers, interfaces, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.symbols import mac +from volatility3.framework import renderers, interfaces, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.symbols import mac class Mount(plugins.PluginInterface): """A module containing a collection of plugins that produce data typically foundin Mac's mount command""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) diff --git a/volatility/framework/plugins/mac/netstat.py b/volatility3/framework/plugins/mac/netstat.py similarity index 91% rename from volatility/framework/plugins/mac/netstat.py rename to volatility3/framework/plugins/mac/netstat.py index dc3c03297..4b9f539fd 100644 --- a/volatility/framework/plugins/mac/netstat.py +++ b/volatility3/framework/plugins/mac/netstat.py @@ -5,13 +5,13 @@ import logging from typing import Iterable, Callable, Tuple -from volatility.framework import exceptions, renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import pslist +from volatility3.framework import exceptions, renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import pslist vollog = logging.getLogger(__name__) @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Netstat(plugins.PluginInterface): """Lists all network connections for all processes.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility/framework/plugins/mac/proc_maps.py b/volatility3/framework/plugins/mac/proc_maps.py similarity index 88% rename from volatility/framework/plugins/mac/proc_maps.py rename to volatility3/framework/plugins/mac/proc_maps.py index 57a8d0215..2ff80c47e 100644 --- a/volatility/framework/plugins/mac/proc_maps.py +++ b/volatility3/framework/plugins/mac/proc_maps.py @@ -2,17 +2,17 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.mac import pslist +from volatility3.framework import renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.mac import pslist class Maps(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility/framework/plugins/mac/psaux.py b/volatility3/framework/plugins/mac/psaux.py similarity index 92% rename from volatility/framework/plugins/mac/psaux.py rename to volatility3/framework/plugins/mac/psaux.py index 2dca44da4..97f61c02e 100644 --- a/volatility/framework/plugins/mac/psaux.py +++ b/volatility3/framework/plugins/mac/psaux.py @@ -4,17 +4,17 @@ """In-memory artifacts from OSX systems.""" from typing import Iterator, Tuple, Any, Generator, List -from volatility.framework import exceptions, renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.plugins.mac import pslist +from volatility3.framework import exceptions, renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.plugins.mac import pslist class Psaux(plugins.PluginInterface): """Recovers program command line arguments.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/mac/pslist.py b/volatility3/framework/plugins/mac/pslist.py similarity index 97% rename from volatility/framework/plugins/mac/pslist.py rename to volatility3/framework/plugins/mac/pslist.py index 23fba1ac7..8ef7876f1 100644 --- a/volatility/framework/plugins/mac/pslist.py +++ b/volatility3/framework/plugins/mac/pslist.py @@ -5,10 +5,10 @@ import logging from typing import Callable, Iterable, List, Dict -from volatility.framework import renderers, interfaces, contexts, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.symbols import mac +from volatility3.framework import renderers, interfaces, contexts, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.symbols import mac vollog = logging.getLogger(__name__) @@ -16,7 +16,7 @@ vollog = logging.getLogger(__name__) class PsList(interfaces.plugins.PluginInterface): """Lists the processes present in a particular mac memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (2, 0, 0) pslist_methods = ['tasks', 'allproc', 'process_group', 'sessions', 'pid_hash_table'] diff --git a/volatility/framework/plugins/mac/pstree.py b/volatility3/framework/plugins/mac/pstree.py similarity index 89% rename from volatility/framework/plugins/mac/pstree.py rename to volatility3/framework/plugins/mac/pstree.py index 7fda089f7..ea70a5d4c 100644 --- a/volatility/framework/plugins/mac/pstree.py +++ b/volatility3/framework/plugins/mac/pstree.py @@ -2,18 +2,18 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.plugins.mac import pslist +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.plugins.mac import pslist class PsTree(plugins.PluginInterface): """Plugin for listing processes in a tree based on their parent process ID.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility/framework/plugins/mac/socket_filters.py b/volatility3/framework/plugins/mac/socket_filters.py similarity index 86% rename from volatility/framework/plugins/mac/socket_filters.py rename to volatility3/framework/plugins/mac/socket_filters.py index 800eb134d..40fc6ffe0 100644 --- a/volatility/framework/plugins/mac/socket_filters.py +++ b/volatility3/framework/plugins/mac/socket_filters.py @@ -4,14 +4,14 @@ import logging from typing import List -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Socket_filters(plugins.PluginInterface): """Enumerates kernel socket filters.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/mac/timers.py b/volatility3/framework/plugins/mac/timers.py similarity index 88% rename from volatility/framework/plugins/mac/timers.py rename to volatility3/framework/plugins/mac/timers.py index 94502d800..912388ffb 100644 --- a/volatility/framework/plugins/mac/timers.py +++ b/volatility3/framework/plugins/mac/timers.py @@ -4,13 +4,13 @@ import logging from typing import List -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class Timers(plugins.PluginInterface): """Check for malicious kernel timers.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/mac/trustedbsd.py b/volatility3/framework/plugins/mac/trustedbsd.py similarity index 87% rename from volatility/framework/plugins/mac/trustedbsd.py rename to volatility3/framework/plugins/mac/trustedbsd.py index 73a313af4..b03663625 100644 --- a/volatility/framework/plugins/mac/trustedbsd.py +++ b/volatility3/framework/plugins/mac/trustedbsd.py @@ -5,14 +5,14 @@ import logging from typing import List, Iterator, Any -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class Trustedbsd(plugins.PluginInterface): """Checks for malicious trustedbsd modules""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/mac/vfsevents.py b/volatility3/framework/plugins/mac/vfsevents.py similarity index 90% rename from volatility/framework/plugins/mac/vfsevents.py rename to volatility3/framework/plugins/mac/vfsevents.py index 84d3adc51..97b23168c 100644 --- a/volatility/framework/plugins/mac/vfsevents.py +++ b/volatility3/framework/plugins/mac/vfsevents.py @@ -2,15 +2,15 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import renderers, interfaces, exceptions, contexts -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility +from volatility3.framework import renderers, interfaces, exceptions, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility class VFSevents(interfaces.plugins.PluginInterface): """ Lists processes that are filtering file system events """ - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) event_types = [ "CREATE_FILE", "DELETE", "STAT_CHANGED", "RENAME", "CONTENT_MODIFIED", "EXCHANGE", "FINDER_INFO_CHANGED", diff --git a/volatility/framework/plugins/timeliner.py b/volatility3/framework/plugins/timeliner.py similarity index 97% rename from volatility/framework/plugins/timeliner.py rename to volatility3/framework/plugins/timeliner.py index 40148800d..bd6377ca1 100644 --- a/volatility/framework/plugins/timeliner.py +++ b/volatility3/framework/plugins/timeliner.py @@ -11,9 +11,9 @@ import logging import traceback from typing import Generator, Iterable, List, Optional, Tuple, Type -from volatility import framework -from volatility.framework import renderers, automagic, interfaces, plugins, exceptions -from volatility.framework.configuration import requirements +from volatility3 import framework +from volatility3.framework import renderers, automagic, interfaces, plugins, exceptions +from volatility3.framework.configuration import requirements vollog = logging.getLogger(__name__) @@ -42,7 +42,7 @@ class Timeliner(interfaces.plugins.PluginInterface): """Runs all relevant plugins that provide time related information and orders the results by time.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility/framework/plugins/windows/__init__.py b/volatility3/framework/plugins/windows/__init__.py similarity index 69% rename from volatility/framework/plugins/windows/__init__.py rename to volatility3/framework/plugins/windows/__init__.py index e7f81d48d..87a986e48 100644 --- a/volatility/framework/plugins/windows/__init__.py +++ b/volatility3/framework/plugins/windows/__init__.py @@ -3,6 +3,6 @@ # """All core windows plugins. -These modules should only be imported from volatility.plugins NOT -volatility.framework.plugins +These modules should only be imported from volatility3.plugins NOT +volatility3.framework.plugins """ diff --git a/volatility/framework/plugins/windows/bigpools.py b/volatility3/framework/plugins/windows/bigpools.py similarity index 92% rename from volatility/framework/plugins/windows/bigpools.py rename to volatility3/framework/plugins/windows/bigpools.py index 434d88df3..a2c23a31c 100644 --- a/volatility/framework/plugins/windows/bigpools.py +++ b/volatility3/framework/plugins/windows/bigpools.py @@ -5,13 +5,13 @@ import logging from typing import List, Optional, Tuple, Iterator -from volatility.framework import interfaces, renderers, exceptions, symbols -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import configuration -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import extensions -from volatility.framework.symbols.windows import versions +from volatility3.framework import interfaces, renderers, exceptions, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import configuration +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import extensions +from volatility3.framework.symbols.windows import versions vollog = logging.getLogger(__name__) @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class BigPools(interfaces.plugins.PluginInterface): """List big page pools.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py similarity index 94% rename from volatility/framework/plugins/windows/cachedump.py rename to volatility3/framework/plugins/windows/cachedump.py index 35eb0f593..42bb93a73 100644 --- a/volatility/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -7,17 +7,17 @@ from struct import unpack from Crypto.Cipher import ARC4, AES from Crypto.Hash import HMAC -from volatility.framework import interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.symbols.windows import versions -from volatility.plugins.windows import hashdump, lsadump -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.symbols.windows import versions +from volatility3.plugins.windows import hashdump, lsadump +from volatility3.plugins.windows.registry import hivelist class Cachedump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py similarity index 96% rename from volatility/framework/plugins/windows/callbacks.py rename to volatility3/framework/plugins/windows/callbacks.py index 8f5280ad0..545ff9811 100644 --- a/volatility/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -5,13 +5,13 @@ import logging from typing import List, Iterable, Tuple, Optional, Union -from volatility.framework import constants, exceptions, renderers, interfaces, symbols -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import versions -from volatility.plugins.windows import ssdt -from volatility.plugins.windows import svcscan +from volatility3.framework import constants, exceptions, renderers, interfaces, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import versions +from volatility3.plugins.windows import ssdt +from volatility3.plugins.windows import svcscan vollog = logging.getLogger(__name__) @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Callbacks(interfaces.plugins.PluginInterface): """Lists kernel callbacks and notification routines.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/cmdline.py b/volatility3/framework/plugins/windows/cmdline.py similarity index 93% rename from volatility/framework/plugins/windows/cmdline.py rename to volatility3/framework/plugins/windows/cmdline.py index 83ac2aa02..bf5cc4bfe 100644 --- a/volatility/framework/plugins/windows/cmdline.py +++ b/volatility3/framework/plugins/windows/cmdline.py @@ -4,10 +4,10 @@ import logging from typing import List -from volatility.framework import constants, exceptions, renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.plugins.windows import pslist +from volatility3.framework import constants, exceptions, renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) @@ -15,7 +15,7 @@ vollog = logging.getLogger(__name__) class CmdLine(interfaces.plugins.PluginInterface): """Lists process command line arguments.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py similarity index 94% rename from volatility/framework/plugins/windows/dlllist.py rename to volatility3/framework/plugins/windows/dlllist.py index 94de9d193..4740e5751 100644 --- a/volatility/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -6,13 +6,13 @@ import logging import ntpath from typing import List, Optional, Type -from volatility.framework import exceptions, renderers, interfaces, constants -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints, conversion -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe -from volatility.plugins import timeliner -from volatility.plugins.windows import pslist, info +from volatility3.framework import exceptions, renderers, interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints, conversion +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins import timeliner +from volatility3.plugins.windows import pslist, info vollog = logging.getLogger(__name__) @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the loaded modules in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (2, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/driverirp.py b/volatility3/framework/plugins/windows/driverirp.py similarity index 90% rename from volatility/framework/plugins/windows/driverirp.py rename to volatility3/framework/plugins/windows/driverirp.py index c77e0801d..64231b9db 100644 --- a/volatility/framework/plugins/windows/driverirp.py +++ b/volatility3/framework/plugins/windows/driverirp.py @@ -2,11 +2,11 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import constants -from volatility.framework import renderers, exceptions, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import ssdt, driverscan +from volatility3.framework import constants +from volatility3.framework import renderers, exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import ssdt, driverscan MAJOR_FUNCTIONS = [ 'IRP_MJ_CREATE', 'IRP_MJ_CREATE_NAMED_PIPE', 'IRP_MJ_CLOSE', 'IRP_MJ_READ', 'IRP_MJ_WRITE', @@ -22,7 +22,7 @@ MAJOR_FUNCTIONS = [ class DriverIrp(interfaces.plugins.PluginInterface): """List IRPs for drivers in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility/framework/plugins/windows/driverscan.py b/volatility3/framework/plugins/windows/driverscan.py similarity index 91% rename from volatility/framework/plugins/windows/driverscan.py rename to volatility3/framework/plugins/windows/driverscan.py index e3d1bd5b2..7b44d4ebc 100644 --- a/volatility/framework/plugins/windows/driverscan.py +++ b/volatility3/framework/plugins/windows/driverscan.py @@ -4,16 +4,16 @@ from typing import Iterable -from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import poolscanner +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import poolscanner class DriverScan(interfaces.plugins.PluginInterface): """Scans for drivers present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py similarity index 97% rename from volatility/framework/plugins/windows/dumpfiles.py rename to volatility3/framework/plugins/windows/dumpfiles.py index d17b30244..757dbd3c3 100755 --- a/volatility/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -4,12 +4,12 @@ import logging import ntpath -from volatility.framework import interfaces, renderers, exceptions, constants -from volatility.plugins.windows import handles -from volatility.plugins.windows import pslist -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.objects import utility +from volatility3.framework import interfaces, renderers, exceptions, constants +from volatility3.plugins.windows import handles +from volatility3.plugins.windows import pslist +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.objects import utility from typing import List, Tuple, Type, Optional vollog = logging.getLogger(__name__) @@ -25,7 +25,7 @@ EXTENSION_CACHE_MAP = { class DumpFiles(interfaces.plugins.PluginInterface): """Dumps cached file contents from Windows memory samples.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py similarity index 93% rename from volatility/framework/plugins/windows/envars.py rename to volatility3/framework/plugins/windows/envars.py index 50f99659f..8d3ee8506 100644 --- a/volatility/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -3,11 +3,11 @@ import logging from typing import List -from volatility.framework import renderers, interfaces, objects, exceptions, constants -from volatility.framework.configuration import requirements -from volatility.framework.layers import registry -from volatility.plugins.windows import pslist -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import renderers, interfaces, objects, exceptions, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import registry +from volatility3.plugins.windows import pslist +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) @@ -16,7 +16,7 @@ class Envars(interfaces.plugins.PluginInterface): "Display process environment variables" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/windows/filescan.py b/volatility3/framework/plugins/windows/filescan.py similarity index 89% rename from volatility/framework/plugins/windows/filescan.py rename to volatility3/framework/plugins/windows/filescan.py index 3f59e02e5..e1756630d 100644 --- a/volatility/framework/plugins/windows/filescan.py +++ b/volatility3/framework/plugins/windows/filescan.py @@ -4,16 +4,16 @@ from typing import Iterable -from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import poolscanner +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import poolscanner class FileScan(interfaces.plugins.PluginInterface): """Scans for file objects present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py similarity index 91% rename from volatility/framework/plugins/windows/getservicesids.py rename to volatility3/framework/plugins/windows/getservicesids.py index 0a5a96820..2b5ab11f4 100644 --- a/volatility/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -8,9 +8,9 @@ import os import struct from typing import List -from volatility.framework import renderers, interfaces, constants, exceptions -from volatility.framework.configuration import requirements -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import renderers, interfaces, constants, exceptions +from volatility3.framework.configuration import requirements +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) @@ -31,7 +31,7 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): """Lists process token sids.""" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py similarity index 92% rename from volatility/framework/plugins/windows/getsids.py rename to volatility3/framework/plugins/windows/getsids.py index 5f7e2dcf4..30503b2bf 100644 --- a/volatility/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -8,12 +8,12 @@ import os import re from typing import List, Dict, Union -from volatility.framework import renderers, interfaces, objects, exceptions, constants, layers -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols.windows.extensions import registry -from volatility.plugins.windows import pslist -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import renderers, interfaces, objects, exceptions, constants, layers +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols.windows.extensions import registry +from volatility3.plugins.windows import pslist +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) @@ -29,7 +29,7 @@ class GetSIDs(interfaces.plugins.PluginInterface): """Print the SIDs owning each process""" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py similarity index 91% rename from volatility/framework/plugins/windows/handles.py rename to volatility3/framework/plugins/windows/handles.py index 25914842d..d08f888e3 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -5,11 +5,11 @@ import logging from typing import List, Optional, Dict -from volatility.framework import constants, exceptions, renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import pslist +from volatility3.framework import constants, exceptions, renderers, interfaces, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) @@ -24,7 +24,7 @@ except ImportError: class Handles(interfaces.plugins.PluginInterface): """Lists process open handles.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) def __init__(self, *args, **kwargs): @@ -80,20 +80,29 @@ class Handles(interfaces.plugins.PluginInterface): object_header.GrantedAccess = handle_table_entry.GrantedAccess except AttributeError: # starting with windows 8 - if handle_table_entry.LowValue == 0: - return None + is_64bit = symbols.symbol_table_is_64bit(self.context, self.config["nt_symbols"]) - magic = self.find_sar_value() + if is_64bit: + if handle_table_entry.LowValue == 0: + return None - # is this the right thing to raise here? - if magic is None: - if not has_capstone: - raise AttributeError("Unable to find the SAR value for decoding handle table pointers") - else: - raise exceptions.MissingModuleException( - "capstone", "Unable to find the SAR value for decoding handle table pointers") + magic = self.find_sar_value() + + # is this the right thing to raise here? + if magic is None: + if has_capstone: + raise AttributeError("Unable to find the SAR value for decoding handle table pointers") + else: + raise exceptions.MissingModuleException( + "capstone", "Requires capstone to find the SAR value for decoding handle table pointers") + + offset = self._decode_pointer(handle_table_entry.LowValue, magic) + else: + if handle_table_entry.InfoTable == 0: + return None + + offset = handle_table_entry.InfoTable & ~7 - offset = self._decode_pointer(handle_table_entry.LowValue, magic) # print("LowValue: {0:#x} Magic: {1:#x} Offset: {2:#x}".format(handle_table_entry.InfoTable, magic, offset)) object_header = self.context.object(self.config["nt_symbols"] + constants.BANG + "_OBJECT_HEADER", virtual, diff --git a/volatility/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py similarity index 97% rename from volatility/framework/plugins/windows/hashdump.py rename to volatility3/framework/plugins/windows/hashdump.py index 64e312bb0..ed2f1988a 100644 --- a/volatility/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -10,10 +10,10 @@ from typing import List, Tuple, Optional from Crypto.Cipher import ARC4, DES, AES from Crypto.Hash import MD5 -from volatility.framework import interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.symbols.windows.extensions import registry -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.symbols.windows.extensions import registry +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) @@ -21,7 +21,7 @@ vollog = logging.getLogger(__name__) class Hashdump(interfaces.plugins.PluginInterface): """Dumps user hashes from memory""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility/framework/plugins/windows/info.py b/volatility3/framework/plugins/windows/info.py similarity index 94% rename from volatility/framework/plugins/windows/info.py rename to volatility3/framework/plugins/windows/info.py index 90ede538a..76b81eb00 100644 --- a/volatility/framework/plugins/windows/info.py +++ b/volatility3/framework/plugins/windows/info.py @@ -5,18 +5,18 @@ import time from typing import List, Tuple, Iterable -from volatility.framework import constants, interfaces, layers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import TreeGrid -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import extensions +from volatility3.framework import constants, interfaces, layers, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import TreeGrid +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import extensions class Info(plugins.PluginInterface): """Show OS & kernel details of the memory sample being analyzed.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod @@ -158,6 +158,8 @@ class Info(plugins.PluginInterface): yield (0, ("Kernel Base", hex(self.config["primary.kernel_virtual_offset"]))) yield (0, ("DTB", hex(self.config["primary.page_map_offset"]))) yield (0, ("Symbols", self.config["nt_symbols.isf_url"])) + yield (0, ("Is64Bit", str(symbols.symbol_table_is_64bit(self.context, symbol_table)))) + yield (0, ("IsPAE", str(self.context.layers[layer_name].metadata.get("pae", False)))) for i, layer in self.get_depends(self.context, "primary"): yield (0, (layer.name, "{} {}".format(i, layer.__class__.__name__))) diff --git a/volatility/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py similarity index 95% rename from volatility/framework/plugins/windows/lsadump.py rename to volatility3/framework/plugins/windows/lsadump.py index a0b674855..b9f8df9fe 100644 --- a/volatility/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -7,11 +7,11 @@ from struct import unpack from Crypto.Cipher import ARC4, DES, AES from Crypto.Hash import MD5, SHA256 -from volatility.framework import interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.symbols.windows import versions -from volatility.plugins.windows import hashdump -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.symbols.windows import versions +from volatility3.plugins.windows import hashdump +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Lsadump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py similarity index 95% rename from volatility/framework/plugins/windows/malfind.py rename to volatility3/framework/plugins/windows/malfind.py index 17fcf11b8..eedd3b715 100644 --- a/volatility/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -4,12 +4,12 @@ import logging from typing import Iterable, Tuple -from volatility.framework import interfaces, symbols, exceptions -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import pslist, vadinfo +from volatility3.framework import interfaces, symbols, exceptions +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist, vadinfo vollog = logging.getLogger(__name__) @@ -17,7 +17,7 @@ vollog = logging.getLogger(__name__) class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility/framework/plugins/windows/memmap.py b/volatility3/framework/plugins/windows/memmap.py similarity index 93% rename from volatility/framework/plugins/windows/memmap.py rename to volatility3/framework/plugins/windows/memmap.py index 627baca2f..86d453115 100644 --- a/volatility/framework/plugins/windows/memmap.py +++ b/volatility3/framework/plugins/windows/memmap.py @@ -4,10 +4,10 @@ import logging from typing import List -from volatility.framework import exceptions, renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import pslist +from volatility3.framework import exceptions, renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) @@ -15,7 +15,7 @@ vollog = logging.getLogger(__name__) class Memmap(interfaces.plugins.PluginInterface): """Prints the memory map""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/windows/modscan.py b/volatility3/framework/plugins/windows/modscan.py similarity index 95% rename from volatility/framework/plugins/windows/modscan.py rename to volatility3/framework/plugins/windows/modscan.py index 3ff0f399a..13b23577f 100644 --- a/volatility/framework/plugins/windows/modscan.py +++ b/volatility3/framework/plugins/windows/modscan.py @@ -4,12 +4,12 @@ import logging from typing import Iterable, List, Generator -from volatility.framework import renderers, interfaces, exceptions, constants -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe -from volatility.plugins.windows import poolscanner, dlllist, pslist +from volatility3.framework import renderers, interfaces, exceptions, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins.windows import poolscanner, dlllist, pslist vollog = logging.getLogger(__name__) @@ -17,7 +17,7 @@ vollog = logging.getLogger(__name__) class ModScan(interfaces.plugins.PluginInterface): """Scans for modules present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py similarity index 94% rename from volatility/framework/plugins/windows/modules.py rename to volatility3/framework/plugins/windows/modules.py index df2c04fef..b030066db 100644 --- a/volatility/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -4,14 +4,14 @@ import logging from typing import List, Iterable, Generator -from volatility.framework import constants -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe -from volatility.plugins.windows import pslist, dlllist +from volatility3.framework import constants +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins.windows import pslist, dlllist vollog = logging.getLogger(__name__) @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Modules(interfaces.plugins.PluginInterface): """Lists the loaded kernel modules.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 1, 0) @classmethod diff --git a/volatility/framework/plugins/windows/mutantscan.py b/volatility3/framework/plugins/windows/mutantscan.py similarity index 89% rename from volatility/framework/plugins/windows/mutantscan.py rename to volatility3/framework/plugins/windows/mutantscan.py index d9053c44a..c0a47d38e 100644 --- a/volatility/framework/plugins/windows/mutantscan.py +++ b/volatility3/framework/plugins/windows/mutantscan.py @@ -4,16 +4,16 @@ from typing import Iterable -from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import poolscanner +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import poolscanner class MutantScan(interfaces.plugins.PluginInterface): """Scans for mutexes present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py similarity index 97% rename from volatility/framework/plugins/windows/netscan.py rename to volatility3/framework/plugins/windows/netscan.py index 09b02e3ac..0f58c97f5 100644 --- a/volatility/framework/plugins/windows/netscan.py +++ b/volatility3/framework/plugins/windows/netscan.py @@ -6,14 +6,14 @@ import datetime import logging from typing import Iterable, List, Optional -from volatility.framework import constants, exceptions, interfaces, renderers, symbols -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import versions -from volatility.framework.symbols.windows.extensions import network -from volatility.plugins import timeliner -from volatility.plugins.windows import info, poolscanner +from volatility3.framework import constants, exceptions, interfaces, renderers, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import versions +from volatility3.framework.symbols.windows.extensions import network +from volatility3.plugins import timeliner +from volatility3.plugins.windows import info, poolscanner vollog = logging.getLogger(__name__) @@ -21,7 +21,7 @@ vollog = logging.getLogger(__name__) class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for network objects present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py similarity index 97% rename from volatility/framework/plugins/windows/poolscanner.py rename to volatility3/framework/plugins/windows/poolscanner.py index c888c1f6a..b2ea449ea 100644 --- a/volatility/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -6,14 +6,14 @@ import enum import logging from typing import Dict, Generator, List, Optional, Tuple -from volatility.framework import constants, interfaces, renderers, exceptions, symbols -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins, configuration -from volatility.framework.layers import scanners -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import extensions, versions -from volatility.plugins.windows import handles +from volatility3.framework import constants, interfaces, renderers, exceptions, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins, configuration +from volatility3.framework.layers import scanners +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import extensions, versions +from volatility3.plugins.windows import handles vollog = logging.getLogger(__name__) @@ -115,7 +115,7 @@ class PoolScanner(plugins.PluginInterface): """A generic pool scanner plugin.""" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/windows/privileges.py b/volatility3/framework/plugins/windows/privileges.py similarity index 92% rename from volatility/framework/plugins/windows/privileges.py rename to volatility3/framework/plugins/windows/privileges.py index f24aa7be3..8c652daa6 100644 --- a/volatility/framework/plugins/windows/privileges.py +++ b/volatility3/framework/plugins/windows/privileges.py @@ -6,9 +6,9 @@ import logging import os from typing import List -from volatility.framework import renderers, interfaces, objects, exceptions, constants -from volatility.framework.configuration import requirements -from volatility.plugins.windows import pslist +from volatility3.framework import renderers, interfaces, objects, exceptions, constants +from volatility3.framework.configuration import requirements +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) @@ -17,7 +17,7 @@ class Privs(interfaces.plugins.PluginInterface): """Lists process token privileges""" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py similarity index 95% rename from volatility/framework/plugins/windows/pslist.py rename to volatility3/framework/plugins/windows/pslist.py index be3bf0235..f9fb20aaf 100644 --- a/volatility/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -6,13 +6,13 @@ import datetime import logging from typing import Callable, Iterable, List, Type -from volatility.framework import renderers, interfaces, layers, constants -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe -from volatility.plugins import timeliner +from volatility3.framework import renderers, interfaces, layers, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins import timeliner vollog = logging.getLogger(__name__) @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the processes present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (2, 0, 0) PHYSICAL_DEFAULT = False diff --git a/volatility/framework/plugins/windows/psscan.py b/volatility3/framework/plugins/windows/psscan.py similarity index 94% rename from volatility/framework/plugins/windows/psscan.py rename to volatility3/framework/plugins/windows/psscan.py index 76823ee37..a5e20ef62 100644 --- a/volatility/framework/plugins/windows/psscan.py +++ b/volatility3/framework/plugins/windows/psscan.py @@ -6,15 +6,15 @@ import datetime import logging from typing import Iterable, Callable, Tuple -from volatility.framework import renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe -from volatility.plugins import timeliner -from volatility.plugins.windows import info -from volatility.plugins.windows import poolscanner -from volatility.plugins.windows import pslist +from volatility3.framework import renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins import timeliner +from volatility3.plugins.windows import info +from volatility3.plugins.windows import poolscanner +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) @@ -22,7 +22,7 @@ vollog = logging.getLogger(__name__) class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for processes present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 1, 0) @classmethod diff --git a/volatility/framework/plugins/windows/pstree.py b/volatility3/framework/plugins/windows/pstree.py similarity index 94% rename from volatility/framework/plugins/windows/pstree.py rename to volatility3/framework/plugins/windows/pstree.py index a4027ea7a..3b695ea70 100644 --- a/volatility/framework/plugins/windows/pstree.py +++ b/volatility3/framework/plugins/windows/pstree.py @@ -4,17 +4,17 @@ import datetime from typing import Dict, Set -from volatility.framework import objects, interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import pslist +from volatility3.framework import objects, interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist class PsTree(interfaces.plugins.PluginInterface): """Plugin for listing processes in a tree based on their parent process ID.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs) -> None: super().__init__(*args, **kwargs) diff --git a/volatility/framework/plugins/windows/registry/__init__.py b/volatility3/framework/plugins/windows/registry/__init__.py similarity index 70% rename from volatility/framework/plugins/windows/registry/__init__.py rename to volatility3/framework/plugins/windows/registry/__init__.py index 4939c7755..4351a2ca2 100644 --- a/volatility/framework/plugins/windows/registry/__init__.py +++ b/volatility3/framework/plugins/windows/registry/__init__.py @@ -3,6 +3,6 @@ # """All core windows registry plugins. -These modules should only be imported from volatility.plugins NOT -volatility.framework.plugins +These modules should only be imported from volatility3.plugins NOT +volatility3.framework.plugins """ diff --git a/volatility/framework/plugins/windows/registry/hivelist.py b/volatility3/framework/plugins/windows/registry/hivelist.py similarity index 97% rename from volatility/framework/plugins/windows/registry/hivelist.py rename to volatility3/framework/plugins/windows/registry/hivelist.py index 81aa6b26a..249118c8e 100644 --- a/volatility/framework/plugins/windows/registry/hivelist.py +++ b/volatility3/framework/plugins/windows/registry/hivelist.py @@ -4,11 +4,11 @@ import logging from typing import Iterator, List, Tuple, Iterable, Optional -from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import registry -from volatility.framework.renderers import format_hints -from volatility.plugins.windows.registry import hivescan +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import registry +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows.registry import hivescan vollog = logging.getLogger(__name__) @@ -17,7 +17,7 @@ class HiveGenerator: """Walks the registry HiveList linked list in a given direction and stores an invalid offset if it's unable to fully walk the list""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, cmhive, forward = True): self._cmhive = cmhive @@ -40,7 +40,7 @@ class HiveList(interfaces.plugins.PluginInterface): """Lists the registry hives present in a particular memory image.""" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/windows/registry/hivescan.py b/volatility3/framework/plugins/windows/registry/hivescan.py similarity index 90% rename from volatility/framework/plugins/windows/registry/hivescan.py rename to volatility3/framework/plugins/windows/registry/hivescan.py index 466e27763..ac04fcc02 100644 --- a/volatility/framework/plugins/windows/registry/hivescan.py +++ b/volatility3/framework/plugins/windows/registry/hivescan.py @@ -4,18 +4,18 @@ from typing import Iterable -from volatility.framework import renderers, interfaces, symbols -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols.windows import versions -from volatility.plugins.windows import poolscanner, bigpools +from volatility3.framework import renderers, interfaces, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols.windows import versions +from volatility3.plugins.windows import poolscanner, bigpools class HiveScan(interfaces.plugins.PluginInterface): """Scans for registry hives present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py similarity index 95% rename from volatility/framework/plugins/windows/registry/printkey.py rename to volatility3/framework/plugins/windows/registry/printkey.py index da660792e..5b0a909fc 100644 --- a/volatility/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -6,12 +6,12 @@ import datetime import logging from typing import List, Sequence, Iterable, Tuple, Union -from volatility.framework import objects, renderers, exceptions, interfaces, constants -from volatility.framework.configuration import requirements -from volatility.framework.layers.registry import RegistryHive, RegistryFormatException -from volatility.framework.renderers import TreeGrid, conversion, format_hints -from volatility.framework.symbols.windows.extensions.registry import RegValueTypes -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import objects, renderers, exceptions, interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.layers.registry import RegistryHive, RegistryFormatException +from volatility3.framework.renderers import TreeGrid, conversion, format_hints +from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class PrintKey(interfaces.plugins.PluginInterface): """Lists the registry keys under a hive or specific key value.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/registry/userassist.json b/volatility3/framework/plugins/windows/registry/userassist.json similarity index 100% rename from volatility/framework/plugins/windows/registry/userassist.json rename to volatility3/framework/plugins/windows/registry/userassist.json diff --git a/volatility/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py similarity index 96% rename from volatility/framework/plugins/windows/registry/userassist.py rename to volatility3/framework/plugins/windows/registry/userassist.py index c18d92edf..b2ce971bf 100644 --- a/volatility/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -9,13 +9,13 @@ import logging import os from typing import Any, List, Tuple, Generator -from volatility.framework import exceptions, renderers, constants, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.layers.physical import BufferDataLayer -from volatility.framework.layers.registry import RegistryHive -from volatility.framework.renderers import format_hints, conversion -from volatility.framework.symbols import intermed -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import exceptions, renderers, constants, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.layers.physical import BufferDataLayer +from volatility3.framework.layers.registry import RegistryHive +from volatility3.framework.renderers import format_hints, conversion +from volatility3.framework.symbols import intermed +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) @@ -23,7 +23,7 @@ vollog = logging.getLogger(__name__) class UserAssist(interfaces.plugins.PluginInterface): """Print userassist registry keys and information.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility/framework/plugins/windows/sids_and_privileges.json b/volatility3/framework/plugins/windows/sids_and_privileges.json similarity index 100% rename from volatility/framework/plugins/windows/sids_and_privileges.json rename to volatility3/framework/plugins/windows/sids_and_privileges.json diff --git a/volatility/framework/plugins/windows/ssdt.py b/volatility3/framework/plugins/windows/ssdt.py similarity index 92% rename from volatility/framework/plugins/windows/ssdt.py rename to volatility3/framework/plugins/windows/ssdt.py index 539d2e0a4..8092beb2f 100644 --- a/volatility/framework/plugins/windows/ssdt.py +++ b/volatility3/framework/plugins/windows/ssdt.py @@ -5,20 +5,20 @@ import os from typing import Any, Iterator, List, Tuple -from volatility.framework import constants, interfaces -from volatility.framework import contexts -from volatility.framework import exceptions, symbols -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import modules +from volatility3.framework import constants, interfaces +from volatility3.framework import contexts +from volatility3.framework import exceptions, symbols +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import modules class SSDT(plugins.PluginInterface): """Lists the system call table.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/strings.py b/volatility3/framework/plugins/windows/strings.py similarity index 94% rename from volatility/framework/plugins/windows/strings.py rename to volatility3/framework/plugins/windows/strings.py index 90fb82df8..3e9fdfb85 100644 --- a/volatility/framework/plugins/windows/strings.py +++ b/volatility3/framework/plugins/windows/strings.py @@ -7,11 +7,11 @@ import re from os import path from typing import Dict, Generator, List, Set, Tuple -from volatility.framework import interfaces, renderers, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import intel, resources, linear -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import pslist +from volatility3.framework import interfaces, renderers, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import intel, resources, linear +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Strings(interfaces.plugins.PluginInterface): """Reads output from the strings command and indicates which process(es) each string belongs to.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) strings_pattern = re.compile(rb"(?:\W*)([0-9]+)(?:\W*)(\w[\w\W]+)\n?") @classmethod diff --git a/volatility/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py similarity index 93% rename from volatility/framework/plugins/windows/svcscan.py rename to volatility3/framework/plugins/windows/svcscan.py index 8c9866631..4820e5735 100644 --- a/volatility/framework/plugins/windows/svcscan.py +++ b/volatility3/framework/plugins/windows/svcscan.py @@ -5,14 +5,14 @@ import logging from typing import List -from volatility.framework import interfaces, renderers, constants, symbols, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import scanners -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import versions -from volatility.framework.symbols.windows.extensions import services -from volatility.plugins.windows import poolscanner, vadyarascan, pslist +from volatility3.framework import interfaces, renderers, constants, symbols, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import scanners +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import versions +from volatility3.framework.symbols.windows.extensions import services +from volatility3.plugins.windows import poolscanner, vadyarascan, pslist vollog = logging.getLogger(__name__) @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class SvcScan(interfaces.plugins.PluginInterface): """Scans for windows services.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/symlinkscan.py b/volatility3/framework/plugins/windows/symlinkscan.py similarity index 89% rename from volatility/framework/plugins/windows/symlinkscan.py rename to volatility3/framework/plugins/windows/symlinkscan.py index 74f5e116a..abfbd1d6d 100644 --- a/volatility/framework/plugins/windows/symlinkscan.py +++ b/volatility3/framework/plugins/windows/symlinkscan.py @@ -5,17 +5,17 @@ import datetime from typing import Iterable -from volatility.framework import renderers, exceptions, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins import timeliner -from volatility.plugins.windows import poolscanner +from volatility3.framework import renderers, exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins import timeliner +from volatility3.plugins.windows import poolscanner class SymlinkScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for links present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py similarity index 96% rename from volatility/framework/plugins/windows/vadinfo.py rename to volatility3/framework/plugins/windows/vadinfo.py index 25d232c24..d50f596aa 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -5,11 +5,11 @@ import logging from typing import Callable, List, Generator, Iterable, Type, Optional -from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import pslist +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) @@ -33,7 +33,7 @@ winnt_protections = { class VadInfo(interfaces.plugins.PluginInterface): """Lists process memory ranges.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (2, 0, 0) MAXSIZE_DEFAULT = 0 diff --git a/volatility/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py similarity index 93% rename from volatility/framework/plugins/windows/vadyarascan.py rename to volatility3/framework/plugins/windows/vadyarascan.py index 799cdc4a2..cdb349cf8 100644 --- a/volatility/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -5,11 +5,11 @@ import logging from typing import Iterable, List, Tuple -from volatility.framework import interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins import yarascan -from volatility.plugins.windows import pslist +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins import yarascan +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) @@ -17,7 +17,7 @@ vollog = logging.getLogger(__name__) class VadYaraScan(interfaces.plugins.PluginInterface): """Scans all the Virtual Address Descriptor memory maps using yara.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/verinfo.py b/volatility3/framework/plugins/windows/verinfo.py similarity index 94% rename from volatility/framework/plugins/windows/verinfo.py rename to volatility3/framework/plugins/windows/verinfo.py index 5338a3178..d65402a6a 100644 --- a/volatility/framework/plugins/windows/verinfo.py +++ b/volatility3/framework/plugins/windows/verinfo.py @@ -6,12 +6,12 @@ import io import logging from typing import Generator, List, Tuple -from volatility.framework import exceptions, renderers, constants, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe -from volatility.plugins.windows import pslist, modules, dlllist +from volatility3.framework import exceptions, renderers, constants, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins.windows import pslist, modules, dlllist vollog = logging.getLogger(__name__) @@ -25,7 +25,7 @@ except ImportError: class VerInfo(interfaces.plugins.PluginInterface): """Lists version information from PE files.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/windows/virtmap.py b/volatility3/framework/plugins/windows/virtmap.py similarity index 95% rename from volatility/framework/plugins/windows/virtmap.py rename to volatility3/framework/plugins/windows/virtmap.py index 5ce7d5d78..552564cad 100644 --- a/volatility/framework/plugins/windows/virtmap.py +++ b/volatility3/framework/plugins/windows/virtmap.py @@ -5,10 +5,10 @@ import logging from typing import List, Tuple, Dict, Generator -from volatility.framework import interfaces, renderers, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import intel -from volatility.framework.renderers import format_hints +from volatility3.framework import interfaces, renderers, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import intel +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) @@ -16,7 +16,7 @@ vollog = logging.getLogger(__name__) class VirtMap(interfaces.plugins.PluginInterface): """Lists virtual mapped sections.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py similarity index 92% rename from volatility/framework/plugins/yarascan.py rename to volatility3/framework/plugins/yarascan.py index 4e3abee25..1c04e2311 100644 --- a/volatility/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -5,11 +5,11 @@ import logging from typing import Iterable, Tuple, List, Dict, Any -from volatility.framework import interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.layers import resources -from volatility.framework.renderers import format_hints +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.layers import resources +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) @@ -37,7 +37,7 @@ class YaraScanner(interfaces.layers.ScannerInterface): class YaraScan(plugins.PluginInterface): """Scans kernel memory using yara rules (string or file).""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/renderers/__init__.py b/volatility3/framework/renderers/__init__.py similarity index 99% rename from volatility/framework/renderers/__init__.py rename to volatility3/framework/renderers/__init__.py index 431ac8034..c7dc126b2 100644 --- a/volatility/framework/renderers/__init__.py +++ b/volatility3/framework/renderers/__init__.py @@ -11,8 +11,8 @@ import datetime import logging from typing import Any, Callable, Iterable, List, Optional, Sequence, Tuple, TypeVar, Union -from volatility.framework import interfaces -from volatility.framework.interfaces import renderers +from volatility3.framework import interfaces +from volatility3.framework.interfaces import renderers vollog = logging.getLogger(__name__) diff --git a/volatility/framework/renderers/conversion.py b/volatility3/framework/renderers/conversion.py similarity index 98% rename from volatility/framework/renderers/conversion.py rename to volatility3/framework/renderers/conversion.py index c570c124f..b60b47411 100644 --- a/volatility/framework/renderers/conversion.py +++ b/volatility3/framework/renderers/conversion.py @@ -8,7 +8,7 @@ import socket import struct from typing import Union -from volatility.framework import interfaces, renderers +from volatility3.framework import interfaces, renderers def wintime_to_datetime(wintime: int) -> Union[interfaces.renderers.BaseAbsentValue, datetime.datetime]: diff --git a/volatility/framework/renderers/format_hints.py b/volatility3/framework/renderers/format_hints.py similarity index 100% rename from volatility/framework/renderers/format_hints.py rename to volatility3/framework/renderers/format_hints.py diff --git a/volatility/framework/symbols/__init__.py b/volatility3/framework/symbols/__init__.py similarity index 99% rename from volatility/framework/symbols/__init__.py rename to volatility3/framework/symbols/__init__.py index 6cbf41196..c2444682c 100644 --- a/volatility/framework/symbols/__init__.py +++ b/volatility3/framework/symbols/__init__.py @@ -8,7 +8,7 @@ import enum import logging from typing import Any, Dict, Iterable, Iterator, TypeVar, List -from volatility.framework import constants, exceptions, interfaces, objects +from volatility3.framework import constants, exceptions, interfaces, objects vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/generic/__init__.py b/volatility3/framework/symbols/generic/__init__.py similarity index 97% rename from volatility/framework/symbols/generic/__init__.py rename to volatility3/framework/symbols/generic/__init__.py index be0bfb59a..68b4e9252 100644 --- a/volatility/framework/symbols/generic/__init__.py +++ b/volatility3/framework/symbols/generic/__init__.py @@ -6,7 +6,7 @@ import random import string from typing import Union -from volatility.framework import objects, interfaces +from volatility3.framework import objects, interfaces class GenericIntelProcess(objects.StructType): diff --git a/volatility/framework/symbols/generic/qemu.json b/volatility3/framework/symbols/generic/qemu.json similarity index 100% rename from volatility/framework/symbols/generic/qemu.json rename to volatility3/framework/symbols/generic/qemu.json diff --git a/volatility/framework/symbols/intermed.py b/volatility3/framework/symbols/intermed.py similarity index 98% rename from volatility/framework/symbols/intermed.py rename to volatility3/framework/symbols/intermed.py index b383846a1..0ff03cbca 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility3/framework/symbols/intermed.py @@ -13,11 +13,11 @@ import zipfile from abc import ABCMeta from typing import Any, Dict, Generator, Iterable, List, Optional, Type, Tuple, Mapping -from volatility.framework.layers import resources -from volatility import schemas, symbols -from volatility.framework import class_subclasses, constants, exceptions, interfaces, objects -from volatility.framework.configuration import requirements -from volatility.framework.symbols import native, metadata +from volatility3.framework.layers import resources +from volatility3 import schemas, symbols +from volatility3.framework import class_subclasses, constants, exceptions, interfaces, objects +from volatility3.framework.configuration import requirements +from volatility3.framework.symbols import native, metadata vollog = logging.getLogger(__name__) @@ -71,7 +71,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): * Enums can specify a list of names and values and a type inside which the numeric encoding will fit * Metadata defines information about the originating file - These are documented in JSONSchema JSON files located in volatility/schemas. + These are documented in JSONSchema JSON files located in volatility3/schemas. """ def __init__(self, @@ -229,7 +229,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): Args: context: The context that the current plugin is being run within config_path: The configuration path for reading/storing configuration information this symbol table may use - sub_path: The path under a suitable symbol path (defaults to volatility/symbols and volatility/framework/symbols) to check + sub_path: The path under a suitable symbol path (defaults to volatility3/symbols and volatility3/framework/symbols) to check filename: Basename of the file to find under the sub_path native_types: Set of native types, defaults to native types read from the intermediate symbol format file table_mapping: a dictionary of table names mentioned within the ISF file, and the tables within the context which they map to diff --git a/volatility/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py similarity index 96% rename from volatility/framework/symbols/linux/__init__.py rename to volatility3/framework/symbols/linux/__init__.py index d8c88d07a..0d8e99e42 100644 --- a/volatility/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -3,11 +3,11 @@ # from typing import List, Tuple, Iterator -from volatility.framework import exceptions, constants, interfaces, objects, contexts -from volatility.framework.objects import utility -from volatility.framework.symbols import intermed -from volatility.framework.symbols.linux import extensions -from volatility.framework.objects import utility +from volatility3.framework import exceptions, constants, interfaces, objects, contexts +from volatility3.framework.objects import utility +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.linux import extensions +from volatility3.framework.objects import utility class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): diff --git a/volatility/framework/symbols/linux/bash.py b/volatility3/framework/symbols/linux/bash.py similarity index 77% rename from volatility/framework/symbols/linux/bash.py rename to volatility3/framework/symbols/linux/bash.py index 570d2cda5..f1f40ace1 100644 --- a/volatility/framework/symbols/linux/bash.py +++ b/volatility3/framework/symbols/linux/bash.py @@ -2,8 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework.symbols import intermed -from volatility.framework.symbols.linux.extensions import bash +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.linux.extensions import bash class BashIntermedSymbols(intermed.IntermediateSymbolTable): diff --git a/volatility/framework/symbols/linux/bash32.json b/volatility3/framework/symbols/linux/bash32.json similarity index 100% rename from volatility/framework/symbols/linux/bash32.json rename to volatility3/framework/symbols/linux/bash32.json diff --git a/volatility/framework/symbols/linux/bash64.json b/volatility3/framework/symbols/linux/bash64.json similarity index 100% rename from volatility/framework/symbols/linux/bash64.json rename to volatility3/framework/symbols/linux/bash64.json diff --git a/volatility/framework/symbols/linux/elf.json b/volatility3/framework/symbols/linux/elf.json similarity index 100% rename from volatility/framework/symbols/linux/elf.json rename to volatility3/framework/symbols/linux/elf.json diff --git a/volatility/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py similarity index 97% rename from volatility/framework/symbols/linux/extensions/__init__.py rename to volatility3/framework/symbols/linux/extensions/__init__.py index c601c0979..5bcfda11e 100644 --- a/volatility/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -6,13 +6,13 @@ import collections.abc import logging from typing import Generator, Iterable, Iterator, Optional, Tuple -from volatility.framework import constants -from volatility.framework import exceptions, objects, interfaces, symbols -from volatility.framework.layers import linear -from volatility.framework.objects import utility -from volatility.framework.symbols import generic, linux -from volatility.framework.symbols import intermed -from volatility.framework.symbols.linux.extensions import elf +from volatility3.framework import constants +from volatility3.framework import exceptions, objects, interfaces, symbols +from volatility3.framework.layers import linear +from volatility3.framework.objects import utility +from volatility3.framework.symbols import generic, linux +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.linux.extensions import elf vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/linux/extensions/bash.py b/volatility3/framework/symbols/linux/extensions/bash.py similarity index 89% rename from volatility/framework/symbols/linux/extensions/bash.py rename to volatility3/framework/symbols/linux/extensions/bash.py index c583b67a4..40fa2521d 100644 --- a/volatility/framework/symbols/linux/extensions/bash.py +++ b/volatility3/framework/symbols/linux/extensions/bash.py @@ -2,10 +2,10 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import exceptions -from volatility.framework import objects -from volatility.framework.objects import utility -from volatility.framework.renderers import conversion +from volatility3.framework import exceptions +from volatility3.framework import objects +from volatility3.framework.objects import utility +from volatility3.framework.renderers import conversion class hist_entry(objects.StructType): diff --git a/volatility/framework/symbols/linux/extensions/elf.py b/volatility3/framework/symbols/linux/extensions/elf.py similarity index 98% rename from volatility/framework/symbols/linux/extensions/elf.py rename to volatility3/framework/symbols/linux/extensions/elf.py index 505132ea9..0774e937a 100644 --- a/volatility/framework/symbols/linux/extensions/elf.py +++ b/volatility3/framework/symbols/linux/extensions/elf.py @@ -4,8 +4,8 @@ from typing import Dict, Tuple -from volatility.framework import constants -from volatility.framework import objects, interfaces +from volatility3.framework import constants +from volatility3.framework import objects, interfaces class elf(objects.StructType): diff --git a/volatility/framework/symbols/mac/__init__.py b/volatility3/framework/symbols/mac/__init__.py similarity index 97% rename from volatility/framework/symbols/mac/__init__.py rename to volatility3/framework/symbols/mac/__init__.py index 4343a38f3..54a5259d0 100644 --- a/volatility/framework/symbols/mac/__init__.py +++ b/volatility3/framework/symbols/mac/__init__.py @@ -3,9 +3,9 @@ # from typing import Iterator, Any, Iterable, List, Tuple, Set -from volatility.framework import interfaces, objects, exceptions, constants -from volatility.framework.symbols import intermed -from volatility.framework.symbols.mac import extensions +from volatility3.framework import interfaces, objects, exceptions, constants +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.mac import extensions class MacKernelIntermedSymbols(intermed.IntermediateSymbolTable): diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility3/framework/symbols/mac/extensions/__init__.py similarity index 98% rename from volatility/framework/symbols/mac/extensions/__init__.py rename to volatility3/framework/symbols/mac/extensions/__init__.py index 787e7b56d..37d733af6 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility3/framework/symbols/mac/extensions/__init__.py @@ -4,11 +4,11 @@ from typing import Generator, Iterable, Optional, Set, Tuple -from volatility.framework import constants, objects, renderers -from volatility.framework import exceptions, interfaces -from volatility.framework.objects import utility -from volatility.framework.renderers import conversion -from volatility.framework.symbols import generic +from volatility3.framework import constants, objects, renderers +from volatility3.framework import exceptions, interfaces +from volatility3.framework.objects import utility +from volatility3.framework.renderers import conversion +from volatility3.framework.symbols import generic class proc(generic.GenericIntelProcess): @@ -270,7 +270,7 @@ class vm_map_entry(objects.StructType): if found: vpager = context.object(config_prefix + constants.BANG + "vnode_pager", - layer_name = vnode_object.vol.layer_name, + layer_name = vnode_object.vol.native_layer_name, offset = vnode_object.pager) ret = vpager.vnode_handle else: @@ -517,7 +517,7 @@ class sysctl_oid(objects.StructType): Returns: A combination of: - R - readable + R - readable W - writeable L - self handles locking """ diff --git a/volatility/framework/symbols/metadata.py b/volatility3/framework/symbols/metadata.py similarity index 96% rename from volatility/framework/symbols/metadata.py rename to volatility3/framework/symbols/metadata.py index 444fb6481..7cde686ee 100644 --- a/volatility/framework/symbols/metadata.py +++ b/volatility3/framework/symbols/metadata.py @@ -4,7 +4,7 @@ from typing import Optional, Tuple -from volatility.framework import interfaces +from volatility3.framework import interfaces class WindowsMetadata(interfaces.symbols.MetadataInterface): diff --git a/volatility/framework/symbols/native.py b/volatility3/framework/symbols/native.py similarity index 98% rename from volatility/framework/symbols/native.py rename to volatility3/framework/symbols/native.py index 26d12bd7e..fdc161322 100644 --- a/volatility/framework/symbols/native.py +++ b/volatility3/framework/symbols/native.py @@ -5,7 +5,7 @@ import copy from typing import Any, Dict, Iterable, Optional, Type -from volatility.framework import constants, interfaces, objects +from volatility3.framework import constants, interfaces, objects class NativeTable(interfaces.symbols.NativeTableInterface): diff --git a/volatility/framework/symbols/windows/__init__.py b/volatility3/framework/symbols/windows/__init__.py similarity index 92% rename from volatility/framework/symbols/windows/__init__.py rename to volatility3/framework/symbols/windows/__init__.py index d99706022..3aa607574 100755 --- a/volatility/framework/symbols/windows/__init__.py +++ b/volatility3/framework/symbols/windows/__init__.py @@ -1,10 +1,10 @@ # This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import volatility.framework.symbols.windows.extensions.pool -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import extensions -from volatility.framework.symbols.windows.extensions import registry, pool +import volatility3.framework.symbols.windows.extensions.pool +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import extensions +from volatility3.framework.symbols.windows.extensions import registry, pool class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): diff --git a/volatility/framework/symbols/windows/bigpools-vista-x64.json b/volatility3/framework/symbols/windows/bigpools-vista-x64.json similarity index 100% rename from volatility/framework/symbols/windows/bigpools-vista-x64.json rename to volatility3/framework/symbols/windows/bigpools-vista-x64.json diff --git a/volatility/framework/symbols/windows/bigpools-vista-x86.json b/volatility3/framework/symbols/windows/bigpools-vista-x86.json similarity index 100% rename from volatility/framework/symbols/windows/bigpools-vista-x86.json rename to volatility3/framework/symbols/windows/bigpools-vista-x86.json diff --git a/volatility/framework/symbols/windows/bigpools-win10-x64.json b/volatility3/framework/symbols/windows/bigpools-win10-x64.json similarity index 100% rename from volatility/framework/symbols/windows/bigpools-win10-x64.json rename to volatility3/framework/symbols/windows/bigpools-win10-x64.json diff --git a/volatility/framework/symbols/windows/bigpools-win10-x86.json b/volatility3/framework/symbols/windows/bigpools-win10-x86.json similarity index 100% rename from volatility/framework/symbols/windows/bigpools-win10-x86.json rename to volatility3/framework/symbols/windows/bigpools-win10-x86.json diff --git a/volatility/framework/symbols/windows/bigpools-x64.json b/volatility3/framework/symbols/windows/bigpools-x64.json similarity index 100% rename from volatility/framework/symbols/windows/bigpools-x64.json rename to volatility3/framework/symbols/windows/bigpools-x64.json diff --git a/volatility/framework/symbols/windows/bigpools-x86.json b/volatility3/framework/symbols/windows/bigpools-x86.json similarity index 100% rename from volatility/framework/symbols/windows/bigpools-x86.json rename to volatility3/framework/symbols/windows/bigpools-x86.json diff --git a/volatility/framework/symbols/windows/callbacks-x64.json b/volatility3/framework/symbols/windows/callbacks-x64.json similarity index 100% rename from volatility/framework/symbols/windows/callbacks-x64.json rename to volatility3/framework/symbols/windows/callbacks-x64.json diff --git a/volatility/framework/symbols/windows/callbacks-x86.json b/volatility3/framework/symbols/windows/callbacks-x86.json similarity index 100% rename from volatility/framework/symbols/windows/callbacks-x86.json rename to volatility3/framework/symbols/windows/callbacks-x86.json diff --git a/volatility/framework/symbols/windows/crash.json b/volatility3/framework/symbols/windows/crash.json similarity index 100% rename from volatility/framework/symbols/windows/crash.json rename to volatility3/framework/symbols/windows/crash.json diff --git a/volatility/framework/symbols/windows/crash64.json b/volatility3/framework/symbols/windows/crash64.json similarity index 100% rename from volatility/framework/symbols/windows/crash64.json rename to volatility3/framework/symbols/windows/crash64.json diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py similarity index 99% rename from volatility/framework/symbols/windows/extensions/__init__.py rename to volatility3/framework/symbols/windows/extensions/__init__.py index 9352b04d3..f402c800f 100755 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -6,15 +6,14 @@ import collections.abc import datetime import functools import logging -import struct import math -from typing import Iterable, Iterator, Optional, Union, Dict, Tuple, List +from typing import Iterable, Iterator, Optional, Union, Tuple, List -from volatility.framework import constants, exceptions, interfaces, objects, renderers, symbols -from volatility.framework.layers import intel -from volatility.framework.renderers import conversion -from volatility.framework.symbols import generic -from volatility.framework.symbols.windows.extensions import pool, pe, kdbg +from volatility3.framework import constants, exceptions, interfaces, objects, renderers, symbols +from volatility3.framework.layers import intel +from volatility3.framework.renderers import conversion +from volatility3.framework.symbols import generic +from volatility3.framework.symbols.windows.extensions import pool, pe, kdbg vollog = logging.getLogger(__name__) @@ -1052,7 +1051,7 @@ class SHARED_CACHE_MAP(objects.StructType): continue vacb_obj = vacb_array[counter].dereference().cast(symbol_table_name + constants.BANG + "_VACB") - if vacb_obj.is_valid(shared_cache_map = self): + if vacb_obj.SharedCacheMap == self.vol.offset: self.save_vacb(vacb_obj, vacb_list) else: # Process the next level of the multi-level array diff --git a/volatility/framework/symbols/windows/extensions/kdbg.py b/volatility3/framework/symbols/windows/extensions/kdbg.py similarity index 93% rename from volatility/framework/symbols/windows/extensions/kdbg.py rename to volatility3/framework/symbols/windows/extensions/kdbg.py index 6a98d62b9..437edf823 100644 --- a/volatility/framework/symbols/windows/extensions/kdbg.py +++ b/volatility3/framework/symbols/windows/extensions/kdbg.py @@ -2,8 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import constants -from volatility.framework import objects +from volatility3.framework import constants +from volatility3.framework import objects class KDDEBUGGER_DATA64(objects.StructType): diff --git a/volatility/framework/symbols/windows/extensions/network.py b/volatility3/framework/symbols/windows/extensions/network.py similarity index 97% rename from volatility/framework/symbols/windows/extensions/network.py rename to volatility3/framework/symbols/windows/extensions/network.py index c3f8d17cc..78b4c77d7 100644 --- a/volatility/framework/symbols/windows/extensions/network.py +++ b/volatility3/framework/symbols/windows/extensions/network.py @@ -6,10 +6,10 @@ import logging import socket from typing import Dict, Tuple, List, Union -from volatility.framework import exceptions -from volatility.framework import objects, interfaces -from volatility.framework.objects import Array -from volatility.framework.renderers import conversion +from volatility3.framework import exceptions +from volatility3.framework import objects, interfaces +from volatility3.framework.objects import Array +from volatility3.framework.renderers import conversion vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/windows/extensions/pe.py b/volatility3/framework/symbols/windows/extensions/pe.py similarity index 98% rename from volatility/framework/symbols/windows/extensions/pe.py rename to volatility3/framework/symbols/windows/extensions/pe.py index 39bbf00c0..b7b6d71df 100644 --- a/volatility/framework/symbols/windows/extensions/pe.py +++ b/volatility3/framework/symbols/windows/extensions/pe.py @@ -5,9 +5,9 @@ from typing import Generator, Tuple import logging -from volatility.framework import constants -from volatility.framework import objects, interfaces -from volatility.framework.renderers import conversion +from volatility3.framework import constants +from volatility3.framework import objects, interfaces +from volatility3.framework.renderers import conversion vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/windows/extensions/pool.py b/volatility3/framework/symbols/windows/extensions/pool.py similarity index 99% rename from volatility/framework/symbols/windows/extensions/pool.py rename to volatility3/framework/symbols/windows/extensions/pool.py index c029964af..895533840 100644 --- a/volatility/framework/symbols/windows/extensions/pool.py +++ b/volatility3/framework/symbols/windows/extensions/pool.py @@ -3,8 +3,8 @@ import logging import struct from typing import Optional, Tuple, List, Dict, Union -from volatility.framework import objects, interfaces, constants, symbols, exceptions, renderers -from volatility.framework.renderers import conversion +from volatility3.framework import objects, interfaces, constants, symbols, exceptions, renderers +from volatility3.framework.renderers import conversion vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py similarity index 98% rename from volatility/framework/symbols/windows/extensions/registry.py rename to volatility3/framework/symbols/windows/extensions/registry.py index cf15e6c18..3cf2469ff 100644 --- a/volatility/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -7,8 +7,8 @@ import logging import struct from typing import Optional, Iterable, Union -from volatility.framework import constants, exceptions, objects, interfaces -from volatility.framework.layers.registry import RegistryHive, RegistryInvalidIndex, RegistryFormatException +from volatility3.framework import constants, exceptions, objects, interfaces +from volatility3.framework.layers.registry import RegistryHive, RegistryInvalidIndex, RegistryFormatException vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/windows/extensions/services.py b/volatility3/framework/symbols/windows/extensions/services.py similarity index 96% rename from volatility/framework/symbols/windows/extensions/services.py rename to volatility3/framework/symbols/windows/extensions/services.py index fa372609e..5e04c51b6 100644 --- a/volatility/framework/symbols/windows/extensions/services.py +++ b/volatility3/framework/symbols/windows/extensions/services.py @@ -2,10 +2,10 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import objects, interfaces -from volatility.framework import exceptions -from volatility.framework.symbols.wrappers import Flags -from volatility.framework import renderers +from volatility3.framework import objects, interfaces +from volatility3.framework import exceptions +from volatility3.framework.symbols.wrappers import Flags +from volatility3.framework import renderers from typing import Union diff --git a/volatility/framework/symbols/windows/kdbg.json b/volatility3/framework/symbols/windows/kdbg.json similarity index 100% rename from volatility/framework/symbols/windows/kdbg.json rename to volatility3/framework/symbols/windows/kdbg.json diff --git a/volatility/framework/symbols/windows/netscan-vista-sp12-x64.json b/volatility3/framework/symbols/windows/netscan-vista-sp12-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-vista-sp12-x64.json rename to volatility3/framework/symbols/windows/netscan-vista-sp12-x64.json diff --git a/volatility/framework/symbols/windows/netscan-vista-x64.json b/volatility3/framework/symbols/windows/netscan-vista-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-vista-x64.json rename to volatility3/framework/symbols/windows/netscan-vista-x64.json diff --git a/volatility/framework/symbols/windows/netscan-vista-x86.json b/volatility3/framework/symbols/windows/netscan-vista-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-vista-x86.json rename to volatility3/framework/symbols/windows/netscan-vista-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win10-14393-x86.json b/volatility3/framework/symbols/windows/netscan-win10-14393-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-14393-x86.json rename to volatility3/framework/symbols/windows/netscan-win10-14393-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win10-15063-x64.json b/volatility3/framework/symbols/windows/netscan-win10-15063-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-15063-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-15063-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-15063-x86.json b/volatility3/framework/symbols/windows/netscan-win10-15063-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-15063-x86.json rename to volatility3/framework/symbols/windows/netscan-win10-15063-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win10-16299-x64.json b/volatility3/framework/symbols/windows/netscan-win10-16299-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-16299-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-16299-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-17134-x64.json b/volatility3/framework/symbols/windows/netscan-win10-17134-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-17134-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-17134-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-17134-x86.json b/volatility3/framework/symbols/windows/netscan-win10-17134-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-17134-x86.json rename to volatility3/framework/symbols/windows/netscan-win10-17134-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win10-17763-x64.json b/volatility3/framework/symbols/windows/netscan-win10-17763-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-17763-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-17763-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-18363-x64.json b/volatility3/framework/symbols/windows/netscan-win10-18363-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-18363-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-18363-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-19041-x64.json b/volatility3/framework/symbols/windows/netscan-win10-19041-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-19041-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-19041-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-19041-x86.json b/volatility3/framework/symbols/windows/netscan-win10-19041-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-19041-x86.json rename to volatility3/framework/symbols/windows/netscan-win10-19041-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win10-x64.json b/volatility3/framework/symbols/windows/netscan-win10-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-x86.json b/volatility3/framework/symbols/windows/netscan-win10-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-x86.json rename to volatility3/framework/symbols/windows/netscan-win10-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win7-x64.json b/volatility3/framework/symbols/windows/netscan-win7-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win7-x64.json rename to volatility3/framework/symbols/windows/netscan-win7-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win7-x86.json b/volatility3/framework/symbols/windows/netscan-win7-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win7-x86.json rename to volatility3/framework/symbols/windows/netscan-win7-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win8-x64.json b/volatility3/framework/symbols/windows/netscan-win8-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win8-x64.json rename to volatility3/framework/symbols/windows/netscan-win8-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win8-x86.json b/volatility3/framework/symbols/windows/netscan-win8-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win8-x86.json rename to volatility3/framework/symbols/windows/netscan-win8-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win81-x64.json b/volatility3/framework/symbols/windows/netscan-win81-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win81-x64.json rename to volatility3/framework/symbols/windows/netscan-win81-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win81-x86.json b/volatility3/framework/symbols/windows/netscan-win81-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win81-x86.json rename to volatility3/framework/symbols/windows/netscan-win81-x86.json diff --git a/volatility/framework/symbols/windows/pdb.json b/volatility3/framework/symbols/windows/pdb.json similarity index 100% rename from volatility/framework/symbols/windows/pdb.json rename to volatility3/framework/symbols/windows/pdb.json diff --git a/volatility/framework/symbols/windows/pdbconv.py b/volatility3/framework/symbols/windows/pdbconv.py similarity index 99% rename from volatility/framework/symbols/windows/pdbconv.py rename to volatility3/framework/symbols/windows/pdbconv.py index d2dbcfc50..5116b8f78 100644 --- a/volatility/framework/symbols/windows/pdbconv.py +++ b/volatility3/framework/symbols/windows/pdbconv.py @@ -10,8 +10,8 @@ from bisect import bisect from typing import Tuple, Dict, Any, Optional, Union, List from urllib import request, error -from volatility.framework import contexts, interfaces, constants -from volatility.framework.layers import physical, msf, resources +from volatility3.framework import contexts, interfaces, constants +from volatility3.framework.layers import physical, msf, resources vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py similarity index 96% rename from volatility/framework/symbols/windows/pdbutil.py rename to volatility3/framework/symbols/windows/pdbutil.py index 7e1558304..653c953b1 100644 --- a/volatility/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -11,11 +11,11 @@ import struct from typing import Any, Dict, Generator, List, Optional, Tuple, Union from urllib import request -from volatility import symbols -from volatility.framework import constants, interfaces -from volatility.framework.configuration.requirements import SymbolTableRequirement -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import pdbconv +from volatility3 import symbols +from volatility3.framework import constants, interfaces +from volatility3.framework.configuration.requirements import SymbolTableRequirement +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import pdbconv vollog = logging.getLogger(__name__) @@ -29,7 +29,7 @@ class PDBUtility: context: interfaces.context.ContextInterface, layer_name: str, offset: int, - symbol_table_class: str = "volatility.framework.symbols.intermed.IntermediateSymbolTable", + symbol_table_class: str = "volatility3.framework.symbols.intermed.IntermediateSymbolTable", config_path: str = None, progress_callback: constants.ProgressCallback = None) -> Optional[str]: """Produces the name of a symbol table loaded from the offset for an MZ header @@ -274,7 +274,7 @@ class PDBUtility: class PdbSignatureScanner(interfaces.layers.ScannerInterface): - """A :class:`~volatility.framework.interfaces.layers.ScannerInterface` + """A :class:`~volatility3.framework.interfaces.layers.ScannerInterface` based scanner use to identify Windows PDB records. Args: diff --git a/volatility/framework/symbols/windows/pe.json b/volatility3/framework/symbols/windows/pe.json similarity index 100% rename from volatility/framework/symbols/windows/pe.json rename to volatility3/framework/symbols/windows/pe.json diff --git a/volatility/framework/symbols/windows/poolheader-x64-win7.json b/volatility3/framework/symbols/windows/poolheader-x64-win7.json similarity index 100% rename from volatility/framework/symbols/windows/poolheader-x64-win7.json rename to volatility3/framework/symbols/windows/poolheader-x64-win7.json diff --git a/volatility/framework/symbols/windows/poolheader-x64.json b/volatility3/framework/symbols/windows/poolheader-x64.json similarity index 100% rename from volatility/framework/symbols/windows/poolheader-x64.json rename to volatility3/framework/symbols/windows/poolheader-x64.json diff --git a/volatility/framework/symbols/windows/poolheader-x86.json b/volatility3/framework/symbols/windows/poolheader-x86.json similarity index 100% rename from volatility/framework/symbols/windows/poolheader-x86.json rename to volatility3/framework/symbols/windows/poolheader-x86.json diff --git a/volatility/framework/symbols/windows/registry.json b/volatility3/framework/symbols/windows/registry.json similarity index 100% rename from volatility/framework/symbols/windows/registry.json rename to volatility3/framework/symbols/windows/registry.json diff --git a/volatility/framework/symbols/windows/services-vista-x64.json b/volatility3/framework/symbols/windows/services-vista-x64.json similarity index 100% rename from volatility/framework/symbols/windows/services-vista-x64.json rename to volatility3/framework/symbols/windows/services-vista-x64.json diff --git a/volatility/framework/symbols/windows/services-vista-x86.json b/volatility3/framework/symbols/windows/services-vista-x86.json similarity index 100% rename from volatility/framework/symbols/windows/services-vista-x86.json rename to volatility3/framework/symbols/windows/services-vista-x86.json diff --git a/volatility/framework/symbols/windows/services-win10-15063-x64.json b/volatility3/framework/symbols/windows/services-win10-15063-x64.json similarity index 100% rename from volatility/framework/symbols/windows/services-win10-15063-x64.json rename to volatility3/framework/symbols/windows/services-win10-15063-x64.json diff --git a/volatility/framework/symbols/windows/services-win10-15063-x86.json b/volatility3/framework/symbols/windows/services-win10-15063-x86.json similarity index 100% rename from volatility/framework/symbols/windows/services-win10-15063-x86.json rename to volatility3/framework/symbols/windows/services-win10-15063-x86.json diff --git a/volatility/framework/symbols/windows/services-win10-16299-x64.json b/volatility3/framework/symbols/windows/services-win10-16299-x64.json similarity index 100% rename from volatility/framework/symbols/windows/services-win10-16299-x64.json rename to volatility3/framework/symbols/windows/services-win10-16299-x64.json diff --git a/volatility/framework/symbols/windows/services-win10-16299-x86.json b/volatility3/framework/symbols/windows/services-win10-16299-x86.json similarity index 100% rename from volatility/framework/symbols/windows/services-win10-16299-x86.json rename to volatility3/framework/symbols/windows/services-win10-16299-x86.json diff --git a/volatility/framework/symbols/windows/services-win8-x64.json b/volatility3/framework/symbols/windows/services-win8-x64.json similarity index 100% rename from volatility/framework/symbols/windows/services-win8-x64.json rename to volatility3/framework/symbols/windows/services-win8-x64.json diff --git a/volatility/framework/symbols/windows/services-win8-x86.json b/volatility3/framework/symbols/windows/services-win8-x86.json similarity index 100% rename from volatility/framework/symbols/windows/services-win8-x86.json rename to volatility3/framework/symbols/windows/services-win8-x86.json diff --git a/volatility/framework/symbols/windows/services-xp-2003-x64.json b/volatility3/framework/symbols/windows/services-xp-2003-x64.json similarity index 100% rename from volatility/framework/symbols/windows/services-xp-2003-x64.json rename to volatility3/framework/symbols/windows/services-xp-2003-x64.json diff --git a/volatility/framework/symbols/windows/services-xp-x86.json b/volatility3/framework/symbols/windows/services-xp-x86.json similarity index 100% rename from volatility/framework/symbols/windows/services-xp-x86.json rename to volatility3/framework/symbols/windows/services-xp-x86.json diff --git a/volatility/framework/symbols/windows/versions.py b/volatility3/framework/symbols/windows/versions.py similarity index 98% rename from volatility/framework/symbols/windows/versions.py rename to volatility3/framework/symbols/windows/versions.py index 3a7e84b5b..d38cdb701 100644 --- a/volatility/framework/symbols/windows/versions.py +++ b/volatility3/framework/symbols/windows/versions.py @@ -1,7 +1,7 @@ import logging from typing import Callable, Tuple, List, Optional -from volatility.framework import interfaces, constants, exceptions +from volatility3.framework import interfaces, constants, exceptions vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/wrappers.py b/volatility3/framework/symbols/wrappers.py similarity index 94% rename from volatility/framework/symbols/wrappers.py rename to volatility3/framework/symbols/wrappers.py index 307da4ec9..8cf51df23 100644 --- a/volatility/framework/symbols/wrappers.py +++ b/volatility3/framework/symbols/wrappers.py @@ -4,7 +4,7 @@ from typing import List, Mapping -from volatility.framework import interfaces +from volatility3.framework import interfaces class Flags: diff --git a/volatility/plugins/__init__.py b/volatility3/plugins/__init__.py similarity index 94% rename from volatility/plugins/__init__.py rename to volatility3/plugins/__init__.py index 8ecd9c946..6afa8baf4 100644 --- a/volatility/plugins/__init__.py +++ b/volatility3/plugins/__init__.py @@ -12,6 +12,6 @@ are dependent upon, please DO NOT alter or remove this file unless you know the The framework is configured this way to allow plugin developers/users to override any plugin functionality whether existing or new. """ -from volatility.framework import constants +from volatility3.framework import constants __path__ = constants.PLUGINS_PATH diff --git a/volatility/plugins/linux/__init__.py b/volatility3/plugins/linux/__init__.py similarity index 100% rename from volatility/plugins/linux/__init__.py rename to volatility3/plugins/linux/__init__.py diff --git a/volatility/plugins/mac/__init__.py b/volatility3/plugins/mac/__init__.py similarity index 100% rename from volatility/plugins/mac/__init__.py rename to volatility3/plugins/mac/__init__.py diff --git a/volatility/plugins/windows/__init__.py b/volatility3/plugins/windows/__init__.py similarity index 100% rename from volatility/plugins/windows/__init__.py rename to volatility3/plugins/windows/__init__.py diff --git a/volatility/plugins/windows/registry/__init__.py b/volatility3/plugins/windows/registry/__init__.py similarity index 100% rename from volatility/plugins/windows/registry/__init__.py rename to volatility3/plugins/windows/registry/__init__.py diff --git a/volatility/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py similarity index 92% rename from volatility/plugins/windows/registry/certificates.py rename to volatility3/plugins/windows/registry/certificates.py index 8fd574670..909e852fb 100644 --- a/volatility/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -1,16 +1,16 @@ import struct from typing import List, Iterator, Tuple -from volatility.framework import interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.symbols.windows.extensions.registry import RegValueTypes -from volatility.plugins.windows.registry import hivelist, printkey +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes +from volatility3.plugins.windows.registry import hivelist, printkey class Certificates(interfaces.plugins.PluginInterface): """Lists the certificates in the registry's Certificate Store.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/plugins/windows/statistics.py b/volatility3/plugins/windows/statistics.py similarity index 92% rename from volatility/plugins/windows/statistics.py rename to volatility3/plugins/windows/statistics.py index 2e637bf6f..b3bc8044f 100644 --- a/volatility/plugins/windows/statistics.py +++ b/volatility3/plugins/windows/statistics.py @@ -4,16 +4,16 @@ import logging from typing import List -from volatility.framework import renderers, exceptions, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.layers import intel +from volatility3.framework import renderers, exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.layers import intel vollog = logging.getLogger(__name__) class Statistics(plugins.PluginInterface): - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/schemas/__init__.py b/volatility3/schemas/__init__.py similarity index 98% rename from volatility/schemas/__init__.py rename to volatility3/schemas/__init__.py index 40bc235f4..ea7f0579d 100644 --- a/volatility/schemas/__init__.py +++ b/volatility3/schemas/__init__.py @@ -8,7 +8,7 @@ import logging import os from typing import Set, Any, Dict -from volatility.framework import constants +from volatility3.framework import constants vollog = logging.getLogger(__name__) diff --git a/volatility/schemas/schema-0.1.0.json b/volatility3/schemas/schema-0.1.0.json similarity index 100% rename from volatility/schemas/schema-0.1.0.json rename to volatility3/schemas/schema-0.1.0.json diff --git a/volatility/schemas/schema-2.0.0.json b/volatility3/schemas/schema-2.0.0.json similarity index 100% rename from volatility/schemas/schema-2.0.0.json rename to volatility3/schemas/schema-2.0.0.json diff --git a/volatility/schemas/schema-2.1.0.json b/volatility3/schemas/schema-2.1.0.json similarity index 100% rename from volatility/schemas/schema-2.1.0.json rename to volatility3/schemas/schema-2.1.0.json diff --git a/volatility/schemas/schema-4.0.0.json b/volatility3/schemas/schema-4.0.0.json similarity index 100% rename from volatility/schemas/schema-4.0.0.json rename to volatility3/schemas/schema-4.0.0.json diff --git a/volatility/schemas/schema-4.1.0.json b/volatility3/schemas/schema-4.1.0.json similarity index 100% rename from volatility/schemas/schema-4.1.0.json rename to volatility3/schemas/schema-4.1.0.json diff --git a/volatility/schemas/schema-6.0.0.json b/volatility3/schemas/schema-6.0.0.json similarity index 100% rename from volatility/schemas/schema-6.0.0.json rename to volatility3/schemas/schema-6.0.0.json diff --git a/volatility/schemas/schema-6.1.0.json b/volatility3/schemas/schema-6.1.0.json similarity index 100% rename from volatility/schemas/schema-6.1.0.json rename to volatility3/schemas/schema-6.1.0.json diff --git a/volatility/schemas/schema-6.2.0.json b/volatility3/schemas/schema-6.2.0.json similarity index 100% rename from volatility/schemas/schema-6.2.0.json rename to volatility3/schemas/schema-6.2.0.json diff --git a/volatility/symbols/__init__.py b/volatility3/symbols/__init__.py similarity index 89% rename from volatility/symbols/__init__.py rename to volatility3/symbols/__init__.py index e656d0649..c35f07cbe 100644 --- a/volatility/symbols/__init__.py +++ b/volatility3/symbols/__init__.py @@ -6,6 +6,6 @@ This is the namespace for all volatility symbols, and determines the path for loading symbol ISF files """ -from volatility.framework import constants +from volatility3.framework import constants __path__ = constants.SYMBOL_BASEPATHS diff --git a/volshell.py b/volshell.py index 4de304daf..590994324 100644 --- a/volshell.py +++ b/volshell.py @@ -4,7 +4,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.cli import volshell +from volatility3.cli import volshell if __name__ == '__main__': volshell.main() diff --git a/volshell.spec b/volshell.spec index 832332c23..6654772ca 100644 --- a/volshell.spec +++ b/volshell.spec @@ -31,16 +31,16 @@ sys.path.append(os.getcwd()) vol_analysis = Analysis(['volshell.py'], pathex = [], binaries = binaries, - datas = collect_data_files('volatility.framework') + \ - collect_data_files('volatility.framework.automagic', include_py_files = True) + \ - collect_data_files('volatility.framework.plugins', include_py_files = True) + \ - collect_data_files('volatility.framework.layers', include_py_files = True) + \ - collect_data_files('volatility.cli', include_py_files = True) + \ - collect_data_files('volatility.schemas') + \ - collect_data_files('volatility.plugins', include_py_files = True), - hiddenimports = collect_submodules('volatility.framework.automagic') + \ - collect_submodules('volatility.framework.plugins') + \ - collect_submodules('volatility.framework.symbols'), + datas = collect_data_files('volatility3.framework') + \ + collect_data_files('volatility3.framework.automagic', include_py_files = True) + \ + collect_data_files('volatility3.framework.plugins', include_py_files = True) + \ + collect_data_files('volatility3.framework.layers', include_py_files = True) + \ + collect_data_files('volatility3.cli', include_py_files = True) + \ + collect_data_files('volatility3.schemas') + \ + collect_data_files('volatility3.plugins', include_py_files = True), + hiddenimports = collect_submodules('volatility3.framework.automagic') + \ + collect_submodules('volatility3.framework.plugins') + \ + collect_submodules('volatility3.framework.symbols'), hookspath = [], runtime_hooks = [], excludes = [],