From f9102a60b801c26899e966c6a65d34e18d47ba05 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 10 Dec 2020 22:42:16 +0000 Subject: [PATCH 01/28] Release: Update the version number for this release Entering code-freeze 10th Dec - Bug fixes and documentation, no new features 7th Jan - Only critical fixes 21st Jan - Release date --- volatility/framework/constants/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/constants/__init__.py b/volatility/framework/constants/__init__.py index b39fc2b7a..cc1cf3eec 100644 --- a/volatility/framework/constants/__init__.py +++ b/volatility/framework/constants/__init__.py @@ -41,7 +41,7 @@ BANG = "!" VERSION_MAJOR = 2 # Number of releases of the library with a breaking change VERSION_MINOR = 0 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface -VERSION_SUFFIX = "-beta.1" +VERSION_SUFFIX = "" PACKAGE_VERSION = ".".join([str(x) for x in [VERSION_MAJOR, VERSION_MINOR, VERSION_PATCH]]) + VERSION_SUFFIX """The canonical version of the volatility package""" From 1abc65c2ac45cb605aafed367629d01048b54779 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 11 Dec 2020 16:03:44 +0000 Subject: [PATCH 02/28] CLI: Fix inaccurate documentation --- volatility/cli/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index 04af5b0de..3e680aa26 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -107,7 +107,7 @@ class CommandLine: default = None, type = str) parser.add_argument("--parallelism", - help = "Enables parallelism (defaults to processes if no argument given)", + help = "Enables parallelism (defaults to off if no argument given)", nargs = '?', choices = ['processes', 'threads', 'off'], const = 'processes', From c45b1b3423fff9376346025f13e1539418d55f28 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 21 Dec 2020 15:52:40 +0000 Subject: [PATCH 03/28] Automagic: Windows DTB finder was too limited The DTB finder test returns a full DTB, if that's over the scan chunk size it'll get discarded, so we remove that test. --- volatility/framework/automagic/windows.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/volatility/framework/automagic/windows.py b/volatility/framework/automagic/windows.py index 3f33f1c58..d55ff8c23 100644 --- a/volatility/framework/automagic/windows.py +++ b/volatility/framework/automagic/windows.py @@ -225,8 +225,7 @@ class PageMapScanner(interfaces.layers.ScannerInterface): for page_offset in range(0, len(data), 0x1000): result = test(data, data_offset, page_offset) if result is not None: - if result[0] < self.chunk_size: - yield (test, result[0]) + yield (test, result[0]) class WintelHelper(interfaces.automagic.AutomagicInterface): From ccef55e44893aded13250f346524c08edf4c788a Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 21 Dec 2020 15:57:18 +0000 Subject: [PATCH 04/28] Linux: Use native_layer when constructing from a pointer offset --- volatility/framework/symbols/mac/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility/framework/symbols/mac/extensions/__init__.py index 787e7b56d..e433318ae 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility/framework/symbols/mac/extensions/__init__.py @@ -270,7 +270,7 @@ class vm_map_entry(objects.StructType): if found: vpager = context.object(config_prefix + constants.BANG + "vnode_pager", - layer_name = vnode_object.vol.layer_name, + layer_name = vnode_object.vol.native_layer_name, offset = vnode_object.pager) ret = vpager.vnode_handle else: From f262821924dc634f5a04397ca01be895041d2fef Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 21 Dec 2020 17:07:51 +0000 Subject: [PATCH 05/28] Documentation: minor bugfix --- doc/source/conf.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/source/conf.py b/doc/source/conf.py index 2fa2c1b5b..bef818295 100644 --- a/doc/source/conf.py +++ b/doc/source/conf.py @@ -75,7 +75,7 @@ def setup(app): break else: line_index = len(real_lines) - submodule_lines = real_lines[line_index:] + submodule_lines = [b"\n"] + real_lines[line_index:] plugins_seen = False with open(os.path.join(dir, filename), "wb") as contents: From feefc93adc83a13afa656cb53c2913afe986ea90 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 11 Dec 2020 16:03:44 +0000 Subject: [PATCH 06/28] CLI: Fix inaccurate documentation --- volatility/cli/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index 04af5b0de..3e680aa26 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -107,7 +107,7 @@ class CommandLine: default = None, type = str) parser.add_argument("--parallelism", - help = "Enables parallelism (defaults to processes if no argument given)", + help = "Enables parallelism (defaults to off if no argument given)", nargs = '?', choices = ['processes', 'threads', 'off'], const = 'processes', From 1c2a9921ff9d336368c6d92afd3656c6b4bcbe3e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 27 Dec 2020 15:21:06 +0000 Subject: [PATCH 07/28] Windows: Partial fix for #368 error messages --- volatility/framework/plugins/windows/handles.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index 25914842d..d09536868 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -87,11 +87,11 @@ class Handles(interfaces.plugins.PluginInterface): # is this the right thing to raise here? if magic is None: - if not has_capstone: + if has_capstone: raise AttributeError("Unable to find the SAR value for decoding handle table pointers") else: raise exceptions.MissingModuleException( - "capstone", "Unable to find the SAR value for decoding handle table pointers") + "capstone", "Requires capstone to find the SAR value for decoding handle table pointers") offset = self._decode_pointer(handle_table_entry.LowValue, magic) # print("LowValue: {0:#x} Magic: {1:#x} Offset: {2:#x}".format(handle_table_entry.InfoTable, magic, offset)) From d1b10781d41023e8daad256999949dac61b237e1 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 30 Dec 2020 18:06:37 +0000 Subject: [PATCH 08/28] CLI: Parse windows file as files not URIs Fixes #408 --- volatility/cli/__init__.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index 3e680aa26..0c038a322 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -436,7 +436,8 @@ class CommandLine: if value is not None: if isinstance(requirement, requirements.URIRequirement): if isinstance(value, str): - if not parse.urlparse(value).scheme: + scheme = parse.urlparse(value).scheme + if not scheme or len(scheme) <= 1: if not os.path.exists(value): raise FileNotFoundError( "Non-existant file {} passed to URIRequirement".format(value)) From f75e77997d123ec0fa5ef1f05726a3323889138f Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 3 Jan 2021 10:38:49 +0000 Subject: [PATCH 09/28] Layerwriter: Remove erroneous debugging statements --- volatility/framework/plugins/layerwriter.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/volatility/framework/plugins/layerwriter.py b/volatility/framework/plugins/layerwriter.py index 1bd6b0a7c..571079f6f 100644 --- a/volatility/framework/plugins/layerwriter.py +++ b/volatility/framework/plugins/layerwriter.py @@ -82,8 +82,6 @@ class LayerWriter(plugins.PluginInterface): for name in self.context.layers: yield 0, (name, ) else: - import pdb - pdb.set_trace() # Choose the most recently added layer that isn't virtual if self.config['layers'] is None: self.config['layers'] = [] From 2c3b6668d5d9269ab0bc8c065bf3d3e8643bfa71 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Wed, 6 Jan 2021 10:10:51 -0600 Subject: [PATCH 10/28] refs #368 fix handles on 32-bit windows 8 and 10 - finding SAR is not necessary on these versions --- .../framework/plugins/windows/handles.py | 33 ++++++++++++------- 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index d09536868..5f697bc23 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -5,7 +5,7 @@ import logging from typing import List, Optional, Dict -from volatility.framework import constants, exceptions, renderers, interfaces +from volatility.framework import constants, exceptions, renderers, interfaces, symbols from volatility.framework.configuration import requirements from volatility.framework.objects import utility from volatility.framework.renderers import format_hints @@ -80,20 +80,29 @@ class Handles(interfaces.plugins.PluginInterface): object_header.GrantedAccess = handle_table_entry.GrantedAccess except AttributeError: # starting with windows 8 - if handle_table_entry.LowValue == 0: - return None + is_64bit = symbols.symbol_table_is_64bit(self.context, self.config["nt_symbols"]) - magic = self.find_sar_value() + if is_64bit: + if handle_table_entry.LowValue == 0: + return None - # is this the right thing to raise here? - if magic is None: - if has_capstone: - raise AttributeError("Unable to find the SAR value for decoding handle table pointers") - else: - raise exceptions.MissingModuleException( - "capstone", "Requires capstone to find the SAR value for decoding handle table pointers") + magic = self.find_sar_value() + + # is this the right thing to raise here? + if magic is None: + if has_capstone: + raise AttributeError("Unable to find the SAR value for decoding handle table pointers") + else: + raise exceptions.MissingModuleException( + "capstone", "Requires capstone to find the SAR value for decoding handle table pointers") + + offset = self._decode_pointer(handle_table_entry.LowValue, magic) + else: + if handle_table_entry.InfoTable == 0: + return None + + offset = handle_table_entry.InfoTable & ~7 - offset = self._decode_pointer(handle_table_entry.LowValue, magic) # print("LowValue: {0:#x} Magic: {1:#x} Offset: {2:#x}".format(handle_table_entry.InfoTable, magic, offset)) object_header = self.context.object(self.config["nt_symbols"] + constants.BANG + "_OBJECT_HEADER", virtual, From 53397117ef5c049df7f5a3fb1e8e01c6cc781a28 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Wed, 6 Jan 2021 10:30:01 -0600 Subject: [PATCH 11/28] remove unnecessary and unused imports from the windows extensions init file --- volatility/framework/symbols/windows/extensions/__init__.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 9352b04d3..dd7684de4 100755 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -6,9 +6,8 @@ import collections.abc import datetime import functools import logging -import struct import math -from typing import Iterable, Iterator, Optional, Union, Dict, Tuple, List +from typing import Iterable, Iterator, Optional, Union, Tuple, List from volatility.framework import constants, exceptions, interfaces, objects, renderers, symbols from volatility.framework.layers import intel From d7d176d04010ec2f1caebdcd473c644d8ed87792 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Wed, 6 Jan 2021 11:36:56 -0600 Subject: [PATCH 12/28] add Is64Bit and IsPAE properties to the windows.info plugin --- volatility/framework/plugins/windows/info.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility/framework/plugins/windows/info.py b/volatility/framework/plugins/windows/info.py index 90ede538a..8a40f305a 100644 --- a/volatility/framework/plugins/windows/info.py +++ b/volatility/framework/plugins/windows/info.py @@ -5,7 +5,7 @@ import time from typing import List, Tuple, Iterable -from volatility.framework import constants, interfaces, layers +from volatility.framework import constants, interfaces, layers, symbols from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins from volatility.framework.renderers import TreeGrid @@ -158,6 +158,8 @@ class Info(plugins.PluginInterface): yield (0, ("Kernel Base", hex(self.config["primary.kernel_virtual_offset"]))) yield (0, ("DTB", hex(self.config["primary.page_map_offset"]))) yield (0, ("Symbols", self.config["nt_symbols.isf_url"])) + yield (0, ("Is64Bit", str(symbols.symbol_table_is_64bit(self.context, symbol_table)))) + yield (0, ("IsPAE", str(self.context.layers[layer_name].metadata.get("pae", False)))) for i, layer in self.get_depends(self.context, "primary"): yield (0, (layer.name, "{} {}".format(i, layer.__class__.__name__))) From e1032623fed1268875089180d02c9261628e934a Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 6 Jan 2021 19:28:24 +0000 Subject: [PATCH 13/28] Layers: Ensure intel PAE reports pae in the metadata --- volatility/framework/layers/intel.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py index cc5aa98aa..86bf26de7 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility/framework/layers/intel.py @@ -247,6 +247,7 @@ class IntelPAE(Intel): _maxphyaddr = 40 _maxvirtaddr = 32 _structure = [('page directory pointer', 2, False), ('page directory', 9, True), ('page table', 9, True)] + _direct_metadata = collections.ChainMap({'pae', True}, Intel._direct_metadata) class Intel32e(Intel): From de2f464a71fef4d196001d60c3d2bad9a2ab88fd Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 8 Jan 2021 01:14:31 +0000 Subject: [PATCH 14/28] Documentation: Fix up the surjective line This makes #389 obsolete. --- doc/source/complex-plugin.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/source/complex-plugin.rst b/doc/source/complex-plugin.rst index 81a3fdc00..e7852aaf5 100644 --- a/doc/source/complex-plugin.rst +++ b/doc/source/complex-plugin.rst @@ -182,8 +182,8 @@ of data. Each chunk contains the following information, in order: An example (and the most common layer encountered in memory forensics) would be an Intel layer, which models the intel page mapping system. Based on a series of tables stored within the layer itself, an intel layer can convert a virtual -address to a physical address. It should be noted that intel layers are surjective in that a single virtual address can -map to multiple physical addresses, but a single virtual address can only ever map to a single physical address. +address to a physical address. It should be noted that intel layers allow multiple virtual addresses to map to the +same physical address (but a single virtual address cannot ever map to more than one physical address). As a simple example, in a virtual layer which looks like `abracadabra` but maps to a physical layer that looks like `abcdr`, requesting `mapping(5, 4)` would return: From 53169b15ab9d47b8ac97bb48f3e9821431505dd7 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 8 Jan 2021 17:40:52 +0000 Subject: [PATCH 15/28] Intel: Fix PAE typo --- volatility/framework/layers/intel.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py index 86bf26de7..cdff9ce7e 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility/framework/layers/intel.py @@ -247,7 +247,7 @@ class IntelPAE(Intel): _maxphyaddr = 40 _maxvirtaddr = 32 _structure = [('page directory pointer', 2, False), ('page directory', 9, True), ('page table', 9, True)] - _direct_metadata = collections.ChainMap({'pae', True}, Intel._direct_metadata) + _direct_metadata = collections.ChainMap({'pae': True}, Intel._direct_metadata) class Intel32e(Intel): From 89a3d441ff58e9fa5c5cb9ffb157edb851a666cf Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 13 Jan 2021 00:54:50 +0000 Subject: [PATCH 16/28] Layerwriter: Ensure we autochoose by default --- volatility/framework/plugins/layerwriter.py | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/volatility/framework/plugins/layerwriter.py b/volatility/framework/plugins/layerwriter.py index 571079f6f..5b4492c6c 100644 --- a/volatility/framework/plugins/layerwriter.py +++ b/volatility/framework/plugins/layerwriter.py @@ -34,11 +34,12 @@ class LayerWriter(plugins.PluginInterface): description = 'List available layers', default = False, optional = True), - requirements.ListRequirement(name = 'layers', - element_type = str, - description = 'Names of layer to write', - default = None, - optional = True) + requirements.ListRequirement( + name = 'layers', + element_type = str, + description = 'Names of layers to write (defaults to the highest non-mapped layer)', + default = None, + optional = True) ] @classmethod @@ -83,7 +84,7 @@ class LayerWriter(plugins.PluginInterface): yield 0, (name, ) else: # Choose the most recently added layer that isn't virtual - if self.config['layers'] is None: + if not self.config['layers']: self.config['layers'] = [] for name in self.context.layers: if not self.context.layers[name].metadata.get('mapped', False): From b61185c6b039eb62931655114ffa0839a5437ebe Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Wed, 13 Jan 2021 21:23:12 -0600 Subject: [PATCH 17/28] refs #409 VACB does not expose is_valid() - do the validity check inline --- volatility/framework/symbols/windows/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index dd7684de4..b320566aa 100755 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -1051,7 +1051,7 @@ class SHARED_CACHE_MAP(objects.StructType): continue vacb_obj = vacb_array[counter].dereference().cast(symbol_table_name + constants.BANG + "_VACB") - if vacb_obj.is_valid(shared_cache_map = self): + if vacb_obj.SharedCacheMap == self.vol.offset: self.save_vacb(vacb_obj, vacb_list) else: # Process the next level of the multi-level array From 3911098d2711ef299f6f53d994fa93fc428fafcc Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 20 Jan 2021 21:21:16 +0000 Subject: [PATCH 18/28] Core: Rename the top level namespace --- .gitignore | 8 ++-- development/schema_validate.py | 2 +- doc/source/conf.py | 24 +++++----- setup.py | 8 ++-- vol.py | 4 +- vol.spec | 38 +++++++-------- {volatility => volatility3}/__init__.py | 18 ++++---- {volatility => volatility3}/cli/__init__.py | 46 +++++++++---------- .../cli/text_renderer.py | 4 +- .../cli/volargparse.py | 0 .../cli/volshell/__init__.py | 24 +++++----- .../cli/volshell/generic.py | 8 ++-- .../cli/volshell/linux.py | 8 ++-- .../cli/volshell/mac.py | 8 ++-- .../cli/volshell/windows.py | 8 ++-- .../framework/__init__.py | 6 +-- .../framework/automagic/__init__.py | 12 ++--- .../framework/automagic/construct_layers.py | 14 +++--- .../framework/automagic/linux.py | 10 ++-- .../framework/automagic/mac.py | 10 ++-- .../framework/automagic/pdbscan.py | 18 ++++---- .../framework/automagic/stacker.py | 20 ++++---- .../framework/automagic/symbol_cache.py | 4 +- .../framework/automagic/symbol_finder.py | 8 ++-- .../framework/automagic/windows.py | 10 ++-- .../framework/configuration/__init__.py | 2 +- .../framework/configuration/requirements.py | 2 +- .../framework/constants/__init__.py | 10 ++-- .../framework/constants/linux/__init__.py | 0 .../framework/constants/windows/__init__.py | 0 .../framework/contexts/__init__.py | 8 ++-- .../framework/exceptions.py | 2 +- .../framework/interfaces/__init__.py | 2 +- .../framework/interfaces/automagic.py | 4 +- .../framework/interfaces/configuration.py | 12 ++--- .../framework/interfaces/context.py | 4 +- .../framework/interfaces/layers.py | 2 +- .../framework/interfaces/objects.py | 4 +- .../framework/interfaces/plugins.py | 4 +- .../framework/interfaces/renderers.py | 0 .../framework/interfaces/symbols.py | 8 ++-- .../framework/layers/__init__.py | 0 .../framework/layers/codecs/__init__.py | 0 .../framework/layers/crash.py | 6 +-- .../framework/layers/elf.py | 6 +-- .../framework/layers/intel.py | 8 ++-- .../framework/layers/lime.py | 4 +- .../framework/layers/linear.py | 2 +- .../framework/layers/msf.py | 10 ++-- .../framework/layers/physical.py | 6 +-- .../framework/layers/qemu.py | 6 +-- .../framework/layers/registry.py | 14 +++--- .../framework/layers/resources.py | 4 +- .../framework/layers/scanners/__init__.py | 4 +- .../framework/layers/scanners/multiregexp.py | 0 .../framework/layers/segmented.py | 6 +-- .../framework/layers/vmware.py | 8 ++-- .../framework/objects/__init__.py | 4 +- .../framework/objects/templates.py | 10 ++-- .../framework/objects/utility.py | 2 +- .../framework/plugins/__init__.py | 6 +-- .../framework/plugins/banners.py | 8 ++-- .../framework/plugins/configwriter.py | 6 +-- .../framework/plugins/frameworkinfo.py | 6 +-- .../framework/plugins/isfinfo.py | 12 ++--- .../framework/plugins/layerwriter.py | 6 +-- .../framework/plugins/linux/__init__.py | 4 +- .../framework/plugins/linux/bash.py | 16 +++---- .../framework/plugins/linux/check_afinfo.py | 10 ++-- .../framework/plugins/linux/check_creds.py | 6 +-- .../framework/plugins/linux/check_idt.py | 10 ++-- .../framework/plugins/linux/check_modules.py | 12 ++--- .../framework/plugins/linux/check_syscall.py | 10 ++-- .../framework/plugins/linux/elfs.py | 12 ++--- .../plugins/linux/keyboard_notifiers.py | 10 ++-- .../framework/plugins/linux/lsmod.py | 12 ++--- .../framework/plugins/linux/lsof.py | 12 ++--- .../framework/plugins/linux/malfind.py | 12 ++--- .../framework/plugins/linux/proc.py | 12 ++--- .../framework/plugins/linux/pslist.py | 6 +-- .../framework/plugins/linux/pstree.py | 4 +- .../framework/plugins/linux/tty_check.py | 14 +++--- .../framework/plugins/mac/__init__.py | 0 .../framework/plugins/mac/bash.py | 16 +++---- .../framework/plugins/mac/check_syscall.py | 14 +++--- .../framework/plugins/mac/check_sysctl.py | 20 ++++---- .../framework/plugins/mac/check_trap_table.py | 14 +++--- .../framework/plugins/mac/ifconfig.py | 10 ++-- .../framework/plugins/mac/kauth_listeners.py | 12 ++--- .../framework/plugins/mac/kauth_scopes.py | 12 ++--- .../framework/plugins/mac/kevents.py | 10 ++-- .../framework/plugins/mac/list_files.py | 14 +++--- .../framework/plugins/mac/lsmod.py | 10 ++-- .../framework/plugins/mac/lsof.py | 10 ++-- .../framework/plugins/mac/malfind.py | 14 +++--- .../framework/plugins/mac/mount.py | 10 ++-- .../framework/plugins/mac/netstat.py | 14 +++--- .../framework/plugins/mac/proc_maps.py | 10 ++-- .../framework/plugins/mac/psaux.py | 10 ++-- .../framework/plugins/mac/pslist.py | 8 ++-- .../framework/plugins/mac/pstree.py | 10 ++-- .../framework/plugins/mac/socket_filters.py | 16 +++---- .../framework/plugins/mac/timers.py | 14 +++--- .../framework/plugins/mac/trustedbsd.py | 16 +++---- .../framework/plugins/mac/vfsevents.py | 6 +-- .../framework/plugins/timeliner.py | 6 +-- .../framework/plugins/windows/__init__.py | 4 +- .../framework/plugins/windows/bigpools.py | 14 +++--- .../framework/plugins/windows/cachedump.py | 10 ++-- .../framework/plugins/windows/callbacks.py | 14 +++--- .../framework/plugins/windows/cmdline.py | 8 ++-- .../framework/plugins/windows/dlllist.py | 14 +++--- .../framework/plugins/windows/driverirp.py | 10 ++-- .../framework/plugins/windows/driverscan.py | 8 ++-- .../framework/plugins/windows/dumpfiles.py | 12 ++--- .../framework/plugins/windows/envars.py | 10 ++-- .../framework/plugins/windows/filescan.py | 8 ++-- .../plugins/windows/getservicesids.py | 6 +-- .../framework/plugins/windows/getsids.py | 12 ++--- .../framework/plugins/windows/handles.py | 10 ++-- .../framework/plugins/windows/hashdump.py | 8 ++-- .../framework/plugins/windows/info.py | 12 ++--- .../framework/plugins/windows/lsadump.py | 10 ++-- .../framework/plugins/windows/malfind.py | 12 ++--- .../framework/plugins/windows/memmap.py | 8 ++-- .../framework/plugins/windows/modscan.py | 12 ++--- .../framework/plugins/windows/modules.py | 16 +++---- .../framework/plugins/windows/mutantscan.py | 8 ++-- .../framework/plugins/windows/netscan.py | 16 +++---- .../framework/plugins/windows/poolscanner.py | 16 +++---- .../framework/plugins/windows/privileges.py | 6 +-- .../framework/plugins/windows/pslist.py | 14 +++--- .../framework/plugins/windows/psscan.py | 18 ++++---- .../framework/plugins/windows/pstree.py | 8 ++-- .../plugins/windows/registry/__init__.py | 4 +- .../plugins/windows/registry/hivelist.py | 10 ++-- .../plugins/windows/registry/hivescan.py | 10 ++-- .../plugins/windows/registry/printkey.py | 12 ++--- .../plugins/windows/registry/userassist.json | 0 .../plugins/windows/registry/userassist.py | 14 +++--- .../plugins/windows/sids_and_privileges.json | 0 .../framework/plugins/windows/ssdt.py | 16 +++---- .../framework/plugins/windows/strings.py | 10 ++-- .../framework/plugins/windows/svcscan.py | 16 +++---- .../framework/plugins/windows/symlinkscan.py | 10 ++-- .../framework/plugins/windows/vadinfo.py | 10 ++-- .../framework/plugins/windows/vadyarascan.py | 10 ++-- .../framework/plugins/windows/verinfo.py | 12 ++--- .../framework/plugins/windows/virtmap.py | 8 ++-- .../framework/plugins/yarascan.py | 10 ++-- .../framework/renderers/__init__.py | 4 +- .../framework/renderers/conversion.py | 2 +- .../framework/renderers/format_hints.py | 0 .../framework/symbols/__init__.py | 2 +- .../framework/symbols/generic/__init__.py | 2 +- .../framework/symbols/generic/qemu.json | 0 .../framework/symbols/intermed.py | 14 +++--- .../framework/symbols/linux/__init__.py | 10 ++-- .../framework/symbols/linux/bash.py | 4 +- .../framework/symbols/linux/bash32.json | 0 .../framework/symbols/linux/bash64.json | 0 .../framework/symbols/linux/elf.json | 0 .../symbols/linux/extensions/__init__.py | 14 +++--- .../symbols/linux/extensions/bash.py | 8 ++-- .../framework/symbols/linux/extensions/elf.py | 4 +- .../framework/symbols/mac/__init__.py | 6 +-- .../symbols/mac/extensions/__init__.py | 12 ++--- .../framework/symbols/metadata.py | 2 +- .../framework/symbols/native.py | 2 +- .../framework/symbols/windows/__init__.py | 8 ++-- .../symbols/windows/bigpools-vista-x64.json | 0 .../symbols/windows/bigpools-vista-x86.json | 0 .../symbols/windows/bigpools-win10-x64.json | 0 .../symbols/windows/bigpools-win10-x86.json | 0 .../symbols/windows/bigpools-x64.json | 0 .../symbols/windows/bigpools-x86.json | 0 .../symbols/windows/callbacks-x64.json | 0 .../symbols/windows/callbacks-x86.json | 0 .../framework/symbols/windows/crash.json | 0 .../framework/symbols/windows/crash64.json | 0 .../symbols/windows/extensions/__init__.py | 10 ++-- .../symbols/windows/extensions/kdbg.py | 4 +- .../symbols/windows/extensions/network.py | 8 ++-- .../symbols/windows/extensions/pe.py | 6 +-- .../symbols/windows/extensions/pool.py | 4 +- .../symbols/windows/extensions/registry.py | 4 +- .../symbols/windows/extensions/services.py | 8 ++-- .../framework/symbols/windows/kdbg.json | 0 .../windows/netscan-vista-sp12-x64.json | 0 .../symbols/windows/netscan-vista-x64.json | 0 .../symbols/windows/netscan-vista-x86.json | 0 .../windows/netscan-win10-14393-x86.json | 0 .../windows/netscan-win10-15063-x64.json | 0 .../windows/netscan-win10-15063-x86.json | 0 .../windows/netscan-win10-16299-x64.json | 0 .../windows/netscan-win10-17134-x64.json | 0 .../windows/netscan-win10-17134-x86.json | 0 .../windows/netscan-win10-17763-x64.json | 0 .../windows/netscan-win10-18363-x64.json | 0 .../windows/netscan-win10-19041-x64.json | 0 .../windows/netscan-win10-19041-x86.json | 0 .../symbols/windows/netscan-win10-x64.json | 0 .../symbols/windows/netscan-win10-x86.json | 0 .../symbols/windows/netscan-win7-x64.json | 0 .../symbols/windows/netscan-win7-x86.json | 0 .../symbols/windows/netscan-win8-x64.json | 0 .../symbols/windows/netscan-win8-x86.json | 0 .../symbols/windows/netscan-win81-x64.json | 0 .../symbols/windows/netscan-win81-x86.json | 0 .../framework/symbols/windows/pdb.json | 0 .../framework/symbols/windows/pdbconv.py | 4 +- .../framework/symbols/windows/pdbutil.py | 14 +++--- .../framework/symbols/windows/pe.json | 0 .../symbols/windows/poolheader-x64-win7.json | 0 .../symbols/windows/poolheader-x64.json | 0 .../symbols/windows/poolheader-x86.json | 0 .../framework/symbols/windows/registry.json | 0 .../symbols/windows/services-vista-x64.json | 0 .../symbols/windows/services-vista-x86.json | 0 .../windows/services-win10-15063-x64.json | 0 .../windows/services-win10-15063-x86.json | 0 .../windows/services-win10-16299-x64.json | 0 .../windows/services-win10-16299-x86.json | 0 .../symbols/windows/services-win8-x64.json | 0 .../symbols/windows/services-win8-x86.json | 0 .../symbols/windows/services-xp-2003-x64.json | 0 .../symbols/windows/services-xp-x86.json | 0 .../framework/symbols/windows/versions.py | 2 +- .../framework/symbols/wrappers.py | 2 +- .../plugins/__init__.py | 2 +- .../plugins/linux/__init__.py | 0 .../plugins/mac/__init__.py | 0 .../plugins/windows/__init__.py | 0 .../plugins/windows/registry/__init__.py | 0 .../plugins/windows/registry/certificates.py | 8 ++-- .../plugins/windows/statistics.py | 8 ++-- .../schemas/__init__.py | 2 +- .../schemas/schema-0.1.0.json | 0 .../schemas/schema-2.0.0.json | 0 .../schemas/schema-2.1.0.json | 0 .../schemas/schema-4.0.0.json | 0 .../schemas/schema-4.1.0.json | 0 .../schemas/schema-6.0.0.json | 0 .../schemas/schema-6.1.0.json | 0 .../schemas/schema-6.2.0.json | 0 .../symbols/__init__.py | 2 +- volshell.py | 2 +- volshell.spec | 20 ++++---- 248 files changed, 813 insertions(+), 813 deletions(-) rename {volatility => volatility3}/__init__.py (73%) rename {volatility => volatility3}/cli/__init__.py (94%) rename {volatility => volatility3}/cli/text_renderer.py (99%) rename {volatility => volatility3}/cli/volargparse.py (100%) rename {volatility => volatility3}/cli/volshell/__init__.py (93%) rename {volatility => volatility3}/cli/volshell/generic.py (98%) rename {volatility => volatility3}/cli/volshell/linux.py (93%) rename {volatility => volatility3}/cli/volshell/mac.py (93%) rename {volatility => volatility3}/cli/volshell/windows.py (92%) rename {volatility => volatility3}/framework/__init__.py (96%) rename {volatility => volatility3}/framework/automagic/__init__.py (92%) rename {volatility => volatility3}/framework/automagic/construct_layers.py (88%) rename {volatility => volatility3}/framework/automagic/linux.py (95%) rename {volatility => volatility3}/framework/automagic/mac.py (96%) rename {volatility => volatility3}/framework/automagic/pdbscan.py (96%) rename {volatility => volatility3}/framework/automagic/stacker.py (93%) rename {volatility => volatility3}/framework/automagic/symbol_cache.py (97%) rename {volatility => volatility3}/framework/automagic/symbol_finder.py (96%) rename {volatility => volatility3}/framework/automagic/windows.py (98%) rename {volatility => volatility3}/framework/configuration/__init__.py (75%) rename {volatility => volatility3}/framework/configuration/requirements.py (99%) rename {volatility => volatility3}/framework/constants/__init__.py (90%) rename {volatility => volatility3}/framework/constants/linux/__init__.py (100%) rename {volatility => volatility3}/framework/constants/windows/__init__.py (100%) rename {volatility => volatility3}/framework/contexts/__init__.py (97%) rename {volatility => volatility3}/framework/exceptions.py (98%) rename {volatility => volatility3}/framework/interfaces/__init__.py (85%) rename {volatility => volatility3}/framework/interfaces/automagic.py (98%) rename {volatility => volatility3}/framework/interfaces/configuration.py (98%) rename {volatility => volatility3}/framework/interfaces/context.py (98%) rename {volatility => volatility3}/framework/interfaces/layers.py (99%) rename {volatility => volatility3}/framework/interfaces/objects.py (99%) rename {volatility => volatility3}/framework/interfaces/plugins.py (98%) rename {volatility => volatility3}/framework/interfaces/renderers.py (100%) rename {volatility => volatility3}/framework/interfaces/symbols.py (98%) rename {volatility => volatility3}/framework/layers/__init__.py (100%) rename {volatility => volatility3}/framework/layers/codecs/__init__.py (100%) rename {volatility => volatility3}/framework/layers/crash.py (98%) rename {volatility => volatility3}/framework/layers/elf.py (95%) rename {volatility => volatility3}/framework/layers/intel.py (98%) rename {volatility => volatility3}/framework/layers/lime.py (96%) rename {volatility => volatility3}/framework/layers/linear.py (98%) rename {volatility => volatility3}/framework/layers/msf.py (97%) rename {volatility => volatility3}/framework/layers/physical.py (97%) rename {volatility => volatility3}/framework/layers/qemu.py (98%) rename {volatility => volatility3}/framework/layers/registry.py (96%) rename {volatility => volatility3}/framework/layers/resources.py (99%) rename {volatility => volatility3}/framework/layers/scanners/__init__.py (94%) rename {volatility => volatility3}/framework/layers/scanners/multiregexp.py (100%) rename {volatility => volatility3}/framework/layers/segmented.py (97%) rename {volatility => volatility3}/framework/layers/vmware.py (96%) rename {volatility => volatility3}/framework/objects/__init__.py (99%) rename {volatility => volatility3}/framework/objects/templates.py (91%) rename {volatility => volatility3}/framework/objects/utility.py (97%) rename {volatility => volatility3}/framework/plugins/__init__.py (93%) rename {volatility => volatility3}/framework/plugins/banners.py (89%) rename {volatility => volatility3}/framework/plugins/configwriter.py (92%) rename {volatility => volatility3}/framework/plugins/frameworkinfo.py (88%) rename {volatility => volatility3}/framework/plugins/isfinfo.py (94%) rename {volatility => volatility3}/framework/plugins/layerwriter.py (96%) rename {volatility => volatility3}/framework/plugins/linux/__init__.py (69%) rename {volatility => volatility3}/framework/plugins/linux/bash.py (91%) rename {volatility => volatility3}/framework/plugins/linux/check_afinfo.py (92%) rename {volatility => volatility3}/framework/plugins/linux/check_creds.py (92%) rename {volatility => volatility3}/framework/plugins/linux/check_idt.py (92%) rename {volatility => volatility3}/framework/plugins/linux/check_modules.py (88%) rename {volatility => volatility3}/framework/plugins/linux/check_syscall.py (95%) rename {volatility => volatility3}/framework/plugins/linux/elfs.py (89%) rename {volatility => volatility3}/framework/plugins/linux/keyboard_notifiers.py (90%) rename {volatility => volatility3}/framework/plugins/linux/lsmod.py (89%) rename {volatility => volatility3}/framework/plugins/linux/lsof.py (89%) rename {volatility => volatility3}/framework/plugins/linux/malfind.py (91%) rename {volatility => volatility3}/framework/plugins/linux/proc.py (91%) rename {volatility => volatility3}/framework/plugins/linux/pslist.py (95%) rename {volatility => volatility3}/framework/plugins/linux/pstree.py (95%) rename {volatility => volatility3}/framework/plugins/linux/tty_check.py (88%) rename {volatility => volatility3}/framework/plugins/mac/__init__.py (100%) rename {volatility => volatility3}/framework/plugins/mac/bash.py (92%) rename {volatility => volatility3}/framework/plugins/mac/check_syscall.py (87%) rename {volatility => volatility3}/framework/plugins/mac/check_sysctl.py (90%) rename {volatility => volatility3}/framework/plugins/mac/check_trap_table.py (86%) rename {volatility => volatility3}/framework/plugins/mac/ifconfig.py (88%) rename {volatility => volatility3}/framework/plugins/mac/kauth_listeners.py (88%) rename {volatility => volatility3}/framework/plugins/mac/kauth_scopes.py (90%) rename {volatility => volatility3}/framework/plugins/mac/kevents.py (95%) rename {volatility => volatility3}/framework/plugins/mac/list_files.py (93%) rename {volatility => volatility3}/framework/plugins/mac/lsmod.py (88%) rename {volatility => volatility3}/framework/plugins/mac/lsof.py (90%) rename {volatility => volatility3}/framework/plugins/mac/malfind.py (90%) rename {volatility => volatility3}/framework/plugins/mac/mount.py (89%) rename {volatility => volatility3}/framework/plugins/mac/netstat.py (92%) rename {volatility => volatility3}/framework/plugins/mac/proc_maps.py (90%) rename {volatility => volatility3}/framework/plugins/mac/psaux.py (93%) rename {volatility => volatility3}/framework/plugins/mac/pslist.py (98%) rename {volatility => volatility3}/framework/plugins/mac/pstree.py (91%) rename {volatility => volatility3}/framework/plugins/mac/socket_filters.py (88%) rename {volatility => volatility3}/framework/plugins/mac/timers.py (90%) rename {volatility => volatility3}/framework/plugins/mac/trustedbsd.py (88%) rename {volatility => volatility3}/framework/plugins/mac/vfsevents.py (92%) rename {volatility => volatility3}/framework/plugins/timeliner.py (98%) rename {volatility => volatility3}/framework/plugins/windows/__init__.py (69%) rename {volatility => volatility3}/framework/plugins/windows/bigpools.py (92%) rename {volatility => volatility3}/framework/plugins/windows/cachedump.py (95%) rename {volatility => volatility3}/framework/plugins/windows/callbacks.py (97%) rename {volatility => volatility3}/framework/plugins/windows/cmdline.py (94%) rename {volatility => volatility3}/framework/plugins/windows/dlllist.py (95%) rename {volatility => volatility3}/framework/plugins/windows/driverirp.py (92%) rename {volatility => volatility3}/framework/plugins/windows/driverscan.py (93%) rename {volatility => volatility3}/framework/plugins/windows/dumpfiles.py (97%) rename {volatility => volatility3}/framework/plugins/windows/envars.py (94%) rename {volatility => volatility3}/framework/plugins/windows/filescan.py (91%) rename {volatility => volatility3}/framework/plugins/windows/getservicesids.py (92%) rename {volatility => volatility3}/framework/plugins/windows/getsids.py (93%) rename {volatility => volatility3}/framework/plugins/windows/handles.py (97%) rename {volatility => volatility3}/framework/plugins/windows/hashdump.py (98%) rename {volatility => volatility3}/framework/plugins/windows/info.py (96%) rename {volatility => volatility3}/framework/plugins/windows/lsadump.py (95%) rename {volatility => volatility3}/framework/plugins/windows/malfind.py (95%) rename {volatility => volatility3}/framework/plugins/windows/memmap.py (94%) rename {volatility => volatility3}/framework/plugins/windows/modscan.py (95%) rename {volatility => volatility3}/framework/plugins/windows/modules.py (94%) rename {volatility => volatility3}/framework/plugins/windows/mutantscan.py (91%) rename {volatility => volatility3}/framework/plugins/windows/netscan.py (97%) rename {volatility => volatility3}/framework/plugins/windows/poolscanner.py (97%) rename {volatility => volatility3}/framework/plugins/windows/privileges.py (93%) rename {volatility => volatility3}/framework/plugins/windows/pslist.py (96%) rename {volatility => volatility3}/framework/plugins/windows/psscan.py (95%) rename {volatility => volatility3}/framework/plugins/windows/pstree.py (95%) rename {volatility => volatility3}/framework/plugins/windows/registry/__init__.py (70%) rename {volatility => volatility3}/framework/plugins/windows/registry/hivelist.py (97%) rename {volatility => volatility3}/framework/plugins/windows/registry/hivescan.py (91%) rename {volatility => volatility3}/framework/plugins/windows/registry/printkey.py (95%) rename {volatility => volatility3}/framework/plugins/windows/registry/userassist.json (100%) rename {volatility => volatility3}/framework/plugins/windows/registry/userassist.py (96%) rename {volatility => volatility3}/framework/plugins/windows/sids_and_privileges.json (100%) rename {volatility => volatility3}/framework/plugins/windows/ssdt.py (93%) rename {volatility => volatility3}/framework/plugins/windows/strings.py (95%) rename {volatility => volatility3}/framework/plugins/windows/svcscan.py (94%) rename {volatility => volatility3}/framework/plugins/windows/symlinkscan.py (91%) rename {volatility => volatility3}/framework/plugins/windows/vadinfo.py (97%) rename {volatility => volatility3}/framework/plugins/windows/vadyarascan.py (94%) rename {volatility => volatility3}/framework/plugins/windows/verinfo.py (95%) rename {volatility => volatility3}/framework/plugins/windows/virtmap.py (96%) rename {volatility => volatility3}/framework/plugins/yarascan.py (93%) rename {volatility => volatility3}/framework/renderers/__init__.py (99%) rename {volatility => volatility3}/framework/renderers/conversion.py (98%) rename {volatility => volatility3}/framework/renderers/format_hints.py (100%) rename {volatility => volatility3}/framework/symbols/__init__.py (99%) rename {volatility => volatility3}/framework/symbols/generic/__init__.py (97%) rename {volatility => volatility3}/framework/symbols/generic/qemu.json (100%) rename {volatility => volatility3}/framework/symbols/intermed.py (98%) rename {volatility => volatility3}/framework/symbols/linux/__init__.py (96%) rename {volatility => volatility3}/framework/symbols/linux/bash.py (77%) rename {volatility => volatility3}/framework/symbols/linux/bash32.json (100%) rename {volatility => volatility3}/framework/symbols/linux/bash64.json (100%) rename {volatility => volatility3}/framework/symbols/linux/elf.json (100%) rename {volatility => volatility3}/framework/symbols/linux/extensions/__init__.py (97%) rename {volatility => volatility3}/framework/symbols/linux/extensions/bash.py (89%) rename {volatility => volatility3}/framework/symbols/linux/extensions/elf.py (98%) rename {volatility => volatility3}/framework/symbols/mac/__init__.py (97%) rename {volatility => volatility3}/framework/symbols/mac/extensions/__init__.py (98%) rename {volatility => volatility3}/framework/symbols/metadata.py (96%) rename {volatility => volatility3}/framework/symbols/native.py (98%) rename {volatility => volatility3}/framework/symbols/windows/__init__.py (92%) rename {volatility => volatility3}/framework/symbols/windows/bigpools-vista-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/bigpools-vista-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/bigpools-win10-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/bigpools-win10-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/bigpools-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/bigpools-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/callbacks-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/callbacks-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/crash.json (100%) rename {volatility => volatility3}/framework/symbols/windows/crash64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/extensions/__init__.py (99%) rename {volatility => volatility3}/framework/symbols/windows/extensions/kdbg.py (93%) rename {volatility => volatility3}/framework/symbols/windows/extensions/network.py (97%) rename {volatility => volatility3}/framework/symbols/windows/extensions/pe.py (98%) rename {volatility => volatility3}/framework/symbols/windows/extensions/pool.py (99%) rename {volatility => volatility3}/framework/symbols/windows/extensions/registry.py (98%) rename {volatility => volatility3}/framework/symbols/windows/extensions/services.py (96%) rename {volatility => volatility3}/framework/symbols/windows/kdbg.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-vista-sp12-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-vista-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-vista-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-14393-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-15063-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-15063-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-16299-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-17134-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-17134-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-17763-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-18363-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-19041-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-19041-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win7-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win7-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win8-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win8-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win81-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win81-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/pdb.json (100%) rename {volatility => volatility3}/framework/symbols/windows/pdbconv.py (99%) rename {volatility => volatility3}/framework/symbols/windows/pdbutil.py (96%) rename {volatility => volatility3}/framework/symbols/windows/pe.json (100%) rename {volatility => volatility3}/framework/symbols/windows/poolheader-x64-win7.json (100%) rename {volatility => volatility3}/framework/symbols/windows/poolheader-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/poolheader-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/registry.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-vista-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-vista-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-win10-15063-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-win10-15063-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-win10-16299-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-win10-16299-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-win8-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-win8-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-xp-2003-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-xp-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/versions.py (98%) rename {volatility => volatility3}/framework/symbols/wrappers.py (94%) rename {volatility => volatility3}/plugins/__init__.py (94%) rename {volatility => volatility3}/plugins/linux/__init__.py (100%) rename {volatility => volatility3}/plugins/mac/__init__.py (100%) rename {volatility => volatility3}/plugins/windows/__init__.py (100%) rename {volatility => volatility3}/plugins/windows/registry/__init__.py (100%) rename {volatility => volatility3}/plugins/windows/registry/certificates.py (93%) rename {volatility => volatility3}/plugins/windows/statistics.py (93%) rename {volatility => volatility3}/schemas/__init__.py (98%) rename {volatility => volatility3}/schemas/schema-0.1.0.json (100%) rename {volatility => volatility3}/schemas/schema-2.0.0.json (100%) rename {volatility => volatility3}/schemas/schema-2.1.0.json (100%) rename {volatility => volatility3}/schemas/schema-4.0.0.json (100%) rename {volatility => volatility3}/schemas/schema-4.1.0.json (100%) rename {volatility => volatility3}/schemas/schema-6.0.0.json (100%) rename {volatility => volatility3}/schemas/schema-6.1.0.json (100%) rename {volatility => volatility3}/schemas/schema-6.2.0.json (100%) rename {volatility => volatility3}/symbols/__init__.py (89%) diff --git a/.gitignore b/.gitignore index 448d08dbd..eba1ee1a5 100644 --- a/.gitignore +++ b/.gitignore @@ -14,14 +14,14 @@ workspace.xml # Manually generated files .mypy_cache stubs -volatility/symbols/linux* -volatility/symbols/windows* -volatility/symbols/mac* +volatility3/symbols/linux* +volatility3/symbols/windows* +volatility3/symbols/mac* # Mac metadata files .DS_Store -# Volatility's config +# Volatility's config config*.json # Pyinstaller files diff --git a/development/schema_validate.py b/development/schema_validate.py index 00a74868a..ece56cdec 100644 --- a/development/schema_validate.py +++ b/development/schema_validate.py @@ -17,7 +17,7 @@ logger = logging.getLogger("") logger.addHandler(console) logger.setLevel(logging.DEBUG) -from volatility import schemas +from volatility3 import schemas if __name__ == '__main__': parser = argparse.ArgumentParser("Validates ") diff --git a/doc/source/conf.py b/doc/source/conf.py index bef818295..6a382be3b 100644 --- a/doc/source/conf.py +++ b/doc/source/conf.py @@ -21,18 +21,18 @@ import sphinx.ext.apidoc def setup(app): - volatility_directory = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..', 'volatility')) + volatility_directory = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..', 'volatility3')) source_dir = os.path.abspath(os.path.dirname(__file__)) sphinx.ext.apidoc.main(argv = ['-e', '-M', '-f', '-T', '-o', source_dir, volatility_directory]) - # Go through the volatility.framework.plugins files and change them to volatility.plugins + # Go through the volatility3.framework.plugins files and change them to volatility3.plugins for dir, _, files in os.walk(os.path.dirname(__file__)): for filename in files: - if filename.startswith('volatility.framework.plugins') and filename != 'volatility.framework.plugins.rst': - # Change all volatility.framework.plugins to volatility.plugins in the file + if filename.startswith('volatility3.framework.plugins') and filename != 'volatility3.framework.plugins.rst': + # Change all volatility3.framework.plugins to volatility3.plugins in the file # Rename the file - new_filename = filename.replace('volatility.framework.plugins', 'volatility.plugins') + new_filename = filename.replace('volatility3.framework.plugins', 'volatility3.plugins') replace_string = b"Submodules\n----------\n\n.. toctree::\n\n" submodules = replace_string @@ -48,22 +48,22 @@ def setup(app): with open(os.path.join(dir, new_filename), 'wb') as newfile: with open(os.path.join(dir, filename), "rb") as oldfile: line = oldfile.read() - correct_plugins = line.replace(b'volatility.framework.plugins', b'volatility.plugins') + correct_plugins = line.replace(b'volatility3.framework.plugins', b'volatility3.plugins') correct_submodules = correct_plugins.replace(replace_string, submodules) newfile.write(correct_submodules) os.remove(os.path.join(dir, filename)) - elif filename == 'volatility.framework.rst': + elif filename == 'volatility3.framework.rst': with open(os.path.join(dir, filename), "rb") as contents: lines = contents.readlines() plugins_seen = False with open(os.path.join(dir, filename), "wb") as contents: for line in lines: - if b'volatility.framework.plugins' in line: + if b'volatility3.framework.plugins' in line: plugins_seen = True if plugins_seen and line == b'': - contents.write(b' volatility.plugins') + contents.write(b' volatility3.plugins') contents.write(line) - elif filename == 'volatility.plugins.rst': + elif filename == 'volatility3.plugins.rst': with open(os.path.join(dir, filename), "rb") as contents: lines = contents.readlines() with open(os.path.join(dir, 'volatility.framework.plugins.rst'), "rb") as contents: @@ -82,7 +82,7 @@ def setup(app): for line in lines: contents.write(line) for line in submodule_lines: - contents.write(line.replace(b'volatility.framework.plugins', b'volatility.plugins')) + contents.write(line.replace(b'volatility3.framework.plugins', b'volatility3.plugins')) # If extensions (or modules to document with autodoc) are in another directory, @@ -90,7 +90,7 @@ def setup(app): # documentation root, use os.path.abspath to make it absolute, like shown here. sys.path.insert(0, os.path.abspath('../..')) -from volatility.framework import constants +from volatility3.framework import constants # -- General configuration ------------------------------------------------ diff --git a/setup.py b/setup.py index 737deb4a9..168c7a4cf 100644 --- a/setup.py +++ b/setup.py @@ -4,9 +4,9 @@ import setuptools -from volatility.framework import constants +from volatility3.framework import constants -setuptools.setup(name = "volatility", +setuptools.setup(name = "volatility3", description = "Memory forensics framework", version = constants.PACKAGE_VERSION, license = "VSL", @@ -27,8 +27,8 @@ setuptools.setup(name = "volatility", packages = setuptools.find_packages(exclude = ["development", "development.*"]), entry_points = { 'console_scripts': [ - 'vol = volatility.cli:main', - 'volshell = volatility.cli.volshell:main', + 'vol = volatility3.cli:main', + 'volshell = volatility3.cli.volshell:main', ], }, install_requires = ["pefile"], diff --git a/vol.py b/vol.py index 802915386..080413545 100755 --- a/vol.py +++ b/vol.py @@ -4,7 +4,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import volatility.cli +import volatility3.cli if __name__ == '__main__': - volatility.cli.main() + volatility3.cli.main() diff --git a/vol.spec b/vol.spec index 6d7b67662..42b69af3f 100644 --- a/vol.spec +++ b/vol.spec @@ -31,15 +31,15 @@ sys.path.append(os.getcwd()) vol_analysis = Analysis(['vol.py'], pathex = [], binaries = binaries, - datas = collect_data_files('volatility.framework') + \ - collect_data_files('volatility.framework.automagic', include_py_files = True) + \ - collect_data_files('volatility.framework.plugins', include_py_files = True) + \ - collect_data_files('volatility.framework.layers', include_py_files = True) + \ - collect_data_files('volatility.schemas') + \ - collect_data_files('volatility.plugins', include_py_files = True), - hiddenimports = collect_submodules('volatility.framework.automagic') + \ - collect_submodules('volatility.framework.plugins') + \ - collect_submodules('volatility.framework.symbols'), + datas = collect_data_files('volatility3.framework') + \ + collect_data_files('volatility3.framework.automagic', include_py_files = True) + \ + collect_data_files('volatility3.framework.plugins', include_py_files = True) + \ + collect_data_files('volatility3.framework.layers', include_py_files = True) + \ + collect_data_files('volatility3.schemas') + \ + collect_data_files('volatility3.plugins', include_py_files = True), + hiddenimports = collect_submodules('volatility3.framework.automagic') + \ + collect_submodules('volatility3.framework.plugins') + \ + collect_submodules('volatility3.framework.symbols'), hookspath = [], runtime_hooks = [], excludes = [], @@ -55,16 +55,16 @@ vol_analysis = Analysis(['vol.py'], # volshell_analysis = Analysis(['volshell.py'], # pathex = [], # binaries = [], -# datas = collect_data_files('volatility.framework') + \ -# collect_data_files('volatility.framework.automagic', include_py_files = True) + \ -# collect_data_files('volatility.framework.plugins', include_py_files = True) + \ -# collect_data_files('volatility.framework.layers', include_py_files = True) + \ -# collect_data_files('volatility.cli', include_py_files = True) + \ -# collect_data_files('volatility.schemas') + \ -# collect_data_files('volatility.plugins', include_py_files = True), -# hiddenimports = collect_submodules('volatility.framework.automagic') + \ -# collect_submodules('volatility.framework.plugins') + \ -# collect_submodules('volatility.framework.symbols'), +# datas = collect_data_files('volatility3.framework') + \ +# collect_data_files('volatility3.framework.automagic', include_py_files = True) + \ +# collect_data_files('volatility3.framework.plugins', include_py_files = True) + \ +# collect_data_files('volatility3.framework.layers', include_py_files = True) + \ +# collect_data_files('volatility3.cli', include_py_files = True) + \ +# collect_data_files('volatility3.schemas') + \ +# collect_data_files('volatility3.plugins', include_py_files = True), +# hiddenimports = collect_submodules('volatility3.framework.automagic') + \ +# collect_submodules('volatility3.framework.plugins') + \ +# collect_submodules('volatility3.framework.symbols'), # hookspath = [], # runtime_hooks = [], # excludes = [], diff --git a/volatility/__init__.py b/volatility3/__init__.py similarity index 73% rename from volatility/__init__.py rename to volatility3/__init__.py index f766a4ba2..5d3c34e43 100644 --- a/volatility/__init__.py +++ b/volatility3/__init__.py @@ -35,8 +35,8 @@ class WarningFindSpec(abc.MetaPathFinder): def find_spec(fullname: str, path: Optional[List[str]], target: None = None, **kwargs) -> None: """Mock find_spec method that just checks the name, this must go first.""" - if fullname.startswith("volatility.framework.plugins."): - warning = "Please do not use the volatility.framework.plugins namespace directly, only use volatility.plugins" + if fullname.startswith("volatility3.framework.plugins."): + warning = "Please do not use the volatility3.framework.plugins namespace directly, only use volatility3.plugins" # Pyinstaller uses walk_packages to import, but needs to read the modules to figure out dependencies # As such, we only print the warning when directly imported rather than from within walk_packages if inspect.stack()[-2].function != 'walk_packages': @@ -46,17 +46,17 @@ class WarningFindSpec(abc.MetaPathFinder): warning_find_spec = [WarningFindSpec()] # type: List[abc.MetaPathFinder] sys.meta_path = warning_find_spec + sys.meta_path -# We point the volatility.plugins __path__ variable at BOTH -# volatility/plugins -# volatility/framework/plugins +# We point the volatility3.plugins __path__ variable at BOTH +# volatility3/plugins +# volatility3/framework/plugins # in that order. # # This will allow our users to override any component of any plugin without monkey patching, # but it also allows us to clear out the plugins directory to get back to proper functionality. # This offered the greatest flexibility for users whilst allowing us to keep the core separate and clean. # -# This means that all plugins should be imported as volatility.plugins (otherwise they'll be imported twice, -# once as volatility.plugins.NAME and once as volatility.framework.plugins.NAME). We therefore throw an error -# if anyone tries to import anything under the volatility.framework.plugins.* namespace +# This means that all plugins should be imported as volatility3.plugins (otherwise they'll be imported twice, +# once as volatility3.plugins.NAME and once as volatility3.framework.plugins.NAME). We therefore throw an error +# if anyone tries to import anything under the volatility3.framework.plugins.* namespace # -# The remediation is to only ever import form volatility.plugins instead. +# The remediation is to only ever import form volatility3.plugins instead. diff --git a/volatility/cli/__init__.py b/volatility3/cli/__init__.py similarity index 94% rename from volatility/cli/__init__.py rename to volatility3/cli/__init__.py index 0c038a322..a90404d0a 100644 --- a/volatility/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -22,13 +22,13 @@ import traceback from typing import Dict, Type, Union, Any from urllib import parse, request -import volatility.plugins -import volatility.symbols -from volatility import framework -from volatility.cli import text_renderer, volargparse -from volatility.framework import automagic, constants, contexts, exceptions, interfaces, plugins, configuration -from volatility.framework.automagic import stacker -from volatility.framework.configuration import requirements +import volatility3.plugins +import volatility3.symbols +from volatility3 import framework +from volatility3.cli import text_renderer, volargparse +from volatility3.framework import automagic, constants, contexts, exceptions, interfaces, plugins, configuration +from volatility3.framework.automagic import stacker +from volatility3.framework.configuration import requirements # Make sure we log everything @@ -71,7 +71,7 @@ class MuteProgress(PrintedProgress): class CommandLine: """Constructs a command-line interface object for users to run plugins.""" - CLI_NAME = 'volatility' + CLI_NAME = 'volatility3' def __init__(self): self.setup_logging() @@ -79,7 +79,7 @@ class CommandLine: @classmethod def setup_logging(cls): - # Delay the setting of vollog for those that want to import volatility.cli (issue #241) + # Delay the setting of vollog for those that want to import volatility3.cli (issue #241) vollog.setLevel(1) vollog.addHandler(console) @@ -87,7 +87,7 @@ class CommandLine: """Executes the command line module, taking the system arguments, determining the plugin to run and then running it.""" - volatility.framework.require_interface_version(2, 0, 0) + volatility3.framework.require_interface_version(2, 0, 0) renderers = dict([(x.name.lower(), x) for x in framework.class_subclasses(text_renderer.CLIRenderer)]) @@ -172,12 +172,12 @@ class CommandLine: banner_output.write("Volatility 3 Framework {}\n".format(constants.PACKAGE_VERSION)) if partial_args.plugin_dirs: - volatility.plugins.__path__ = [os.path.abspath(p) - for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH + volatility3.plugins.__path__ = [os.path.abspath(p) + for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH if partial_args.symbol_dirs: - volatility.symbols.__path__ = [os.path.abspath(p) - for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS + volatility3.symbols.__path__ = [os.path.abspath(p) + for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS if partial_args.log: file_logger = logging.FileHandler(partial_args.log) @@ -192,8 +192,8 @@ class CommandLine: else: console.setLevel(10 - (partial_args.verbosity - 2)) - vollog.info("Volatility plugins path: {}".format(volatility.plugins.__path__)) - vollog.info("Volatility symbols path: {}".format(volatility.symbols.__path__)) + vollog.info("Volatility plugins path: {}".format(volatility3.plugins.__path__)) + vollog.info("Volatility symbols path: {}".format(volatility3.symbols.__path__)) # Set the PARALLELISM if partial_args.parallelism == 'processes': @@ -208,7 +208,7 @@ class CommandLine: # Do the initialization ctx = contexts.Context() # Construct a blank context - failures = framework.import_files(volatility.plugins, + failures = framework.import_files(volatility3.plugins, True) # Will not log as console's default level is WARNING if failures: parser.epilog = "The following plugins could not be loaded (use -vv to see why): " + \ @@ -342,7 +342,7 @@ class CommandLine: caused_by = [ "Memory smear during acquisition (try re-acquiring if possible)", "An intentionally invalid page lookup (operating system protection)", - "A bug in the plugin/volatility (re-run with -vvv and file a bug)" + "A bug in the plugin/volatility3 (re-run with -vvv and file a bug)" ] else: detail = "{} in layer {} ({})".format(hex(excp.invalid_address), excp.layer_name, excp) @@ -350,7 +350,7 @@ class CommandLine: "The base memory file being incomplete (try re-acquiring if possible)", "Memory smear during acquisition (try re-acquiring if possible)", "An intentionally invalid page lookup (operating system protection)", - "A bug in the plugin/volatility (re-run with -vvv and file a bug)" + "A bug in the plugin/volatility3 (re-run with -vvv and file a bug)" ] elif isinstance(excp, exceptions.SymbolError): general = "Volatility experienced a symbol-related issue:" @@ -414,7 +414,7 @@ class CommandLine: print("\nA translation layer requirement was not fulfilled. Please verify that:\n" "\tA file was provided to create this layer (by -f, --single-location or by config)\n" "\tThe file exists and is readable\n" - "\tThe necessary symbols are present and identified by volatility") + "\tThe necessary symbols are present and identified by volatility3") def populate_config(self, context: interfaces.context.ContextInterface, configurables_list: Dict[str, Type[interfaces.configuration.ConfigurableInterface]], @@ -424,7 +424,7 @@ class CommandLine: We have already determined these elements must be descended from ConfigurableInterface Args: - context: The volatility context to operate on + context: The volatility3 context to operate on configurables_list: A dictionary of configurable items that can be configured on the plugin args: An object containing the arguments necessary plugin_config_path: The path within the context's config containing the plugin's configuration @@ -564,11 +564,11 @@ class CommandLine: additional["action"] = "store_true" if "type" in additional: del additional["type"] - elif isinstance(requirement, volatility.framework.configuration.requirements.ListRequirement): + elif isinstance(requirement, volatility3.framework.configuration.requirements.ListRequirement): additional["type"] = requirement.element_type nargs = '*' if requirement.optional else '+' additional["nargs"] = nargs - elif isinstance(requirement, volatility.framework.configuration.requirements.ChoiceRequirement): + elif isinstance(requirement, volatility3.framework.configuration.requirements.ChoiceRequirement): additional["type"] = str additional["choices"] = requirement.choices else: diff --git a/volatility/cli/text_renderer.py b/volatility3/cli/text_renderer.py similarity index 99% rename from volatility/cli/text_renderer.py rename to volatility3/cli/text_renderer.py index d1d2663fe..f40a5d323 100644 --- a/volatility/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -10,8 +10,8 @@ import sys from functools import wraps from typing import Callable, Any, List, Tuple, Dict -from volatility.framework import interfaces, renderers -from volatility.framework.renderers import format_hints +from volatility3.framework import interfaces, renderers +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) diff --git a/volatility/cli/volargparse.py b/volatility3/cli/volargparse.py similarity index 100% rename from volatility/cli/volargparse.py rename to volatility3/cli/volargparse.py diff --git a/volatility/cli/volshell/__init__.py b/volatility3/cli/volshell/__init__.py similarity index 93% rename from volatility/cli/volshell/__init__.py rename to volatility3/cli/volshell/__init__.py index 4441d4b7b..122107d0f 100644 --- a/volatility/cli/volshell/__init__.py +++ b/volatility3/cli/volshell/__init__.py @@ -9,11 +9,11 @@ import os import sys from urllib import request -import volatility.plugins -import volatility.symbols -from volatility import cli, framework -from volatility.cli.volshell import generic, windows, linux, mac -from volatility.framework import automagic, constants, contexts, exceptions, interfaces, plugins +import volatility3.plugins +import volatility3.symbols +from volatility3 import cli, framework +from volatility3.cli.volshell import generic, windows, linux, mac +from volatility3.framework import automagic, constants, contexts, exceptions, interfaces, plugins # Make sure we log everything vollog = logging.getLogger() @@ -104,15 +104,15 @@ class VolShell(cli.CommandLine): known_args = [arg for arg in sys.argv if arg != '--help' and arg != '-h'] partial_args, _ = parser.parse_known_args(known_args) if partial_args.plugin_dirs: - volatility.plugins.__path__ = [os.path.abspath(p) - for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH + volatility3.plugins.__path__ = [os.path.abspath(p) + for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH if partial_args.symbol_dirs: - volatility.symbols.__path__ = [os.path.abspath(p) - for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS + volatility3.symbols.__path__ = [os.path.abspath(p) + for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS - vollog.info("Volatility plugins path: {}".format(volatility.plugins.__path__)) - vollog.info("Volatility symbols path: {}".format(volatility.symbols.__path__)) + vollog.info("Volatility plugins path: {}".format(volatility3.plugins.__path__)) + vollog.info("Volatility symbols path: {}".format(volatility3.symbols.__path__)) if partial_args.log: file_logger = logging.FileHandler(partial_args.log) @@ -134,7 +134,7 @@ class VolShell(cli.CommandLine): # Do the initialization ctx = contexts.Context() # Construct a blank context - failures = framework.import_files(volatility.plugins, + failures = framework.import_files(volatility3.plugins, True) # Will not log as console's default level is WARNING if failures: parser.epilog = "The following plugins could not be loaded (use -vv to see why): " + \ diff --git a/volatility/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py similarity index 98% rename from volatility/cli/volshell/generic.py rename to volatility3/cli/volshell/generic.py index 18d76ae04..a2a156ac4 100644 --- a/volatility/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -11,10 +11,10 @@ import sys from typing import Any, Dict, List, Optional, Tuple, Union, Type from urllib import request -from volatility.cli import text_renderer -from volatility.framework import renderers, interfaces, objects, plugins, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import intel, physical +from volatility3.cli import text_renderer +from volatility3.framework import renderers, interfaces, objects, plugins, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import intel, physical try: import capstone diff --git a/volatility/cli/volshell/linux.py b/volatility3/cli/volshell/linux.py similarity index 93% rename from volatility/cli/volshell/linux.py rename to volatility3/cli/volshell/linux.py index 03c54bda9..73d5481aa 100644 --- a/volatility/cli/volshell/linux.py +++ b/volatility3/cli/volshell/linux.py @@ -4,10 +4,10 @@ from typing import Any, List, Tuple, Union -from volatility.cli.volshell import generic -from volatility.framework import interfaces, constants -from volatility.framework.configuration import requirements -from volatility.plugins.linux import pslist +from volatility3.cli.volshell import generic +from volatility3.framework import interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.plugins.linux import pslist class Volshell(generic.Volshell): diff --git a/volatility/cli/volshell/mac.py b/volatility3/cli/volshell/mac.py similarity index 93% rename from volatility/cli/volshell/mac.py rename to volatility3/cli/volshell/mac.py index d0ae4cb13..662f8dcb4 100644 --- a/volatility/cli/volshell/mac.py +++ b/volatility3/cli/volshell/mac.py @@ -4,10 +4,10 @@ from typing import Any, List, Tuple, Union -from volatility.cli.volshell import generic -from volatility.framework import constants, interfaces -from volatility.framework.configuration import requirements -from volatility.plugins.mac import pslist +from volatility3.cli.volshell import generic +from volatility3.framework import constants, interfaces +from volatility3.framework.configuration import requirements +from volatility3.plugins.mac import pslist class Volshell(generic.Volshell): diff --git a/volatility/cli/volshell/windows.py b/volatility3/cli/volshell/windows.py similarity index 92% rename from volatility/cli/volshell/windows.py rename to volatility3/cli/volshell/windows.py index 7f4c4fcc1..d9de5a92f 100644 --- a/volatility/cli/volshell/windows.py +++ b/volatility3/cli/volshell/windows.py @@ -4,10 +4,10 @@ from typing import Any, List, Tuple, Union -from volatility.cli.volshell import generic -from volatility.framework import interfaces, constants -from volatility.framework.configuration import requirements -from volatility.plugins.windows import pslist +from volatility3.cli.volshell import generic +from volatility3.framework import interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.plugins.windows import pslist class Volshell(generic.Volshell): diff --git a/volatility/framework/__init__.py b/volatility3/framework/__init__.py similarity index 96% rename from volatility/framework/__init__.py rename to volatility3/framework/__init__.py index b0a9feeae..e8c67588c 100644 --- a/volatility/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -19,7 +19,7 @@ import logging import os from typing import Any, Dict, Generator, List, Tuple, Type, TypeVar -from volatility.framework import constants, interfaces +from volatility3.framework import constants, interfaces # ## # @@ -120,8 +120,8 @@ def list_plugins() -> Dict[str, Type[interfaces.plugins.PluginInterface]]: plugin_list = {} for plugin in class_subclasses(interfaces.plugins.PluginInterface): plugin_name = plugin.__module__ + "." + plugin.__name__ - if plugin_name.startswith("volatility.plugins."): - plugin_name = plugin_name[len("volatility.plugins."):] + if plugin_name.startswith("volatility3.plugins."): + plugin_name = plugin_name[len("volatility3.plugins."):] plugin_list[plugin_name] = plugin return plugin_list diff --git a/volatility/framework/automagic/__init__.py b/volatility3/framework/automagic/__init__.py similarity index 92% rename from volatility/framework/automagic/__init__.py rename to volatility3/framework/automagic/__init__.py index 2541214a0..be1badb6b 100644 --- a/volatility/framework/automagic/__init__.py +++ b/volatility3/framework/automagic/__init__.py @@ -16,8 +16,8 @@ import sys import traceback from typing import List, Type, Union -from volatility.framework import class_subclasses, import_files, interfaces, constants -from volatility.framework.configuration import requirements +from volatility3.framework import class_subclasses, import_files, interfaces, constants +from volatility3.framework.configuration import requirements vollog = logging.getLogger(__name__) @@ -30,7 +30,7 @@ mac_automagic = ['ConstructionMagic', 'LayerStacker', 'MacBannerCache', 'MacSymb def available(context: interfaces.context.ContextInterface) -> List[interfaces.automagic.AutomagicInterface]: """Returns an ordered list of all subclasses of - :class:`~volatility.framework.interfaces.automagic.AutomagicInterface`. + :class:`~volatility3.framework.interfaces.automagic.AutomagicInterface`. The order is based on the priority attributes of the subclasses, in order to ensure the automagics are listed in an appropriate order. @@ -90,9 +90,9 @@ def run(automagics: List[interfaces.automagic.AutomagicInterface], changes to the context. Args: - automagics: A list of :class:`~volatility.framework.interfaces.automagic.AutomagicInterface` objects - context: The context (that inherits from :class:`~volatility.framework.interfaces.context.ContextInterface`) for modification - configurable: An object that inherits from :class:`~volatility.framework.interfaces.configuration.ConfigurableInterface` + automagics: A list of :class:`~volatility3.framework.interfaces.automagic.AutomagicInterface` objects + context: The context (that inherits from :class:`~volatility3.framework.interfaces.context.ContextInterface`) for modification + configurable: An object that inherits from :class:`~volatility3.framework.interfaces.configuration.ConfigurableInterface` config_path: The path within the `context.config` for options required by the `configurable` progress_callback: A function that takes a percentage (and an optional description) that will be called periodically diff --git a/volatility/framework/automagic/construct_layers.py b/volatility3/framework/automagic/construct_layers.py similarity index 88% rename from volatility/framework/automagic/construct_layers.py rename to volatility3/framework/automagic/construct_layers.py index 66288db69..15e6af4bd 100644 --- a/volatility/framework/automagic/construct_layers.py +++ b/volatility3/framework/automagic/construct_layers.py @@ -2,16 +2,16 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """An automagic module to use configuration data to configure and then -construct classes that fulfill the descendants of a :class:`~volatility.framewo +construct classes that fulfill the descendants of a :class:`~volatility3.framewo rk.interfaces.configuration.ConfigurableInterface`.""" import logging import sys from typing import List -from volatility import framework -from volatility.framework import constants -from volatility.framework import interfaces +from volatility3 import framework +from volatility3.framework import constants +from volatility3.framework import interfaces vollog = logging.getLogger(__name__) @@ -19,9 +19,9 @@ vollog = logging.getLogger(__name__) class ConstructionMagic(interfaces.automagic.AutomagicInterface): """Constructs underlying layers. - Class to run through the requirement tree of the :class:`~volatility.framework.interfaces.configuration.ConfigurableInterface` + Class to run through the requirement tree of the :class:`~volatility3.framework.interfaces.configuration.ConfigurableInterface` and from the bottom of the tree upwards, attempt to construct all - :class:`~volatility.framework.interfaces.configuration.ConstructableRequirementInterface` based classes. + :class:`~volatility3.framework.interfaces.configuration.ConstructableRequirementInterface` based classes. :warning: This `automagic` should run first to allow existing configurations to have been constructed for use by later automagic """ @@ -35,7 +35,7 @@ class ConstructionMagic(interfaces.automagic.AutomagicInterface): optional = False) -> List[str]: # Make sure we import the layers, so they can reconstructed - framework.import_files(sys.modules['volatility.framework.layers']) + framework.import_files(sys.modules['volatility3.framework.layers']) result = [] # type: List[str] if requirement.unsatisfied(context, config_path): diff --git a/volatility/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py similarity index 95% rename from volatility/framework/automagic/linux.py rename to volatility3/framework/automagic/linux.py index 3590f18b5..34d6e7936 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -5,10 +5,10 @@ import logging from typing import Optional, Tuple, Type -from volatility.framework import interfaces, constants -from volatility.framework.automagic import symbol_cache, symbol_finder -from volatility.framework.layers import intel, scanners -from volatility.framework.symbols import linux +from volatility3.framework import interfaces, constants +from volatility3.framework.automagic import symbol_cache, symbol_finder +from volatility3.framework.layers import intel, scanners +from volatility3.framework.symbols import linux vollog = logging.getLogger(__name__) @@ -153,5 +153,5 @@ class LinuxSymbolFinder(symbol_finder.SymbolFinder): banner_config_key = "kernel_banner" banner_cache = LinuxBannerCache - symbol_class = "volatility.framework.symbols.linux.LinuxKernelIntermedSymbols" + symbol_class = "volatility3.framework.symbols.linux.LinuxKernelIntermedSymbols" find_aslr = lambda cls, *args: LinuxIntelStacker.find_aslr(*args)[1] diff --git a/volatility/framework/automagic/mac.py b/volatility3/framework/automagic/mac.py similarity index 96% rename from volatility/framework/automagic/mac.py rename to volatility3/framework/automagic/mac.py index e88de792f..3ba179068 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility3/framework/automagic/mac.py @@ -6,10 +6,10 @@ import logging import struct from typing import Optional -from volatility.framework import interfaces, constants, layers -from volatility.framework.automagic import symbol_cache, symbol_finder -from volatility.framework.layers import intel, scanners -from volatility.framework.symbols import mac +from volatility3.framework import interfaces, constants, layers +from volatility3.framework.automagic import symbol_cache, symbol_finder +from volatility3.framework.layers import intel, scanners +from volatility3.framework.symbols import mac vollog = logging.getLogger(__name__) @@ -204,4 +204,4 @@ class MacSymbolFinder(symbol_finder.SymbolFinder): banner_config_key = 'kernel_banner' banner_cache = MacBannerCache find_aslr = MacIntelStacker.find_aslr - symbol_class = "volatility.framework.symbols.mac.MacKernelIntermedSymbols" + symbol_class = "volatility3.framework.symbols.mac.MacKernelIntermedSymbols" diff --git a/volatility/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py similarity index 96% rename from volatility/framework/automagic/pdbscan.py rename to volatility3/framework/automagic/pdbscan.py index 8ad750737..59b78c3ca 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -4,19 +4,19 @@ """A module for scanning translation layers looking for Windows PDB records from loaded PE files. -This module contains a standalone scanner, and also a :class:`~volatility.framework.interfaces.layers.ScannerInterface` -based scanner for use within the framework by calling :func:`~volatility.framework.interfaces.layers.DataLayerInterface.scan`. +This module contains a standalone scanner, and also a :class:`~volatility3.framework.interfaces.layers.ScannerInterface` +based scanner for use within the framework by calling :func:`~volatility3.framework.interfaces.layers.DataLayerInterface.scan`. """ import logging import math import os from typing import Any, Dict, Iterable, List, Optional, Set, Tuple, Union -from volatility.framework import constants, exceptions, interfaces, layers -from volatility.framework.configuration import requirements -from volatility.framework.layers import intel, scanners -from volatility.framework.symbols import native -from volatility.framework.symbols.windows.pdbutil import PDBUtility +from volatility3.framework import constants, exceptions, interfaces, layers +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import intel, scanners +from volatility3.framework.symbols import native +from volatility3.framework.symbols.windows.pdbutil import PDBUtility if __name__ == "__main__": import sys @@ -55,7 +55,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): Args: context: The context in which the `requirement` lives config_path: The path within the `context` for the `requirement`'s configuration variables - requirement: The root of the requirement tree to search for :class:~`volatility.framework.interfaces.layers.TranslationLayerRequirement` objects to scan + requirement: The root of the requirement tree to search for :class:~`volatility3.framework.interfaces.layers.TranslationLayerRequirement` objects to scan progress_callback: Means of providing the user with feedback during long processes Returns: @@ -105,7 +105,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): guid = kernel['GUID'], age = kernel['age'], pdb_name = kernel['pdb_name'], - symbol_table_class = "volatility.framework.symbols.windows.WindowsKernelIntermedSymbols", + symbol_table_class = "volatility3.framework.symbols.windows.WindowsKernelIntermedSymbols", config_path = sub_config_path, progress_callback = progress_callback) else: diff --git a/volatility/framework/automagic/stacker.py b/volatility3/framework/automagic/stacker.py similarity index 93% rename from volatility/framework/automagic/stacker.py rename to volatility3/framework/automagic/stacker.py index 1c24384ad..78fbab76c 100644 --- a/volatility/framework/automagic/stacker.py +++ b/volatility3/framework/automagic/stacker.py @@ -3,7 +3,7 @@ # """This module attempts to automatically stack layers. -This automagic module fulfills :class:`~volatility.framework.interfaces.configuration.TranslationLayerRequirement` that are not already fulfilled, by attempting to +This automagic module fulfills :class:`~volatility3.framework.interfaces.configuration.TranslationLayerRequirement` that are not already fulfilled, by attempting to stack as many layers on top of each other as possible. The base/lowest layer is derived from the "automagic.general.single_location" configuration path. Layers are then attempting in likely height order, and once a layer successfully stacks on top of the existing layers, it is removed from the possible choices list @@ -15,11 +15,11 @@ import sys import traceback from typing import Any, List, Optional, Tuple, Type -from volatility import framework -from volatility.framework import interfaces, constants -from volatility.framework.automagic import construct_layers -from volatility.framework.configuration import requirements -from volatility.framework.layers import physical +from volatility3 import framework +from volatility3.framework import interfaces, constants +from volatility3.framework.automagic import construct_layers +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import physical vollog = logging.getLogger(__name__) @@ -28,11 +28,11 @@ class LayerStacker(interfaces.automagic.AutomagicInterface): """Builds up layers in a single stack. This class mimics the volatility 2 style of stacking address spaces. It builds up various layers based on - separate :class:`~volatility.framework.interfaces.automagic.StackerLayerInterface` classes. These classes are + separate :class:`~volatility3.framework.interfaces.automagic.StackerLayerInterface` classes. These classes are built up based on a `stack_order` class variable each has. This has a high priority to provide other automagic modules as complete a context/configuration tree as possible. - Upon completion it will re-call the :class:`~volatility.framework.automagic.construct_layers.ConstructionMagic`, + Upon completion it will re-call the :class:`~volatility3.framework.automagic.construct_layers.ConstructionMagic`, so that any stacked layers are actually constructed and added to the context. """ # Most important automagic, must happen first! @@ -49,7 +49,7 @@ class LayerStacker(interfaces.automagic.AutomagicInterface): progress_callback: constants.ProgressCallback = None) -> Optional[List[str]]: """Runs the automagic over the configurable.""" - framework.import_files(sys.modules['volatility.framework.layers']) + framework.import_files(sys.modules['volatility3.framework.layers']) # Quick exit if we're not needed if not requirement.unsatisfied(context, config_path): @@ -250,7 +250,7 @@ def choose_os_stackers(plugin: Type[interfaces.plugins.PluginInterface]) -> List plugin_first_level = plugin.__module__.split('.')[2] # Ensure all stackers are loaded - framework.import_files(sys.modules['volatility.framework.layers']) + framework.import_files(sys.modules['volatility3.framework.layers']) result = [] for stacker in sorted(framework.class_subclasses(interfaces.automagic.StackerLayerInterface), diff --git a/volatility/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py similarity index 97% rename from volatility/framework/automagic/symbol_cache.py rename to volatility3/framework/automagic/symbol_cache.py index 89d72718f..b2407f8e9 100644 --- a/volatility/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -11,8 +11,8 @@ import urllib.parse import urllib.request from typing import Dict, List, Optional -from volatility.framework import constants, exceptions, interfaces -from volatility.framework.symbols import intermed +from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework.symbols import intermed vollog = logging.getLogger(__name__) diff --git a/volatility/framework/automagic/symbol_finder.py b/volatility3/framework/automagic/symbol_finder.py similarity index 96% rename from volatility/framework/automagic/symbol_finder.py rename to volatility3/framework/automagic/symbol_finder.py index 50844d0fa..f29976769 100644 --- a/volatility/framework/automagic/symbol_finder.py +++ b/volatility3/framework/automagic/symbol_finder.py @@ -5,10 +5,10 @@ import logging from typing import Any, Iterable, List, Tuple, Type, Optional, Callable -from volatility.framework import interfaces, constants, layers, exceptions -from volatility.framework.automagic import symbol_cache -from volatility.framework.configuration import requirements -from volatility.framework.layers import scanners +from volatility3.framework import interfaces, constants, layers, exceptions +from volatility3.framework.automagic import symbol_cache +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import scanners vollog = logging.getLogger(__name__) diff --git a/volatility/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py similarity index 98% rename from volatility/framework/automagic/windows.py rename to volatility3/framework/automagic/windows.py index d55ff8c23..198e64e99 100644 --- a/volatility/framework/automagic/windows.py +++ b/volatility3/framework/automagic/windows.py @@ -30,9 +30,9 @@ import logging import struct from typing import Any, Generator, List, Optional, Tuple, Type -from volatility.framework import interfaces, layers, constants -from volatility.framework.configuration import requirements -from volatility.framework.layers import intel +from volatility3.framework import interfaces, layers, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import intel vollog = logging.getLogger(__name__) @@ -231,7 +231,7 @@ class PageMapScanner(interfaces.layers.ScannerInterface): class WintelHelper(interfaces.automagic.AutomagicInterface): """Windows DTB finder based on self-referential pointers. - This class adheres to the :class:`~volatility.framework.interfaces.automagic.AutomagicInterface` interface + This class adheres to the :class:`~volatility3.framework.interfaces.automagic.AutomagicInterface` interface and both determines the directory table base of an intel layer if one hasn't been specified, and constructs the intel layer if necessary (for example when reconstructing a pre-existing configuration). @@ -414,7 +414,7 @@ class WinSwapLayers(interfaces.automagic.AutomagicInterface): if swap_location: context.config[current_layer_path] = current_layer_name context.config[layer_loc_path] = swap_location - context.config[layer_class_path] = 'volatility.framework.layers.physical.FileLayer' + context.config[layer_class_path] = 'volatility3.framework.layers.physical.FileLayer' # Add the requirement new_req = requirements.TranslationLayerRequirement(name = current_layer_name, diff --git a/volatility/framework/configuration/__init__.py b/volatility3/framework/configuration/__init__.py similarity index 75% rename from volatility/framework/configuration/__init__.py rename to volatility3/framework/configuration/__init__.py index 175dcf295..7a84ee455 100644 --- a/volatility/framework/configuration/__init__.py +++ b/volatility3/framework/configuration/__init__.py @@ -2,4 +2,4 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework.configuration import requirements +from volatility3.framework.configuration import requirements diff --git a/volatility/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py similarity index 99% rename from volatility/framework/configuration/requirements.py rename to volatility3/framework/configuration/requirements.py index 2b5042d43..2a8881ace 100644 --- a/volatility/framework/configuration/requirements.py +++ b/volatility3/framework/configuration/requirements.py @@ -12,7 +12,7 @@ import abc import logging from typing import Any, ClassVar, List, Optional, Type, Dict, Tuple -from volatility.framework import constants, interfaces +from volatility3.framework import constants, interfaces vollog = logging.getLogger(__name__) diff --git a/volatility/framework/constants/__init__.py b/volatility3/framework/constants/__init__.py similarity index 90% rename from volatility/framework/constants/__init__.py rename to volatility3/framework/constants/__init__.py index cc1cf3eec..9e014122b 100644 --- a/volatility/framework/constants/__init__.py +++ b/volatility3/framework/constants/__init__.py @@ -11,20 +11,20 @@ import os.path import sys from typing import Optional, Callable -import volatility.framework.constants.linux -import volatility.framework.constants.windows +import volatility3.framework.constants.linux +import volatility3.framework.constants.windows PLUGINS_PATH = [ os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "plugins")), os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "plugins")) ] -"""Default list of paths to load plugins from (volatility/plugins and volatility/framework/plugins)""" +"""Default list of paths to load plugins from (volatility3/plugins and volatility3/framework/plugins)""" SYMBOL_BASEPATHS = [ os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "symbols")), os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "symbols")) ] -"""Default list of paths to load symbols from (volatility/symbols and volatility/framework/symbols)""" +"""Default list of paths to load symbols from (volatility3/symbols and volatility3/framework/symbols)""" ISF_EXTENSIONS = ['.json', '.json.xz', '.json.gz', '.json.bz2'] """List of accepted extensions for ISF files""" @@ -44,7 +44,7 @@ VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ".".join([str(x) for x in [VERSION_MAJOR, VERSION_MINOR, VERSION_PATCH]]) + VERSION_SUFFIX -"""The canonical version of the volatility package""" +"""The canonical version of the volatility3 package""" AUTOMAGIC_CONFIG_PATH = 'automagic' """The root section within the context configuration for automagic values""" diff --git a/volatility/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py similarity index 100% rename from volatility/framework/constants/linux/__init__.py rename to volatility3/framework/constants/linux/__init__.py diff --git a/volatility/framework/constants/windows/__init__.py b/volatility3/framework/constants/windows/__init__.py similarity index 100% rename from volatility/framework/constants/windows/__init__.py rename to volatility3/framework/constants/windows/__init__.py diff --git a/volatility/framework/contexts/__init__.py b/volatility3/framework/contexts/__init__.py similarity index 97% rename from volatility/framework/contexts/__init__.py rename to volatility3/framework/contexts/__init__.py index ba23847ba..c082a29dd 100644 --- a/volatility/framework/contexts/__init__.py +++ b/volatility3/framework/contexts/__init__.py @@ -12,8 +12,8 @@ import functools import hashlib from typing import Callable, Dict, Iterable, List, Optional, Set, Tuple, Union -from volatility.framework import constants, interfaces, symbols, exceptions -from volatility.framework.objects import templates +from volatility3.framework import constants, interfaces, symbols, exceptions +from volatility3.framework.objects import templates class Context(interfaces.context.ContextInterface): @@ -25,7 +25,7 @@ class Context(interfaces.context.ContextInterface): for creating new objects. Other context objects can be constructed as long as they support the - :class:`~volatility.framework.interfaces.context.ContextInterface`. This is the primary context object to be used + :class:`~volatility3.framework.interfaces.context.ContextInterface`. This is the primary context object to be used in the volatility framework. It maintains the """ @@ -71,7 +71,7 @@ class Context(interfaces.context.ContextInterface): layer: The layer to be added to the memory Raises: - volatility.framework.exceptions.LayerException: if the layer is already present, or has + volatility3.framework.exceptions.LayerException: if the layer is already present, or has unmet dependencies """ self._memory.add_layer(layer) diff --git a/volatility/framework/exceptions.py b/volatility3/framework/exceptions.py similarity index 98% rename from volatility/framework/exceptions.py rename to volatility3/framework/exceptions.py index c92b65af5..117933bbd 100644 --- a/volatility/framework/exceptions.py +++ b/volatility3/framework/exceptions.py @@ -10,7 +10,7 @@ size of the invalid page. """ from typing import Dict, Optional -from volatility.framework import interfaces +from volatility3.framework import interfaces class VolatilityException(Exception): diff --git a/volatility/framework/interfaces/__init__.py b/volatility3/framework/interfaces/__init__.py similarity index 85% rename from volatility/framework/interfaces/__init__.py rename to volatility3/framework/interfaces/__init__.py index 17fd6f011..05cf7d837 100644 --- a/volatility/framework/interfaces/__init__.py +++ b/volatility3/framework/interfaces/__init__.py @@ -12,5 +12,5 @@ components of volatility to write plugins. # Import the submodules we want people to be able to use without importing them themselves # This will also avoid namespace issues, because people can use interfaces.layers to # avoid clashing with the layers package -from volatility.framework.interfaces import renderers, configuration, context, layers, objects, plugins, symbols, \ +from volatility3.framework.interfaces import renderers, configuration, context, layers, objects, plugins, symbols, \ automagic diff --git a/volatility/framework/interfaces/automagic.py b/volatility3/framework/interfaces/automagic.py similarity index 98% rename from volatility/framework/interfaces/automagic.py rename to volatility3/framework/interfaces/automagic.py index ee4dad053..c6eb2e5ce 100644 --- a/volatility/framework/interfaces/automagic.py +++ b/volatility3/framework/interfaces/automagic.py @@ -11,8 +11,8 @@ import logging from abc import ABCMeta from typing import Any, List, Optional, Tuple, Union, Type -from volatility.framework import interfaces, constants -from volatility.framework.configuration import requirements +from volatility3.framework import interfaces, constants +from volatility3.framework.configuration import requirements vollog = logging.getLogger(__name__) diff --git a/volatility/framework/interfaces/configuration.py b/volatility3/framework/interfaces/configuration.py similarity index 98% rename from volatility/framework/interfaces/configuration.py rename to volatility3/framework/interfaces/configuration.py index a52b9984f..418763d6d 100644 --- a/volatility/framework/interfaces/configuration.py +++ b/volatility3/framework/interfaces/configuration.py @@ -25,8 +25,8 @@ import sys from abc import ABCMeta, abstractmethod from typing import Any, ClassVar, Dict, Generator, Iterator, List, Optional, Type, Union, Tuple -from volatility import classproperty -from volatility.framework import constants, interfaces +from volatility3 import classproperty +from volatility3.framework import constants, interfaces CONFIG_SEPARATOR = "." """Use to specify the separator between configuration hierarchies""" @@ -292,10 +292,10 @@ class RequirementInterface(metaclass = ABCMeta): A requirement is a means for plugins and other framework components to request specific configuration data. Requirements can either be simple types (such as - :class:`~volatility.framework.configuration.requirements.SimpleTypeRequirement`, - :class:`~volatility.framework.configuration.requirements.IntRequirement`, - :class:`~volatility.framework.configuration.requirements.BytesRequirement` and - :class:`~volatility.framework.configuration.requirements.StringRequirement`) or complex types (such + :class:`~volatility3.framework.configuration.requirements.SimpleTypeRequirement`, + :class:`~volatility3.framework.configuration.requirements.IntRequirement`, + :class:`~volatility3.framework.configuration.requirements.BytesRequirement` and + :class:`~volatility3.framework.configuration.requirements.StringRequirement`) or complex types (such as :class:`TranslationLayerRequirement`, :class:`SymbolTableRequirement` and :class:`ClassRequirement` """ diff --git a/volatility/framework/interfaces/context.py b/volatility3/framework/interfaces/context.py similarity index 98% rename from volatility/framework/interfaces/context.py rename to volatility3/framework/interfaces/context.py index 0dff023c1..6fede426a 100644 --- a/volatility/framework/interfaces/context.py +++ b/volatility3/framework/interfaces/context.py @@ -15,7 +15,7 @@ import copy from abc import ABCMeta, abstractmethod from typing import Optional, Union -from volatility.framework import interfaces +from volatility3.framework import interfaces class ContextInterface(metaclass = ABCMeta): @@ -39,7 +39,7 @@ class ContextInterface(metaclass = ABCMeta): def symbol_space(self) -> 'interfaces.symbols.SymbolSpaceInterface': """Returns the symbol_space for the context. - This object must support the :class:`~volatility.framework.interfaces.symbols.SymbolSpaceInterface` + This object must support the :class:`~volatility3.framework.interfaces.symbols.SymbolSpaceInterface` """ # ## Memory Functions diff --git a/volatility/framework/interfaces/layers.py b/volatility3/framework/interfaces/layers.py similarity index 99% rename from volatility/framework/interfaces/layers.py rename to volatility3/framework/interfaces/layers.py index 49d6920aa..56426331e 100644 --- a/volatility/framework/interfaces/layers.py +++ b/volatility3/framework/interfaces/layers.py @@ -18,7 +18,7 @@ import types from abc import ABCMeta, abstractmethod from typing import Any, Callable, Dict, Iterable, List, Mapping, Optional, Tuple, Union -from volatility.framework import constants, exceptions, interfaces +from volatility3.framework import constants, exceptions, interfaces vollog = logging.getLogger(__name__) diff --git a/volatility/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py similarity index 99% rename from volatility/framework/interfaces/objects.py rename to volatility3/framework/interfaces/objects.py index 88e6c061f..2f794b565 100644 --- a/volatility/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -9,7 +9,7 @@ import collections.abc import logging from typing import Any, Dict, List, Mapping, Optional -from volatility.framework import constants, interfaces +from volatility3.framework import constants, interfaces vollog = logging.getLogger(__name__) @@ -281,7 +281,7 @@ class Template: @property def vol(self) -> ReadOnlyMapping: """Returns a volatility information object, much like the - :class:`~volatility.framework.interfaces.objects.ObjectInformation` + :class:`~volatility3.framework.interfaces.objects.ObjectInformation` provides.""" return ReadOnlyMapping(self._vol) diff --git a/volatility/framework/interfaces/plugins.py b/volatility3/framework/interfaces/plugins.py similarity index 98% rename from volatility/framework/interfaces/plugins.py rename to volatility3/framework/interfaces/plugins.py index c3fbbf65a..3ab602903 100644 --- a/volatility/framework/interfaces/plugins.py +++ b/volatility3/framework/interfaces/plugins.py @@ -14,8 +14,8 @@ import os from abc import ABCMeta, abstractmethod from typing import List, Tuple, Type -from volatility import framework -from volatility.framework import exceptions, constants, interfaces +from volatility3 import framework +from volatility3.framework import exceptions, constants, interfaces vollog = logging.getLogger(__name__) diff --git a/volatility/framework/interfaces/renderers.py b/volatility3/framework/interfaces/renderers.py similarity index 100% rename from volatility/framework/interfaces/renderers.py rename to volatility3/framework/interfaces/renderers.py diff --git a/volatility/framework/interfaces/symbols.py b/volatility3/framework/interfaces/symbols.py similarity index 98% rename from volatility/framework/interfaces/symbols.py rename to volatility3/framework/interfaces/symbols.py index 77d00337d..8f427d233 100644 --- a/volatility/framework/interfaces/symbols.py +++ b/volatility3/framework/interfaces/symbols.py @@ -7,10 +7,10 @@ import collections.abc from abc import abstractmethod, ABC from typing import Any, Dict, Iterable, List, Optional, Tuple, Type, Mapping -from volatility.framework import constants, exceptions, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import configuration, objects -from volatility.framework.interfaces.configuration import RequirementInterface +from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import configuration, objects +from volatility3.framework.interfaces.configuration import RequirementInterface class SymbolInterface: diff --git a/volatility/framework/layers/__init__.py b/volatility3/framework/layers/__init__.py similarity index 100% rename from volatility/framework/layers/__init__.py rename to volatility3/framework/layers/__init__.py diff --git a/volatility/framework/layers/codecs/__init__.py b/volatility3/framework/layers/codecs/__init__.py similarity index 100% rename from volatility/framework/layers/codecs/__init__.py rename to volatility3/framework/layers/codecs/__init__.py diff --git a/volatility/framework/layers/crash.py b/volatility3/framework/layers/crash.py similarity index 98% rename from volatility/framework/layers/crash.py rename to volatility3/framework/layers/crash.py index 9f239fd13..8909eceb8 100644 --- a/volatility/framework/layers/crash.py +++ b/volatility3/framework/layers/crash.py @@ -6,9 +6,9 @@ import logging import struct from typing import Tuple, Optional -from volatility.framework import constants, exceptions, interfaces -from volatility.framework.layers import segmented -from volatility.framework.symbols import intermed +from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework.layers import segmented +from volatility3.framework.symbols import intermed vollog = logging.getLogger(__name__) diff --git a/volatility/framework/layers/elf.py b/volatility3/framework/layers/elf.py similarity index 95% rename from volatility/framework/layers/elf.py rename to volatility3/framework/layers/elf.py index 022fc4968..48876c286 100644 --- a/volatility/framework/layers/elf.py +++ b/volatility3/framework/layers/elf.py @@ -5,9 +5,9 @@ import logging import struct from typing import Optional -from volatility.framework import exceptions, interfaces, constants -from volatility.framework.layers import segmented -from volatility.framework.symbols import intermed +from volatility3.framework import exceptions, interfaces, constants +from volatility3.framework.layers import segmented +from volatility3.framework.symbols import intermed vollog = logging.getLogger(__name__) diff --git a/volatility/framework/layers/intel.py b/volatility3/framework/layers/intel.py similarity index 98% rename from volatility/framework/layers/intel.py rename to volatility3/framework/layers/intel.py index cdff9ce7e..cf78bbcd1 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -9,10 +9,10 @@ import math import struct from typing import Any, Dict, Iterable, List, Optional, Tuple -from volatility import classproperty -from volatility.framework import exceptions, interfaces, constants -from volatility.framework.configuration import requirements -from volatility.framework.layers import linear +from volatility3 import classproperty +from volatility3.framework import exceptions, interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import linear vollog = logging.getLogger(__name__) diff --git a/volatility/framework/layers/lime.py b/volatility3/framework/layers/lime.py similarity index 96% rename from volatility/framework/layers/lime.py rename to volatility3/framework/layers/lime.py index 45e2ac9dc..ae93f7b7a 100644 --- a/volatility/framework/layers/lime.py +++ b/volatility3/framework/layers/lime.py @@ -5,8 +5,8 @@ import struct from typing import Optional, Tuple -from volatility.framework import exceptions, interfaces, constants -from volatility.framework.layers import segmented +from volatility3.framework import exceptions, interfaces, constants +from volatility3.framework.layers import segmented class LimeFormatException(exceptions.LayerException): diff --git a/volatility/framework/layers/linear.py b/volatility3/framework/layers/linear.py similarity index 98% rename from volatility/framework/layers/linear.py rename to volatility3/framework/layers/linear.py index 84ec081ea..80f71ec35 100644 --- a/volatility/framework/layers/linear.py +++ b/volatility3/framework/layers/linear.py @@ -1,7 +1,7 @@ import functools from typing import List, Optional, Tuple, Iterable -from volatility.framework import exceptions, interfaces +from volatility3.framework import exceptions, interfaces class LinearlyMappedLayer(interfaces.layers.TranslationLayerInterface): diff --git a/volatility/framework/layers/msf.py b/volatility3/framework/layers/msf.py similarity index 97% rename from volatility/framework/layers/msf.py rename to volatility3/framework/layers/msf.py index c030b5354..442ba8728 100644 --- a/volatility/framework/layers/msf.py +++ b/volatility3/framework/layers/msf.py @@ -4,11 +4,11 @@ import math from typing import Optional, Dict, Any, List, Iterable, Tuple -from volatility.framework import interfaces, constants, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import linear -from volatility.framework.objects import utility -from volatility.framework.symbols import intermed +from volatility3.framework import interfaces, constants, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import linear +from volatility3.framework.objects import utility +from volatility3.framework.symbols import intermed class PDBFormatException(exceptions.LayerException): diff --git a/volatility/framework/layers/physical.py b/volatility3/framework/layers/physical.py similarity index 97% rename from volatility/framework/layers/physical.py rename to volatility3/framework/layers/physical.py index a75e08065..7e4e76a6e 100644 --- a/volatility/framework/layers/physical.py +++ b/volatility3/framework/layers/physical.py @@ -4,9 +4,9 @@ import threading from typing import Any, Dict, IO, List, Optional, Union -from volatility.framework import exceptions, interfaces, constants -from volatility.framework.configuration import requirements -from volatility.framework.layers import resources +from volatility3.framework import exceptions, interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import resources class BufferDataLayer(interfaces.layers.DataLayerInterface): diff --git a/volatility/framework/layers/qemu.py b/volatility3/framework/layers/qemu.py similarity index 98% rename from volatility/framework/layers/qemu.py rename to volatility3/framework/layers/qemu.py index d5f926639..8a2621fa8 100644 --- a/volatility/framework/layers/qemu.py +++ b/volatility3/framework/layers/qemu.py @@ -6,9 +6,9 @@ import json import math from typing import Optional, Dict, Any, Tuple, List, Set -from volatility.framework import interfaces, exceptions, constants -from volatility.framework.layers import segmented -from volatility.framework.symbols import intermed +from volatility3.framework import interfaces, exceptions, constants +from volatility3.framework.layers import segmented +from volatility3.framework.symbols import intermed class QemuSuspendLayer(segmented.NonLinearlySegmentedLayer): diff --git a/volatility/framework/layers/registry.py b/volatility3/framework/layers/registry.py similarity index 96% rename from volatility/framework/layers/registry.py rename to volatility3/framework/layers/registry.py index 82128b4f4..32acbc4a9 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -5,13 +5,13 @@ import logging from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple, Union -from volatility.framework import constants, exceptions, interfaces, objects -from volatility.framework.configuration import requirements -from volatility.framework.configuration.requirements import IntRequirement, TranslationLayerRequirement -from volatility.framework.exceptions import InvalidAddressException -from volatility.framework.layers import linear -from volatility.framework.symbols import intermed -from volatility.plugins.windows import pslist +from volatility3.framework import constants, exceptions, interfaces, objects +from volatility3.framework.configuration import requirements +from volatility3.framework.configuration.requirements import IntRequirement, TranslationLayerRequirement +from volatility3.framework.exceptions import InvalidAddressException +from volatility3.framework.layers import linear +from volatility3.framework.symbols import intermed +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/layers/resources.py b/volatility3/framework/layers/resources.py similarity index 99% rename from volatility/framework/layers/resources.py rename to volatility3/framework/layers/resources.py index 1a2402008..d99f7135c 100644 --- a/volatility/framework/layers/resources.py +++ b/volatility3/framework/layers/resources.py @@ -16,8 +16,8 @@ import zipfile from typing import Optional, Any, IO from urllib import error -from volatility import framework -from volatility.framework import constants +from volatility3 import framework +from volatility3.framework import constants try: import magic diff --git a/volatility/framework/layers/scanners/__init__.py b/volatility3/framework/layers/scanners/__init__.py similarity index 94% rename from volatility/framework/layers/scanners/__init__.py rename to volatility3/framework/layers/scanners/__init__.py index 45208161d..3b57d32e4 100644 --- a/volatility/framework/layers/scanners/__init__.py +++ b/volatility3/framework/layers/scanners/__init__.py @@ -5,8 +5,8 @@ import re from typing import Generator, List, Tuple -from volatility.framework.interfaces import layers -from volatility.framework.layers.scanners import multiregexp +from volatility3.framework.interfaces import layers +from volatility3.framework.layers.scanners import multiregexp class BytesScanner(layers.ScannerInterface): diff --git a/volatility/framework/layers/scanners/multiregexp.py b/volatility3/framework/layers/scanners/multiregexp.py similarity index 100% rename from volatility/framework/layers/scanners/multiregexp.py rename to volatility3/framework/layers/scanners/multiregexp.py diff --git a/volatility/framework/layers/segmented.py b/volatility3/framework/layers/segmented.py similarity index 97% rename from volatility/framework/layers/segmented.py rename to volatility3/framework/layers/segmented.py index d2f80ec32..8334c722d 100644 --- a/volatility/framework/layers/segmented.py +++ b/volatility3/framework/layers/segmented.py @@ -5,9 +5,9 @@ from abc import ABCMeta, abstractmethod from bisect import bisect_right from typing import Any, Dict, Iterable, List, Optional, Tuple -from volatility.framework import exceptions, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.layers import linear +from volatility3.framework import exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import linear class NonLinearlySegmentedLayer(interfaces.layers.TranslationLayerInterface, metaclass = ABCMeta): diff --git a/volatility/framework/layers/vmware.py b/volatility3/framework/layers/vmware.py similarity index 96% rename from volatility/framework/layers/vmware.py rename to volatility3/framework/layers/vmware.py index fc412fb2e..e0d6b172d 100644 --- a/volatility/framework/layers/vmware.py +++ b/volatility3/framework/layers/vmware.py @@ -5,10 +5,10 @@ import struct from typing import Any, Dict, List, Optional -from volatility.framework import interfaces, constants, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import physical, segmented, resources -from volatility.framework.symbols import native +from volatility3.framework import interfaces, constants, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import physical, segmented, resources +from volatility3.framework.symbols import native class VmwareFormatException(exceptions.LayerException): diff --git a/volatility/framework/objects/__init__.py b/volatility3/framework/objects/__init__.py similarity index 99% rename from volatility/framework/objects/__init__.py rename to volatility3/framework/objects/__init__.py index 30bbcbe74..6504b1259 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility3/framework/objects/__init__.py @@ -7,8 +7,8 @@ import logging import struct from typing import Any, ClassVar, Dict, List, Iterable, Optional, Tuple, Type, Union as TUnion, overload -from volatility.framework import interfaces, constants -from volatility.framework.objects import templates, utility +from volatility3.framework import interfaces, constants +from volatility3.framework.objects import templates, utility vollog = logging.getLogger(__name__) diff --git a/volatility/framework/objects/templates.py b/volatility3/framework/objects/templates.py similarity index 91% rename from volatility/framework/objects/templates.py rename to volatility3/framework/objects/templates.py index c19bc07e7..05938ff9c 100644 --- a/volatility/framework/objects/templates.py +++ b/volatility3/framework/objects/templates.py @@ -5,7 +5,7 @@ import functools import logging from typing import Any, ClassVar, Dict, List, Type -from volatility.framework import interfaces, exceptions, constants +from volatility3.framework import interfaces, exceptions, constants vollog = logging.getLogger(__name__) @@ -44,13 +44,13 @@ class ObjectTemplate(interfaces.objects.Template): def relative_child_offset(self, child: str) -> int: """Returns the relative offset of a child of the templated object (see - :class:`~volatility.framework.interfaces.objects.ObjectInterface.VolTem + :class:`~volatility3.framework.interfaces.objects.ObjectInterface.VolTem plateProxy`)""" return self.vol.object_class.VolTemplateProxy.relative_child_offset(self, child) def replace_child(self, old_child: interfaces.objects.Template, new_child: interfaces.objects.Template) -> None: """Replaces `old_child` for `new_child` in the templated object's child - list (see :class:`~volatility.framework.interfaces.objects.ObjectInterf + list (see :class:`~volatility3.framework.interfaces.objects.ObjectInterf ace.VolTemplateProxy`)""" return self.vol.object_class.VolTemplateProxy.replace_child(self, old_child, new_child) @@ -63,7 +63,7 @@ class ObjectTemplate(interfaces.objects.Template): object_info: interfaces.objects.ObjectInformation) -> interfaces.objects.ObjectInterface: """Constructs the object. - Returns: an object adhereing to the :class:`~volatility.framework.interfaces.objects.ObjectInterface` + Returns: an object adhereing to the :class:`~volatility3.framework.interfaces.objects.ObjectInterface` """ arguments = {} # type: Dict[str, Any] for arg in self.vol: @@ -76,7 +76,7 @@ class ReferenceTemplate(interfaces.objects.Template): """Factory class that produces objects based on a delayed reference type. Attempts to access any standard attributes of a resolved template will result in a - :class:`~volatility.framework.exceptions.SymbolError`. + :class:`~volatility3.framework.exceptions.SymbolError`. """ @property diff --git a/volatility/framework/objects/utility.py b/volatility3/framework/objects/utility.py similarity index 97% rename from volatility/framework/objects/utility.py rename to volatility3/framework/objects/utility.py index e3795aa78..9c4b59575 100644 --- a/volatility/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -4,7 +4,7 @@ from typing import Optional, Union -from volatility.framework import interfaces, objects, constants +from volatility3.framework import interfaces, objects, constants def array_to_string(array: 'objects.Array', diff --git a/volatility/framework/plugins/__init__.py b/volatility3/framework/plugins/__init__.py similarity index 93% rename from volatility/framework/plugins/__init__.py rename to volatility3/framework/plugins/__init__.py index b00b4ea47..aa9701a4c 100644 --- a/volatility/framework/plugins/__init__.py +++ b/volatility3/framework/plugins/__init__.py @@ -3,14 +3,14 @@ # """All core generic plugins. -These modules should only be imported from volatility.plugins NOT -volatility.framework.plugins +These modules should only be imported from volatility3.plugins NOT +volatility3.framework.plugins """ import logging from typing import List, Type -from volatility.framework import interfaces, automagic, exceptions, constants +from volatility3.framework import interfaces, automagic, exceptions, constants vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/banners.py b/volatility3/framework/plugins/banners.py similarity index 89% rename from volatility/framework/plugins/banners.py rename to volatility3/framework/plugins/banners.py index b7b439aa8..ac2006207 100644 --- a/volatility/framework/plugins/banners.py +++ b/volatility3/framework/plugins/banners.py @@ -4,10 +4,10 @@ import logging from typing import List -from volatility.framework import interfaces, renderers, layers -from volatility.framework.configuration import requirements -from volatility.framework.layers import scanners -from volatility.framework.renderers import format_hints +from volatility3.framework import interfaces, renderers, layers +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import scanners +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/configwriter.py b/volatility3/framework/plugins/configwriter.py similarity index 92% rename from volatility/framework/plugins/configwriter.py rename to volatility3/framework/plugins/configwriter.py index 3d44edfe5..3c2da6ce3 100644 --- a/volatility/framework/plugins/configwriter.py +++ b/volatility3/framework/plugins/configwriter.py @@ -6,9 +6,9 @@ import json import logging from typing import List -from volatility.framework import renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins +from volatility3.framework import renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/frameworkinfo.py b/volatility3/framework/plugins/frameworkinfo.py similarity index 88% rename from volatility/framework/plugins/frameworkinfo.py rename to volatility3/framework/plugins/frameworkinfo.py index 52e85d0a2..b7c887d5c 100644 --- a/volatility/framework/plugins/frameworkinfo.py +++ b/volatility3/framework/plugins/frameworkinfo.py @@ -1,8 +1,8 @@ from typing import List -from volatility import framework -from volatility.framework import interfaces, renderers -from volatility.framework.interfaces import plugins +from volatility3 import framework +from volatility3.framework import interfaces, renderers +from volatility3.framework.interfaces import plugins class FrameworkInfo(plugins.PluginInterface): diff --git a/volatility/framework/plugins/isfinfo.py b/volatility3/framework/plugins/isfinfo.py similarity index 94% rename from volatility/framework/plugins/isfinfo.py rename to volatility3/framework/plugins/isfinfo.py index 41cecc1e9..929c95cdf 100644 --- a/volatility/framework/plugins/isfinfo.py +++ b/volatility3/framework/plugins/isfinfo.py @@ -9,12 +9,12 @@ import pathlib import zipfile from typing import List, Type, Any, Generator -from volatility import schemas, symbols -from volatility.framework import interfaces, renderers, constants -from volatility.framework.automagic import mac, linux, symbol_cache -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.layers import resources +from volatility3 import schemas, symbols +from volatility3.framework import interfaces, renderers, constants +from volatility3.framework.automagic import mac, linux, symbol_cache +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.layers import resources vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/layerwriter.py b/volatility3/framework/plugins/layerwriter.py similarity index 96% rename from volatility/framework/plugins/layerwriter.py rename to volatility3/framework/plugins/layerwriter.py index 5b4492c6c..53f07701f 100644 --- a/volatility/framework/plugins/layerwriter.py +++ b/volatility3/framework/plugins/layerwriter.py @@ -5,9 +5,9 @@ import logging from typing import List, Optional, Type -from volatility.framework import renderers, interfaces, constants, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins +from volatility3.framework import renderers, interfaces, constants, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/linux/__init__.py b/volatility3/framework/plugins/linux/__init__.py similarity index 69% rename from volatility/framework/plugins/linux/__init__.py rename to volatility3/framework/plugins/linux/__init__.py index 24e0d3c1e..3932a6f51 100644 --- a/volatility/framework/plugins/linux/__init__.py +++ b/volatility3/framework/plugins/linux/__init__.py @@ -3,6 +3,6 @@ # """All core linux plugins. -These modules should only be imported from volatility.plugins NOT -volatility.framework.plugins +These modules should only be imported from volatility3.plugins NOT +volatility3.framework.plugins """ diff --git a/volatility/framework/plugins/linux/bash.py b/volatility3/framework/plugins/linux/bash.py similarity index 91% rename from volatility/framework/plugins/linux/bash.py rename to volatility3/framework/plugins/linux/bash.py index 82fdd90dc..9d43a59d3 100644 --- a/volatility/framework/plugins/linux/bash.py +++ b/volatility3/framework/plugins/linux/bash.py @@ -8,14 +8,14 @@ import datetime import struct from typing import List -from volatility.framework import constants, renderers, symbols, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.layers import scanners -from volatility.framework.objects import utility -from volatility.framework.symbols.linux.bash import BashIntermedSymbols -from volatility.plugins import timeliner -from volatility.plugins.linux import pslist +from volatility3.framework import constants, renderers, symbols, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.layers import scanners +from volatility3.framework.objects import utility +from volatility3.framework.symbols.linux.bash import BashIntermedSymbols +from volatility3.plugins import timeliner +from volatility3.plugins.linux import pslist class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): diff --git a/volatility/framework/plugins/linux/check_afinfo.py b/volatility3/framework/plugins/linux/check_afinfo.py similarity index 92% rename from volatility/framework/plugins/linux/check_afinfo.py rename to volatility3/framework/plugins/linux/check_afinfo.py index c3361b966..1b38fe9be 100644 --- a/volatility/framework/plugins/linux/check_afinfo.py +++ b/volatility3/framework/plugins/linux/check_afinfo.py @@ -6,11 +6,11 @@ found in Linux's /proc file system.""" import logging from typing import List -from volatility.framework import exceptions, interfaces, contexts -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints +from volatility3.framework import exceptions, interfaces, contexts +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/linux/check_creds.py b/volatility3/framework/plugins/linux/check_creds.py similarity index 92% rename from volatility/framework/plugins/linux/check_creds.py rename to volatility3/framework/plugins/linux/check_creds.py index 7d68bf644..0d87bce2a 100644 --- a/volatility/framework/plugins/linux/check_creds.py +++ b/volatility3/framework/plugins/linux/check_creds.py @@ -4,9 +4,9 @@ import logging -from volatility.framework import interfaces, renderers, constants -from volatility.framework.configuration import requirements -from volatility.plugins.linux import pslist +from volatility3.framework import interfaces, renderers, constants +from volatility3.framework.configuration import requirements +from volatility3.plugins.linux import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/linux/check_idt.py b/volatility3/framework/plugins/linux/check_idt.py similarity index 92% rename from volatility/framework/plugins/linux/check_idt.py rename to volatility3/framework/plugins/linux/check_idt.py index 4da33e8d8..0e021bb5c 100644 --- a/volatility/framework/plugins/linux/check_idt.py +++ b/volatility3/framework/plugins/linux/check_idt.py @@ -5,11 +5,11 @@ import logging from typing import List -from volatility.framework import interfaces, renderers, contexts, symbols -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import linux -from volatility.plugins.linux import lsmod +from volatility3.framework import interfaces, renderers, contexts, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import linux +from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py similarity index 88% rename from volatility/framework/plugins/linux/check_modules.py rename to volatility3/framework/plugins/linux/check_modules.py index 470ce0a2f..bdd8d921d 100644 --- a/volatility/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -5,12 +5,12 @@ import logging from typing import List -from volatility.framework import interfaces, renderers, exceptions, constants, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.linux import lsmod +from volatility3.framework import interfaces, renderers, exceptions, constants, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/linux/check_syscall.py b/volatility3/framework/plugins/linux/check_syscall.py similarity index 95% rename from volatility/framework/plugins/linux/check_syscall.py rename to volatility3/framework/plugins/linux/check_syscall.py index 30843077a..4a4381b8b 100644 --- a/volatility/framework/plugins/linux/check_syscall.py +++ b/volatility3/framework/plugins/linux/check_syscall.py @@ -6,11 +6,11 @@ found in Linux's /proc file system.""" import logging from typing import List -from volatility.framework import exceptions, interfaces, contexts -from volatility.framework import renderers, constants -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints +from volatility3.framework import exceptions, interfaces, contexts +from volatility3.framework import renderers, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/linux/elfs.py b/volatility3/framework/plugins/linux/elfs.py similarity index 89% rename from volatility/framework/plugins/linux/elfs.py rename to volatility3/framework/plugins/linux/elfs.py index da9281ec3..ac8b9fbfb 100644 --- a/volatility/framework/plugins/linux/elfs.py +++ b/volatility3/framework/plugins/linux/elfs.py @@ -6,12 +6,12 @@ found in Linux's /proc file system.""" from typing import List -from volatility.framework import renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.linux import pslist +from volatility3.framework import renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.linux import pslist class Elfs(plugins.PluginInterface): diff --git a/volatility/framework/plugins/linux/keyboard_notifiers.py b/volatility3/framework/plugins/linux/keyboard_notifiers.py similarity index 90% rename from volatility/framework/plugins/linux/keyboard_notifiers.py rename to volatility3/framework/plugins/linux/keyboard_notifiers.py index 7580b368b..cd7a70b34 100644 --- a/volatility/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility3/framework/plugins/linux/keyboard_notifiers.py @@ -4,11 +4,11 @@ import logging -from volatility.framework import interfaces, renderers, contexts, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import linux -from volatility.plugins.linux import lsmod +from volatility3.framework import interfaces, renderers, contexts, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import linux +from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py similarity index 89% rename from volatility/framework/plugins/linux/lsmod.py rename to volatility3/framework/plugins/linux/lsmod.py index ada3002a4..d75a9dff4 100644 --- a/volatility/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -7,12 +7,12 @@ found in Linux's /proc file system.""" import logging from typing import List, Iterable -from volatility.framework import contexts -from volatility.framework import exceptions, renderers, constants, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints +from volatility3.framework import contexts +from volatility3.framework import exceptions, renderers, constants, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/linux/lsof.py b/volatility3/framework/plugins/linux/lsof.py similarity index 89% rename from volatility/framework/plugins/linux/lsof.py rename to volatility3/framework/plugins/linux/lsof.py index 1ea348b19..b9a686a44 100644 --- a/volatility/framework/plugins/linux/lsof.py +++ b/volatility3/framework/plugins/linux/lsof.py @@ -6,12 +6,12 @@ found in Linux's /proc file system.""" import logging from typing import List -from volatility.framework import renderers, interfaces, constants -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.symbols import linux -from volatility.plugins.linux import pslist +from volatility3.framework import renderers, interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.symbols import linux +from volatility3.plugins.linux import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py similarity index 91% rename from volatility/framework/plugins/linux/malfind.py rename to volatility3/framework/plugins/linux/malfind.py index 0da89025f..41339cca2 100644 --- a/volatility/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -4,12 +4,12 @@ from typing import List -from volatility.framework import constants, interfaces -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.linux import pslist +from volatility3.framework import constants, interfaces +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.linux import pslist class Malfind(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/linux/proc.py b/volatility3/framework/plugins/linux/proc.py similarity index 91% rename from volatility/framework/plugins/linux/proc.py rename to volatility3/framework/plugins/linux/proc.py index 6b73f2352..53e9297de 100644 --- a/volatility/framework/plugins/linux/proc.py +++ b/volatility3/framework/plugins/linux/proc.py @@ -4,12 +4,12 @@ """A module containing a collection of plugins that produce data typically found in Linux's /proc file system.""" -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.linux import pslist +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.linux import pslist class Maps(plugins.PluginInterface): diff --git a/volatility/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py similarity index 95% rename from volatility/framework/plugins/linux/pslist.py rename to volatility3/framework/plugins/linux/pslist.py index 8a60d58c4..4c6d294e1 100644 --- a/volatility/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -4,9 +4,9 @@ from typing import Callable, Iterable, List, Any -from volatility.framework import renderers, interfaces, contexts -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility +from volatility3.framework import renderers, interfaces, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility class PsList(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/linux/pstree.py b/volatility3/framework/plugins/linux/pstree.py similarity index 95% rename from volatility/framework/plugins/linux/pstree.py rename to volatility3/framework/plugins/linux/pstree.py index c1e832950..ff47be760 100644 --- a/volatility/framework/plugins/linux/pstree.py +++ b/volatility3/framework/plugins/linux/pstree.py @@ -2,8 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework.objects import utility -from volatility.plugins.linux import pslist +from volatility3.framework.objects import utility +from volatility3.plugins.linux import pslist class PsTree(pslist.PsList): diff --git a/volatility/framework/plugins/linux/tty_check.py b/volatility3/framework/plugins/linux/tty_check.py similarity index 88% rename from volatility/framework/plugins/linux/tty_check.py rename to volatility3/framework/plugins/linux/tty_check.py index 90959d6a2..3693b6150 100644 --- a/volatility/framework/plugins/linux/tty_check.py +++ b/volatility3/framework/plugins/linux/tty_check.py @@ -5,13 +5,13 @@ import logging from typing import List -from volatility.framework import interfaces, renderers, exceptions, constants, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import linux -from volatility.plugins.linux import lsmod +from volatility3.framework import interfaces, renderers, exceptions, constants, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import linux +from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/__init__.py b/volatility3/framework/plugins/mac/__init__.py similarity index 100% rename from volatility/framework/plugins/mac/__init__.py rename to volatility3/framework/plugins/mac/__init__.py diff --git a/volatility/framework/plugins/mac/bash.py b/volatility3/framework/plugins/mac/bash.py similarity index 92% rename from volatility/framework/plugins/mac/bash.py rename to volatility3/framework/plugins/mac/bash.py index 9c923d33c..3540db6fb 100644 --- a/volatility/framework/plugins/mac/bash.py +++ b/volatility3/framework/plugins/mac/bash.py @@ -7,14 +7,14 @@ found in mac's /proc file system.""" import datetime import struct -from volatility.framework import constants, renderers, symbols -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.layers import scanners -from volatility.framework.objects import utility -from volatility.framework.symbols.linux.bash import BashIntermedSymbols -from volatility.plugins import timeliner -from volatility.plugins.mac import pslist +from volatility3.framework import constants, renderers, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.layers import scanners +from volatility3.framework.objects import utility +from volatility3.framework.symbols.linux.bash import BashIntermedSymbols +from volatility3.plugins import timeliner +from volatility3.plugins.mac import pslist class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): diff --git a/volatility/framework/plugins/mac/check_syscall.py b/volatility3/framework/plugins/mac/check_syscall.py similarity index 87% rename from volatility/framework/plugins/mac/check_syscall.py rename to volatility3/framework/plugins/mac/check_syscall.py index f1e0dc5d1..530e2f031 100644 --- a/volatility/framework/plugins/mac/check_syscall.py +++ b/volatility3/framework/plugins/mac/check_syscall.py @@ -4,13 +4,13 @@ import logging from typing import List -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/check_sysctl.py b/volatility3/framework/plugins/mac/check_sysctl.py similarity index 90% rename from volatility/framework/plugins/mac/check_sysctl.py rename to volatility3/framework/plugins/mac/check_sysctl.py index 5923430bb..2096b291a 100644 --- a/volatility/framework/plugins/mac/check_sysctl.py +++ b/volatility3/framework/plugins/mac/check_sysctl.py @@ -4,15 +4,15 @@ import logging from typing import List -import volatility -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +import volatility3 +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) @@ -55,7 +55,7 @@ class Check_sysctl(plugins.PluginInterface): return var_str def _process_sysctl_list(self, kernel, sysctl_list, recursive = 0): - if type(sysctl_list) == volatility.framework.objects.Pointer: + if type(sysctl_list) == volatility3.framework.objects.Pointer: sysctl_list = sysctl_list.dereference().cast("sysctl_oid_list") sysctl = sysctl_list.slh_first diff --git a/volatility/framework/plugins/mac/check_trap_table.py b/volatility3/framework/plugins/mac/check_trap_table.py similarity index 86% rename from volatility/framework/plugins/mac/check_trap_table.py rename to volatility3/framework/plugins/mac/check_trap_table.py index 99b509f40..b2861d5d5 100644 --- a/volatility/framework/plugins/mac/check_trap_table.py +++ b/volatility3/framework/plugins/mac/check_trap_table.py @@ -5,13 +5,13 @@ import logging from typing import List -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/ifconfig.py b/volatility3/framework/plugins/mac/ifconfig.py similarity index 88% rename from volatility/framework/plugins/mac/ifconfig.py rename to volatility3/framework/plugins/mac/ifconfig.py index 8bcfe7377..501ba8a56 100644 --- a/volatility/framework/plugins/mac/ifconfig.py +++ b/volatility3/framework/plugins/mac/ifconfig.py @@ -1,11 +1,11 @@ # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import exceptions, renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.symbols import mac +from volatility3.framework import exceptions, renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.symbols import mac class Ifconfig(plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/kauth_listeners.py b/volatility3/framework/plugins/mac/kauth_listeners.py similarity index 88% rename from volatility/framework/plugins/mac/kauth_listeners.py rename to volatility3/framework/plugins/mac/kauth_listeners.py index ec784f585..f4bbeaa4c 100644 --- a/volatility/framework/plugins/mac/kauth_listeners.py +++ b/volatility3/framework/plugins/mac/kauth_listeners.py @@ -2,12 +2,12 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import renderers, interfaces, contexts -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod, kauth_scopes +from volatility3.framework import renderers, interfaces, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod, kauth_scopes class Kauth_listeners(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/kauth_scopes.py b/volatility3/framework/plugins/mac/kauth_scopes.py similarity index 90% rename from volatility/framework/plugins/mac/kauth_scopes.py rename to volatility3/framework/plugins/mac/kauth_scopes.py index 9a9db6909..d63c72322 100644 --- a/volatility/framework/plugins/mac/kauth_scopes.py +++ b/volatility3/framework/plugins/mac/kauth_scopes.py @@ -4,12 +4,12 @@ from typing import Iterable, Callable, Tuple -from volatility.framework import renderers, interfaces, contexts -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +from volatility3.framework import renderers, interfaces, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod class Kauth_scopes(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/kevents.py b/volatility3/framework/plugins/mac/kevents.py similarity index 95% rename from volatility/framework/plugins/mac/kevents.py rename to volatility3/framework/plugins/mac/kevents.py index b3826ccfd..45bb29305 100644 --- a/volatility/framework/plugins/mac/kevents.py +++ b/volatility3/framework/plugins/mac/kevents.py @@ -4,11 +4,11 @@ from typing import Iterable, Callable, Tuple -from volatility.framework import renderers, interfaces, exceptions, contexts -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.symbols import mac -from volatility.plugins.mac import pslist +from volatility3.framework import renderers, interfaces, exceptions, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import pslist class Kevents(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/list_files.py b/volatility3/framework/plugins/mac/list_files.py similarity index 93% rename from volatility/framework/plugins/mac/list_files.py rename to volatility3/framework/plugins/mac/list_files.py index a1a062113..e9901c478 100644 --- a/volatility/framework/plugins/mac/list_files.py +++ b/volatility3/framework/plugins/mac/list_files.py @@ -4,13 +4,13 @@ import logging from typing import Iterable, Optional -from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import mount +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import mount vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/lsmod.py b/volatility3/framework/plugins/mac/lsmod.py similarity index 88% rename from volatility/framework/plugins/mac/lsmod.py rename to volatility3/framework/plugins/mac/lsmod.py index 129dbda9a..81639115d 100644 --- a/volatility/framework/plugins/mac/lsmod.py +++ b/volatility3/framework/plugins/mac/lsmod.py @@ -3,11 +3,11 @@ # """A module containing a collection of plugins that produce data typically found in Mac's lsmod command.""" -from volatility.framework import renderers, interfaces, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints +from volatility3.framework import renderers, interfaces, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints class Lsmod(plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/lsof.py b/volatility3/framework/plugins/mac/lsof.py similarity index 90% rename from volatility/framework/plugins/mac/lsof.py rename to volatility3/framework/plugins/mac/lsof.py index 0307b2217..38351009a 100644 --- a/volatility/framework/plugins/mac/lsof.py +++ b/volatility3/framework/plugins/mac/lsof.py @@ -4,11 +4,11 @@ import logging -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.symbols import mac -from volatility.plugins.mac import pslist +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/malfind.py b/volatility3/framework/plugins/mac/malfind.py similarity index 90% rename from volatility/framework/plugins/mac/malfind.py rename to volatility3/framework/plugins/mac/malfind.py index 3a920a8a5..64d7b5010 100644 --- a/volatility/framework/plugins/mac/malfind.py +++ b/volatility3/framework/plugins/mac/malfind.py @@ -2,13 +2,13 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import constants -from volatility.framework import interfaces -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.mac import pslist +from volatility3.framework import constants +from volatility3.framework import interfaces +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.mac import pslist class Malfind(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/mount.py b/volatility3/framework/plugins/mac/mount.py similarity index 89% rename from volatility/framework/plugins/mac/mount.py rename to volatility3/framework/plugins/mac/mount.py index 55193fac4..57ea9e5b6 100644 --- a/volatility/framework/plugins/mac/mount.py +++ b/volatility3/framework/plugins/mac/mount.py @@ -3,11 +3,11 @@ # """A module containing a collection of plugins that produce data typically found in Mac's mount command.""" -from volatility.framework import renderers, interfaces, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.symbols import mac +from volatility3.framework import renderers, interfaces, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.symbols import mac class Mount(plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/netstat.py b/volatility3/framework/plugins/mac/netstat.py similarity index 92% rename from volatility/framework/plugins/mac/netstat.py rename to volatility3/framework/plugins/mac/netstat.py index dc3c03297..3e04d5899 100644 --- a/volatility/framework/plugins/mac/netstat.py +++ b/volatility3/framework/plugins/mac/netstat.py @@ -5,13 +5,13 @@ import logging from typing import Iterable, Callable, Tuple -from volatility.framework import exceptions, renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import pslist +from volatility3.framework import exceptions, renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/proc_maps.py b/volatility3/framework/plugins/mac/proc_maps.py similarity index 90% rename from volatility/framework/plugins/mac/proc_maps.py rename to volatility3/framework/plugins/mac/proc_maps.py index 57a8d0215..3a0bef5ba 100644 --- a/volatility/framework/plugins/mac/proc_maps.py +++ b/volatility3/framework/plugins/mac/proc_maps.py @@ -2,11 +2,11 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.mac import pslist +from volatility3.framework import renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.mac import pslist class Maps(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/psaux.py b/volatility3/framework/plugins/mac/psaux.py similarity index 93% rename from volatility/framework/plugins/mac/psaux.py rename to volatility3/framework/plugins/mac/psaux.py index 2dca44da4..1bb720575 100644 --- a/volatility/framework/plugins/mac/psaux.py +++ b/volatility3/framework/plugins/mac/psaux.py @@ -4,11 +4,11 @@ """In-memory artifacts from OSX systems.""" from typing import Iterator, Tuple, Any, Generator, List -from volatility.framework import exceptions, renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.plugins.mac import pslist +from volatility3.framework import exceptions, renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.plugins.mac import pslist class Psaux(plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/pslist.py b/volatility3/framework/plugins/mac/pslist.py similarity index 98% rename from volatility/framework/plugins/mac/pslist.py rename to volatility3/framework/plugins/mac/pslist.py index 23fba1ac7..c9253e093 100644 --- a/volatility/framework/plugins/mac/pslist.py +++ b/volatility3/framework/plugins/mac/pslist.py @@ -5,10 +5,10 @@ import logging from typing import Callable, Iterable, List, Dict -from volatility.framework import renderers, interfaces, contexts, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.symbols import mac +from volatility3.framework import renderers, interfaces, contexts, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.symbols import mac vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/pstree.py b/volatility3/framework/plugins/mac/pstree.py similarity index 91% rename from volatility/framework/plugins/mac/pstree.py rename to volatility3/framework/plugins/mac/pstree.py index 7fda089f7..e499aa300 100644 --- a/volatility/framework/plugins/mac/pstree.py +++ b/volatility3/framework/plugins/mac/pstree.py @@ -2,11 +2,11 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.plugins.mac import pslist +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.plugins.mac import pslist class PsTree(plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/socket_filters.py b/volatility3/framework/plugins/mac/socket_filters.py similarity index 88% rename from volatility/framework/plugins/mac/socket_filters.py rename to volatility3/framework/plugins/mac/socket_filters.py index 800eb134d..b2bcba759 100644 --- a/volatility/framework/plugins/mac/socket_filters.py +++ b/volatility3/framework/plugins/mac/socket_filters.py @@ -4,14 +4,14 @@ import logging from typing import List -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/timers.py b/volatility3/framework/plugins/mac/timers.py similarity index 90% rename from volatility/framework/plugins/mac/timers.py rename to volatility3/framework/plugins/mac/timers.py index 94502d800..3169b2aeb 100644 --- a/volatility/framework/plugins/mac/timers.py +++ b/volatility3/framework/plugins/mac/timers.py @@ -4,13 +4,13 @@ import logging from typing import List -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/trustedbsd.py b/volatility3/framework/plugins/mac/trustedbsd.py similarity index 88% rename from volatility/framework/plugins/mac/trustedbsd.py rename to volatility3/framework/plugins/mac/trustedbsd.py index 73a313af4..d515959fb 100644 --- a/volatility/framework/plugins/mac/trustedbsd.py +++ b/volatility3/framework/plugins/mac/trustedbsd.py @@ -5,14 +5,14 @@ import logging from typing import List, Iterator, Any -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/vfsevents.py b/volatility3/framework/plugins/mac/vfsevents.py similarity index 92% rename from volatility/framework/plugins/mac/vfsevents.py rename to volatility3/framework/plugins/mac/vfsevents.py index 84d3adc51..9d4db7b97 100644 --- a/volatility/framework/plugins/mac/vfsevents.py +++ b/volatility3/framework/plugins/mac/vfsevents.py @@ -2,9 +2,9 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import renderers, interfaces, exceptions, contexts -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility +from volatility3.framework import renderers, interfaces, exceptions, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility class VFSevents(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/timeliner.py b/volatility3/framework/plugins/timeliner.py similarity index 98% rename from volatility/framework/plugins/timeliner.py rename to volatility3/framework/plugins/timeliner.py index 40148800d..2ec4d6961 100644 --- a/volatility/framework/plugins/timeliner.py +++ b/volatility3/framework/plugins/timeliner.py @@ -11,9 +11,9 @@ import logging import traceback from typing import Generator, Iterable, List, Optional, Tuple, Type -from volatility import framework -from volatility.framework import renderers, automagic, interfaces, plugins, exceptions -from volatility.framework.configuration import requirements +from volatility3 import framework +from volatility3.framework import renderers, automagic, interfaces, plugins, exceptions +from volatility3.framework.configuration import requirements vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/__init__.py b/volatility3/framework/plugins/windows/__init__.py similarity index 69% rename from volatility/framework/plugins/windows/__init__.py rename to volatility3/framework/plugins/windows/__init__.py index e7f81d48d..87a986e48 100644 --- a/volatility/framework/plugins/windows/__init__.py +++ b/volatility3/framework/plugins/windows/__init__.py @@ -3,6 +3,6 @@ # """All core windows plugins. -These modules should only be imported from volatility.plugins NOT -volatility.framework.plugins +These modules should only be imported from volatility3.plugins NOT +volatility3.framework.plugins """ diff --git a/volatility/framework/plugins/windows/bigpools.py b/volatility3/framework/plugins/windows/bigpools.py similarity index 92% rename from volatility/framework/plugins/windows/bigpools.py rename to volatility3/framework/plugins/windows/bigpools.py index 434d88df3..12d4d1f28 100644 --- a/volatility/framework/plugins/windows/bigpools.py +++ b/volatility3/framework/plugins/windows/bigpools.py @@ -5,13 +5,13 @@ import logging from typing import List, Optional, Tuple, Iterator -from volatility.framework import interfaces, renderers, exceptions, symbols -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import configuration -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import extensions -from volatility.framework.symbols.windows import versions +from volatility3.framework import interfaces, renderers, exceptions, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import configuration +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import extensions +from volatility3.framework.symbols.windows import versions vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py similarity index 95% rename from volatility/framework/plugins/windows/cachedump.py rename to volatility3/framework/plugins/windows/cachedump.py index 35eb0f593..02e3a540c 100644 --- a/volatility/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -7,11 +7,11 @@ from struct import unpack from Crypto.Cipher import ARC4, AES from Crypto.Hash import HMAC -from volatility.framework import interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.symbols.windows import versions -from volatility.plugins.windows import hashdump, lsadump -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.symbols.windows import versions +from volatility3.plugins.windows import hashdump, lsadump +from volatility3.plugins.windows.registry import hivelist class Cachedump(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py similarity index 97% rename from volatility/framework/plugins/windows/callbacks.py rename to volatility3/framework/plugins/windows/callbacks.py index 8f5280ad0..7702d67a7 100644 --- a/volatility/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -5,13 +5,13 @@ import logging from typing import List, Iterable, Tuple, Optional, Union -from volatility.framework import constants, exceptions, renderers, interfaces, symbols -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import versions -from volatility.plugins.windows import ssdt -from volatility.plugins.windows import svcscan +from volatility3.framework import constants, exceptions, renderers, interfaces, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import versions +from volatility3.plugins.windows import ssdt +from volatility3.plugins.windows import svcscan vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/cmdline.py b/volatility3/framework/plugins/windows/cmdline.py similarity index 94% rename from volatility/framework/plugins/windows/cmdline.py rename to volatility3/framework/plugins/windows/cmdline.py index 83ac2aa02..dfcf07f38 100644 --- a/volatility/framework/plugins/windows/cmdline.py +++ b/volatility3/framework/plugins/windows/cmdline.py @@ -4,10 +4,10 @@ import logging from typing import List -from volatility.framework import constants, exceptions, renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.plugins.windows import pslist +from volatility3.framework import constants, exceptions, renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py similarity index 95% rename from volatility/framework/plugins/windows/dlllist.py rename to volatility3/framework/plugins/windows/dlllist.py index 94de9d193..c5912afa9 100644 --- a/volatility/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -6,13 +6,13 @@ import logging import ntpath from typing import List, Optional, Type -from volatility.framework import exceptions, renderers, interfaces, constants -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints, conversion -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe -from volatility.plugins import timeliner -from volatility.plugins.windows import pslist, info +from volatility3.framework import exceptions, renderers, interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints, conversion +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins import timeliner +from volatility3.plugins.windows import pslist, info vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/driverirp.py b/volatility3/framework/plugins/windows/driverirp.py similarity index 92% rename from volatility/framework/plugins/windows/driverirp.py rename to volatility3/framework/plugins/windows/driverirp.py index c77e0801d..27f86f3b0 100644 --- a/volatility/framework/plugins/windows/driverirp.py +++ b/volatility3/framework/plugins/windows/driverirp.py @@ -2,11 +2,11 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import constants -from volatility.framework import renderers, exceptions, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import ssdt, driverscan +from volatility3.framework import constants +from volatility3.framework import renderers, exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import ssdt, driverscan MAJOR_FUNCTIONS = [ 'IRP_MJ_CREATE', 'IRP_MJ_CREATE_NAMED_PIPE', 'IRP_MJ_CLOSE', 'IRP_MJ_READ', 'IRP_MJ_WRITE', diff --git a/volatility/framework/plugins/windows/driverscan.py b/volatility3/framework/plugins/windows/driverscan.py similarity index 93% rename from volatility/framework/plugins/windows/driverscan.py rename to volatility3/framework/plugins/windows/driverscan.py index e3d1bd5b2..be941836f 100644 --- a/volatility/framework/plugins/windows/driverscan.py +++ b/volatility3/framework/plugins/windows/driverscan.py @@ -4,10 +4,10 @@ from typing import Iterable -from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import poolscanner +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import poolscanner class DriverScan(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py similarity index 97% rename from volatility/framework/plugins/windows/dumpfiles.py rename to volatility3/framework/plugins/windows/dumpfiles.py index d17b30244..e73de42fa 100755 --- a/volatility/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -4,12 +4,12 @@ import logging import ntpath -from volatility.framework import interfaces, renderers, exceptions, constants -from volatility.plugins.windows import handles -from volatility.plugins.windows import pslist -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.objects import utility +from volatility3.framework import interfaces, renderers, exceptions, constants +from volatility3.plugins.windows import handles +from volatility3.plugins.windows import pslist +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.objects import utility from typing import List, Tuple, Type, Optional vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py similarity index 94% rename from volatility/framework/plugins/windows/envars.py rename to volatility3/framework/plugins/windows/envars.py index 50f99659f..7abcfa159 100644 --- a/volatility/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -3,11 +3,11 @@ import logging from typing import List -from volatility.framework import renderers, interfaces, objects, exceptions, constants -from volatility.framework.configuration import requirements -from volatility.framework.layers import registry -from volatility.plugins.windows import pslist -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import renderers, interfaces, objects, exceptions, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import registry +from volatility3.plugins.windows import pslist +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/filescan.py b/volatility3/framework/plugins/windows/filescan.py similarity index 91% rename from volatility/framework/plugins/windows/filescan.py rename to volatility3/framework/plugins/windows/filescan.py index 3f59e02e5..b53352b6e 100644 --- a/volatility/framework/plugins/windows/filescan.py +++ b/volatility3/framework/plugins/windows/filescan.py @@ -4,10 +4,10 @@ from typing import Iterable -from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import poolscanner +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import poolscanner class FileScan(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py similarity index 92% rename from volatility/framework/plugins/windows/getservicesids.py rename to volatility3/framework/plugins/windows/getservicesids.py index 0a5a96820..c2029b937 100644 --- a/volatility/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -8,9 +8,9 @@ import os import struct from typing import List -from volatility.framework import renderers, interfaces, constants, exceptions -from volatility.framework.configuration import requirements -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import renderers, interfaces, constants, exceptions +from volatility3.framework.configuration import requirements +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py similarity index 93% rename from volatility/framework/plugins/windows/getsids.py rename to volatility3/framework/plugins/windows/getsids.py index 5f7e2dcf4..c9aa9cc5c 100644 --- a/volatility/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -8,12 +8,12 @@ import os import re from typing import List, Dict, Union -from volatility.framework import renderers, interfaces, objects, exceptions, constants, layers -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols.windows.extensions import registry -from volatility.plugins.windows import pslist -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import renderers, interfaces, objects, exceptions, constants, layers +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols.windows.extensions import registry +from volatility3.plugins.windows import pslist +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py similarity index 97% rename from volatility/framework/plugins/windows/handles.py rename to volatility3/framework/plugins/windows/handles.py index 5f697bc23..2951a5bdc 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -5,11 +5,11 @@ import logging from typing import List, Optional, Dict -from volatility.framework import constants, exceptions, renderers, interfaces, symbols -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import pslist +from volatility3.framework import constants, exceptions, renderers, interfaces, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py similarity index 98% rename from volatility/framework/plugins/windows/hashdump.py rename to volatility3/framework/plugins/windows/hashdump.py index 64e312bb0..d78684beb 100644 --- a/volatility/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -10,10 +10,10 @@ from typing import List, Tuple, Optional from Crypto.Cipher import ARC4, DES, AES from Crypto.Hash import MD5 -from volatility.framework import interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.symbols.windows.extensions import registry -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.symbols.windows.extensions import registry +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/info.py b/volatility3/framework/plugins/windows/info.py similarity index 96% rename from volatility/framework/plugins/windows/info.py rename to volatility3/framework/plugins/windows/info.py index 8a40f305a..3cb4f1bb7 100644 --- a/volatility/framework/plugins/windows/info.py +++ b/volatility3/framework/plugins/windows/info.py @@ -5,12 +5,12 @@ import time from typing import List, Tuple, Iterable -from volatility.framework import constants, interfaces, layers, symbols -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import TreeGrid -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import extensions +from volatility3.framework import constants, interfaces, layers, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import TreeGrid +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import extensions class Info(plugins.PluginInterface): diff --git a/volatility/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py similarity index 95% rename from volatility/framework/plugins/windows/lsadump.py rename to volatility3/framework/plugins/windows/lsadump.py index a0b674855..538933f7b 100644 --- a/volatility/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -7,11 +7,11 @@ from struct import unpack from Crypto.Cipher import ARC4, DES, AES from Crypto.Hash import MD5, SHA256 -from volatility.framework import interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.symbols.windows import versions -from volatility.plugins.windows import hashdump -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.symbols.windows import versions +from volatility3.plugins.windows import hashdump +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py similarity index 95% rename from volatility/framework/plugins/windows/malfind.py rename to volatility3/framework/plugins/windows/malfind.py index 17fcf11b8..ed35ef649 100644 --- a/volatility/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -4,12 +4,12 @@ import logging from typing import Iterable, Tuple -from volatility.framework import interfaces, symbols, exceptions -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import pslist, vadinfo +from volatility3.framework import interfaces, symbols, exceptions +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist, vadinfo vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/memmap.py b/volatility3/framework/plugins/windows/memmap.py similarity index 94% rename from volatility/framework/plugins/windows/memmap.py rename to volatility3/framework/plugins/windows/memmap.py index 627baca2f..42cf3b9b0 100644 --- a/volatility/framework/plugins/windows/memmap.py +++ b/volatility3/framework/plugins/windows/memmap.py @@ -4,10 +4,10 @@ import logging from typing import List -from volatility.framework import exceptions, renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import pslist +from volatility3.framework import exceptions, renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/modscan.py b/volatility3/framework/plugins/windows/modscan.py similarity index 95% rename from volatility/framework/plugins/windows/modscan.py rename to volatility3/framework/plugins/windows/modscan.py index 3ff0f399a..0a5cb7c9a 100644 --- a/volatility/framework/plugins/windows/modscan.py +++ b/volatility3/framework/plugins/windows/modscan.py @@ -4,12 +4,12 @@ import logging from typing import Iterable, List, Generator -from volatility.framework import renderers, interfaces, exceptions, constants -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe -from volatility.plugins.windows import poolscanner, dlllist, pslist +from volatility3.framework import renderers, interfaces, exceptions, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins.windows import poolscanner, dlllist, pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py similarity index 94% rename from volatility/framework/plugins/windows/modules.py rename to volatility3/framework/plugins/windows/modules.py index df2c04fef..e1384a015 100644 --- a/volatility/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -4,14 +4,14 @@ import logging from typing import List, Iterable, Generator -from volatility.framework import constants -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe -from volatility.plugins.windows import pslist, dlllist +from volatility3.framework import constants +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins.windows import pslist, dlllist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/mutantscan.py b/volatility3/framework/plugins/windows/mutantscan.py similarity index 91% rename from volatility/framework/plugins/windows/mutantscan.py rename to volatility3/framework/plugins/windows/mutantscan.py index d9053c44a..c886960c6 100644 --- a/volatility/framework/plugins/windows/mutantscan.py +++ b/volatility3/framework/plugins/windows/mutantscan.py @@ -4,10 +4,10 @@ from typing import Iterable -from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import poolscanner +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import poolscanner class MutantScan(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py similarity index 97% rename from volatility/framework/plugins/windows/netscan.py rename to volatility3/framework/plugins/windows/netscan.py index 09b02e3ac..cb455aa03 100644 --- a/volatility/framework/plugins/windows/netscan.py +++ b/volatility3/framework/plugins/windows/netscan.py @@ -6,14 +6,14 @@ import datetime import logging from typing import Iterable, List, Optional -from volatility.framework import constants, exceptions, interfaces, renderers, symbols -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import versions -from volatility.framework.symbols.windows.extensions import network -from volatility.plugins import timeliner -from volatility.plugins.windows import info, poolscanner +from volatility3.framework import constants, exceptions, interfaces, renderers, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import versions +from volatility3.framework.symbols.windows.extensions import network +from volatility3.plugins import timeliner +from volatility3.plugins.windows import info, poolscanner vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py similarity index 97% rename from volatility/framework/plugins/windows/poolscanner.py rename to volatility3/framework/plugins/windows/poolscanner.py index c888c1f6a..f61c8566b 100644 --- a/volatility/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -6,14 +6,14 @@ import enum import logging from typing import Dict, Generator, List, Optional, Tuple -from volatility.framework import constants, interfaces, renderers, exceptions, symbols -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins, configuration -from volatility.framework.layers import scanners -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import extensions, versions -from volatility.plugins.windows import handles +from volatility3.framework import constants, interfaces, renderers, exceptions, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins, configuration +from volatility3.framework.layers import scanners +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import extensions, versions +from volatility3.plugins.windows import handles vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/privileges.py b/volatility3/framework/plugins/windows/privileges.py similarity index 93% rename from volatility/framework/plugins/windows/privileges.py rename to volatility3/framework/plugins/windows/privileges.py index f24aa7be3..cfd2d70e0 100644 --- a/volatility/framework/plugins/windows/privileges.py +++ b/volatility3/framework/plugins/windows/privileges.py @@ -6,9 +6,9 @@ import logging import os from typing import List -from volatility.framework import renderers, interfaces, objects, exceptions, constants -from volatility.framework.configuration import requirements -from volatility.plugins.windows import pslist +from volatility3.framework import renderers, interfaces, objects, exceptions, constants +from volatility3.framework.configuration import requirements +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py similarity index 96% rename from volatility/framework/plugins/windows/pslist.py rename to volatility3/framework/plugins/windows/pslist.py index be3bf0235..1428936f0 100644 --- a/volatility/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -6,13 +6,13 @@ import datetime import logging from typing import Callable, Iterable, List, Type -from volatility.framework import renderers, interfaces, layers, constants -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe -from volatility.plugins import timeliner +from volatility3.framework import renderers, interfaces, layers, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins import timeliner vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/psscan.py b/volatility3/framework/plugins/windows/psscan.py similarity index 95% rename from volatility/framework/plugins/windows/psscan.py rename to volatility3/framework/plugins/windows/psscan.py index 76823ee37..2458ee42e 100644 --- a/volatility/framework/plugins/windows/psscan.py +++ b/volatility3/framework/plugins/windows/psscan.py @@ -6,15 +6,15 @@ import datetime import logging from typing import Iterable, Callable, Tuple -from volatility.framework import renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe -from volatility.plugins import timeliner -from volatility.plugins.windows import info -from volatility.plugins.windows import poolscanner -from volatility.plugins.windows import pslist +from volatility3.framework import renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins import timeliner +from volatility3.plugins.windows import info +from volatility3.plugins.windows import poolscanner +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/pstree.py b/volatility3/framework/plugins/windows/pstree.py similarity index 95% rename from volatility/framework/plugins/windows/pstree.py rename to volatility3/framework/plugins/windows/pstree.py index a4027ea7a..0d79d3d5b 100644 --- a/volatility/framework/plugins/windows/pstree.py +++ b/volatility3/framework/plugins/windows/pstree.py @@ -4,10 +4,10 @@ import datetime from typing import Dict, Set -from volatility.framework import objects, interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import pslist +from volatility3.framework import objects, interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist class PsTree(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/windows/registry/__init__.py b/volatility3/framework/plugins/windows/registry/__init__.py similarity index 70% rename from volatility/framework/plugins/windows/registry/__init__.py rename to volatility3/framework/plugins/windows/registry/__init__.py index 4939c7755..4351a2ca2 100644 --- a/volatility/framework/plugins/windows/registry/__init__.py +++ b/volatility3/framework/plugins/windows/registry/__init__.py @@ -3,6 +3,6 @@ # """All core windows registry plugins. -These modules should only be imported from volatility.plugins NOT -volatility.framework.plugins +These modules should only be imported from volatility3.plugins NOT +volatility3.framework.plugins """ diff --git a/volatility/framework/plugins/windows/registry/hivelist.py b/volatility3/framework/plugins/windows/registry/hivelist.py similarity index 97% rename from volatility/framework/plugins/windows/registry/hivelist.py rename to volatility3/framework/plugins/windows/registry/hivelist.py index 81aa6b26a..d5ac804a5 100644 --- a/volatility/framework/plugins/windows/registry/hivelist.py +++ b/volatility3/framework/plugins/windows/registry/hivelist.py @@ -4,11 +4,11 @@ import logging from typing import Iterator, List, Tuple, Iterable, Optional -from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import registry -from volatility.framework.renderers import format_hints -from volatility.plugins.windows.registry import hivescan +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import registry +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows.registry import hivescan vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/registry/hivescan.py b/volatility3/framework/plugins/windows/registry/hivescan.py similarity index 91% rename from volatility/framework/plugins/windows/registry/hivescan.py rename to volatility3/framework/plugins/windows/registry/hivescan.py index 466e27763..558638cfd 100644 --- a/volatility/framework/plugins/windows/registry/hivescan.py +++ b/volatility3/framework/plugins/windows/registry/hivescan.py @@ -4,11 +4,11 @@ from typing import Iterable -from volatility.framework import renderers, interfaces, symbols -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols.windows import versions -from volatility.plugins.windows import poolscanner, bigpools +from volatility3.framework import renderers, interfaces, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols.windows import versions +from volatility3.plugins.windows import poolscanner, bigpools class HiveScan(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py similarity index 95% rename from volatility/framework/plugins/windows/registry/printkey.py rename to volatility3/framework/plugins/windows/registry/printkey.py index da660792e..5709b246d 100644 --- a/volatility/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -6,12 +6,12 @@ import datetime import logging from typing import List, Sequence, Iterable, Tuple, Union -from volatility.framework import objects, renderers, exceptions, interfaces, constants -from volatility.framework.configuration import requirements -from volatility.framework.layers.registry import RegistryHive, RegistryFormatException -from volatility.framework.renderers import TreeGrid, conversion, format_hints -from volatility.framework.symbols.windows.extensions.registry import RegValueTypes -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import objects, renderers, exceptions, interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.layers.registry import RegistryHive, RegistryFormatException +from volatility3.framework.renderers import TreeGrid, conversion, format_hints +from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/registry/userassist.json b/volatility3/framework/plugins/windows/registry/userassist.json similarity index 100% rename from volatility/framework/plugins/windows/registry/userassist.json rename to volatility3/framework/plugins/windows/registry/userassist.json diff --git a/volatility/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py similarity index 96% rename from volatility/framework/plugins/windows/registry/userassist.py rename to volatility3/framework/plugins/windows/registry/userassist.py index c18d92edf..16e997d0f 100644 --- a/volatility/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -9,13 +9,13 @@ import logging import os from typing import Any, List, Tuple, Generator -from volatility.framework import exceptions, renderers, constants, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.layers.physical import BufferDataLayer -from volatility.framework.layers.registry import RegistryHive -from volatility.framework.renderers import format_hints, conversion -from volatility.framework.symbols import intermed -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import exceptions, renderers, constants, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.layers.physical import BufferDataLayer +from volatility3.framework.layers.registry import RegistryHive +from volatility3.framework.renderers import format_hints, conversion +from volatility3.framework.symbols import intermed +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/sids_and_privileges.json b/volatility3/framework/plugins/windows/sids_and_privileges.json similarity index 100% rename from volatility/framework/plugins/windows/sids_and_privileges.json rename to volatility3/framework/plugins/windows/sids_and_privileges.json diff --git a/volatility/framework/plugins/windows/ssdt.py b/volatility3/framework/plugins/windows/ssdt.py similarity index 93% rename from volatility/framework/plugins/windows/ssdt.py rename to volatility3/framework/plugins/windows/ssdt.py index 539d2e0a4..c510dec92 100644 --- a/volatility/framework/plugins/windows/ssdt.py +++ b/volatility3/framework/plugins/windows/ssdt.py @@ -5,14 +5,14 @@ import os from typing import Any, Iterator, List, Tuple -from volatility.framework import constants, interfaces -from volatility.framework import contexts -from volatility.framework import exceptions, symbols -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import modules +from volatility3.framework import constants, interfaces +from volatility3.framework import contexts +from volatility3.framework import exceptions, symbols +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import modules class SSDT(plugins.PluginInterface): diff --git a/volatility/framework/plugins/windows/strings.py b/volatility3/framework/plugins/windows/strings.py similarity index 95% rename from volatility/framework/plugins/windows/strings.py rename to volatility3/framework/plugins/windows/strings.py index 90fb82df8..8b18ef812 100644 --- a/volatility/framework/plugins/windows/strings.py +++ b/volatility3/framework/plugins/windows/strings.py @@ -7,11 +7,11 @@ import re from os import path from typing import Dict, Generator, List, Set, Tuple -from volatility.framework import interfaces, renderers, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import intel, resources, linear -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import pslist +from volatility3.framework import interfaces, renderers, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import intel, resources, linear +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py similarity index 94% rename from volatility/framework/plugins/windows/svcscan.py rename to volatility3/framework/plugins/windows/svcscan.py index 8c9866631..23648ada2 100644 --- a/volatility/framework/plugins/windows/svcscan.py +++ b/volatility3/framework/plugins/windows/svcscan.py @@ -5,14 +5,14 @@ import logging from typing import List -from volatility.framework import interfaces, renderers, constants, symbols, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import scanners -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import versions -from volatility.framework.symbols.windows.extensions import services -from volatility.plugins.windows import poolscanner, vadyarascan, pslist +from volatility3.framework import interfaces, renderers, constants, symbols, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import scanners +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import versions +from volatility3.framework.symbols.windows.extensions import services +from volatility3.plugins.windows import poolscanner, vadyarascan, pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/symlinkscan.py b/volatility3/framework/plugins/windows/symlinkscan.py similarity index 91% rename from volatility/framework/plugins/windows/symlinkscan.py rename to volatility3/framework/plugins/windows/symlinkscan.py index 74f5e116a..7d8a54869 100644 --- a/volatility/framework/plugins/windows/symlinkscan.py +++ b/volatility3/framework/plugins/windows/symlinkscan.py @@ -5,11 +5,11 @@ import datetime from typing import Iterable -from volatility.framework import renderers, exceptions, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins import timeliner -from volatility.plugins.windows import poolscanner +from volatility3.framework import renderers, exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins import timeliner +from volatility3.plugins.windows import poolscanner class SymlinkScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py similarity index 97% rename from volatility/framework/plugins/windows/vadinfo.py rename to volatility3/framework/plugins/windows/vadinfo.py index 25d232c24..8d4ca027a 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -5,11 +5,11 @@ import logging from typing import Callable, List, Generator, Iterable, Type, Optional -from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import pslist +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py similarity index 94% rename from volatility/framework/plugins/windows/vadyarascan.py rename to volatility3/framework/plugins/windows/vadyarascan.py index 799cdc4a2..bf597140f 100644 --- a/volatility/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -5,11 +5,11 @@ import logging from typing import Iterable, List, Tuple -from volatility.framework import interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins import yarascan -from volatility.plugins.windows import pslist +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins import yarascan +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/verinfo.py b/volatility3/framework/plugins/windows/verinfo.py similarity index 95% rename from volatility/framework/plugins/windows/verinfo.py rename to volatility3/framework/plugins/windows/verinfo.py index 5338a3178..52c8e462a 100644 --- a/volatility/framework/plugins/windows/verinfo.py +++ b/volatility3/framework/plugins/windows/verinfo.py @@ -6,12 +6,12 @@ import io import logging from typing import Generator, List, Tuple -from volatility.framework import exceptions, renderers, constants, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe -from volatility.plugins.windows import pslist, modules, dlllist +from volatility3.framework import exceptions, renderers, constants, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins.windows import pslist, modules, dlllist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/virtmap.py b/volatility3/framework/plugins/windows/virtmap.py similarity index 96% rename from volatility/framework/plugins/windows/virtmap.py rename to volatility3/framework/plugins/windows/virtmap.py index 5ce7d5d78..93ec763cc 100644 --- a/volatility/framework/plugins/windows/virtmap.py +++ b/volatility3/framework/plugins/windows/virtmap.py @@ -5,10 +5,10 @@ import logging from typing import List, Tuple, Dict, Generator -from volatility.framework import interfaces, renderers, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import intel -from volatility.framework.renderers import format_hints +from volatility3.framework import interfaces, renderers, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import intel +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py similarity index 93% rename from volatility/framework/plugins/yarascan.py rename to volatility3/framework/plugins/yarascan.py index 4e3abee25..8c49c0824 100644 --- a/volatility/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -5,11 +5,11 @@ import logging from typing import Iterable, Tuple, List, Dict, Any -from volatility.framework import interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.layers import resources -from volatility.framework.renderers import format_hints +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.layers import resources +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) diff --git a/volatility/framework/renderers/__init__.py b/volatility3/framework/renderers/__init__.py similarity index 99% rename from volatility/framework/renderers/__init__.py rename to volatility3/framework/renderers/__init__.py index 431ac8034..c7dc126b2 100644 --- a/volatility/framework/renderers/__init__.py +++ b/volatility3/framework/renderers/__init__.py @@ -11,8 +11,8 @@ import datetime import logging from typing import Any, Callable, Iterable, List, Optional, Sequence, Tuple, TypeVar, Union -from volatility.framework import interfaces -from volatility.framework.interfaces import renderers +from volatility3.framework import interfaces +from volatility3.framework.interfaces import renderers vollog = logging.getLogger(__name__) diff --git a/volatility/framework/renderers/conversion.py b/volatility3/framework/renderers/conversion.py similarity index 98% rename from volatility/framework/renderers/conversion.py rename to volatility3/framework/renderers/conversion.py index c570c124f..b60b47411 100644 --- a/volatility/framework/renderers/conversion.py +++ b/volatility3/framework/renderers/conversion.py @@ -8,7 +8,7 @@ import socket import struct from typing import Union -from volatility.framework import interfaces, renderers +from volatility3.framework import interfaces, renderers def wintime_to_datetime(wintime: int) -> Union[interfaces.renderers.BaseAbsentValue, datetime.datetime]: diff --git a/volatility/framework/renderers/format_hints.py b/volatility3/framework/renderers/format_hints.py similarity index 100% rename from volatility/framework/renderers/format_hints.py rename to volatility3/framework/renderers/format_hints.py diff --git a/volatility/framework/symbols/__init__.py b/volatility3/framework/symbols/__init__.py similarity index 99% rename from volatility/framework/symbols/__init__.py rename to volatility3/framework/symbols/__init__.py index 6cbf41196..c2444682c 100644 --- a/volatility/framework/symbols/__init__.py +++ b/volatility3/framework/symbols/__init__.py @@ -8,7 +8,7 @@ import enum import logging from typing import Any, Dict, Iterable, Iterator, TypeVar, List -from volatility.framework import constants, exceptions, interfaces, objects +from volatility3.framework import constants, exceptions, interfaces, objects vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/generic/__init__.py b/volatility3/framework/symbols/generic/__init__.py similarity index 97% rename from volatility/framework/symbols/generic/__init__.py rename to volatility3/framework/symbols/generic/__init__.py index be0bfb59a..68b4e9252 100644 --- a/volatility/framework/symbols/generic/__init__.py +++ b/volatility3/framework/symbols/generic/__init__.py @@ -6,7 +6,7 @@ import random import string from typing import Union -from volatility.framework import objects, interfaces +from volatility3.framework import objects, interfaces class GenericIntelProcess(objects.StructType): diff --git a/volatility/framework/symbols/generic/qemu.json b/volatility3/framework/symbols/generic/qemu.json similarity index 100% rename from volatility/framework/symbols/generic/qemu.json rename to volatility3/framework/symbols/generic/qemu.json diff --git a/volatility/framework/symbols/intermed.py b/volatility3/framework/symbols/intermed.py similarity index 98% rename from volatility/framework/symbols/intermed.py rename to volatility3/framework/symbols/intermed.py index b383846a1..0ff03cbca 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility3/framework/symbols/intermed.py @@ -13,11 +13,11 @@ import zipfile from abc import ABCMeta from typing import Any, Dict, Generator, Iterable, List, Optional, Type, Tuple, Mapping -from volatility.framework.layers import resources -from volatility import schemas, symbols -from volatility.framework import class_subclasses, constants, exceptions, interfaces, objects -from volatility.framework.configuration import requirements -from volatility.framework.symbols import native, metadata +from volatility3.framework.layers import resources +from volatility3 import schemas, symbols +from volatility3.framework import class_subclasses, constants, exceptions, interfaces, objects +from volatility3.framework.configuration import requirements +from volatility3.framework.symbols import native, metadata vollog = logging.getLogger(__name__) @@ -71,7 +71,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): * Enums can specify a list of names and values and a type inside which the numeric encoding will fit * Metadata defines information about the originating file - These are documented in JSONSchema JSON files located in volatility/schemas. + These are documented in JSONSchema JSON files located in volatility3/schemas. """ def __init__(self, @@ -229,7 +229,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): Args: context: The context that the current plugin is being run within config_path: The configuration path for reading/storing configuration information this symbol table may use - sub_path: The path under a suitable symbol path (defaults to volatility/symbols and volatility/framework/symbols) to check + sub_path: The path under a suitable symbol path (defaults to volatility3/symbols and volatility3/framework/symbols) to check filename: Basename of the file to find under the sub_path native_types: Set of native types, defaults to native types read from the intermediate symbol format file table_mapping: a dictionary of table names mentioned within the ISF file, and the tables within the context which they map to diff --git a/volatility/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py similarity index 96% rename from volatility/framework/symbols/linux/__init__.py rename to volatility3/framework/symbols/linux/__init__.py index d8c88d07a..0d8e99e42 100644 --- a/volatility/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -3,11 +3,11 @@ # from typing import List, Tuple, Iterator -from volatility.framework import exceptions, constants, interfaces, objects, contexts -from volatility.framework.objects import utility -from volatility.framework.symbols import intermed -from volatility.framework.symbols.linux import extensions -from volatility.framework.objects import utility +from volatility3.framework import exceptions, constants, interfaces, objects, contexts +from volatility3.framework.objects import utility +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.linux import extensions +from volatility3.framework.objects import utility class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): diff --git a/volatility/framework/symbols/linux/bash.py b/volatility3/framework/symbols/linux/bash.py similarity index 77% rename from volatility/framework/symbols/linux/bash.py rename to volatility3/framework/symbols/linux/bash.py index 570d2cda5..f1f40ace1 100644 --- a/volatility/framework/symbols/linux/bash.py +++ b/volatility3/framework/symbols/linux/bash.py @@ -2,8 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework.symbols import intermed -from volatility.framework.symbols.linux.extensions import bash +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.linux.extensions import bash class BashIntermedSymbols(intermed.IntermediateSymbolTable): diff --git a/volatility/framework/symbols/linux/bash32.json b/volatility3/framework/symbols/linux/bash32.json similarity index 100% rename from volatility/framework/symbols/linux/bash32.json rename to volatility3/framework/symbols/linux/bash32.json diff --git a/volatility/framework/symbols/linux/bash64.json b/volatility3/framework/symbols/linux/bash64.json similarity index 100% rename from volatility/framework/symbols/linux/bash64.json rename to volatility3/framework/symbols/linux/bash64.json diff --git a/volatility/framework/symbols/linux/elf.json b/volatility3/framework/symbols/linux/elf.json similarity index 100% rename from volatility/framework/symbols/linux/elf.json rename to volatility3/framework/symbols/linux/elf.json diff --git a/volatility/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py similarity index 97% rename from volatility/framework/symbols/linux/extensions/__init__.py rename to volatility3/framework/symbols/linux/extensions/__init__.py index c601c0979..5bcfda11e 100644 --- a/volatility/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -6,13 +6,13 @@ import collections.abc import logging from typing import Generator, Iterable, Iterator, Optional, Tuple -from volatility.framework import constants -from volatility.framework import exceptions, objects, interfaces, symbols -from volatility.framework.layers import linear -from volatility.framework.objects import utility -from volatility.framework.symbols import generic, linux -from volatility.framework.symbols import intermed -from volatility.framework.symbols.linux.extensions import elf +from volatility3.framework import constants +from volatility3.framework import exceptions, objects, interfaces, symbols +from volatility3.framework.layers import linear +from volatility3.framework.objects import utility +from volatility3.framework.symbols import generic, linux +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.linux.extensions import elf vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/linux/extensions/bash.py b/volatility3/framework/symbols/linux/extensions/bash.py similarity index 89% rename from volatility/framework/symbols/linux/extensions/bash.py rename to volatility3/framework/symbols/linux/extensions/bash.py index c583b67a4..40fa2521d 100644 --- a/volatility/framework/symbols/linux/extensions/bash.py +++ b/volatility3/framework/symbols/linux/extensions/bash.py @@ -2,10 +2,10 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import exceptions -from volatility.framework import objects -from volatility.framework.objects import utility -from volatility.framework.renderers import conversion +from volatility3.framework import exceptions +from volatility3.framework import objects +from volatility3.framework.objects import utility +from volatility3.framework.renderers import conversion class hist_entry(objects.StructType): diff --git a/volatility/framework/symbols/linux/extensions/elf.py b/volatility3/framework/symbols/linux/extensions/elf.py similarity index 98% rename from volatility/framework/symbols/linux/extensions/elf.py rename to volatility3/framework/symbols/linux/extensions/elf.py index 505132ea9..0774e937a 100644 --- a/volatility/framework/symbols/linux/extensions/elf.py +++ b/volatility3/framework/symbols/linux/extensions/elf.py @@ -4,8 +4,8 @@ from typing import Dict, Tuple -from volatility.framework import constants -from volatility.framework import objects, interfaces +from volatility3.framework import constants +from volatility3.framework import objects, interfaces class elf(objects.StructType): diff --git a/volatility/framework/symbols/mac/__init__.py b/volatility3/framework/symbols/mac/__init__.py similarity index 97% rename from volatility/framework/symbols/mac/__init__.py rename to volatility3/framework/symbols/mac/__init__.py index 4343a38f3..54a5259d0 100644 --- a/volatility/framework/symbols/mac/__init__.py +++ b/volatility3/framework/symbols/mac/__init__.py @@ -3,9 +3,9 @@ # from typing import Iterator, Any, Iterable, List, Tuple, Set -from volatility.framework import interfaces, objects, exceptions, constants -from volatility.framework.symbols import intermed -from volatility.framework.symbols.mac import extensions +from volatility3.framework import interfaces, objects, exceptions, constants +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.mac import extensions class MacKernelIntermedSymbols(intermed.IntermediateSymbolTable): diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility3/framework/symbols/mac/extensions/__init__.py similarity index 98% rename from volatility/framework/symbols/mac/extensions/__init__.py rename to volatility3/framework/symbols/mac/extensions/__init__.py index e433318ae..37d733af6 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility3/framework/symbols/mac/extensions/__init__.py @@ -4,11 +4,11 @@ from typing import Generator, Iterable, Optional, Set, Tuple -from volatility.framework import constants, objects, renderers -from volatility.framework import exceptions, interfaces -from volatility.framework.objects import utility -from volatility.framework.renderers import conversion -from volatility.framework.symbols import generic +from volatility3.framework import constants, objects, renderers +from volatility3.framework import exceptions, interfaces +from volatility3.framework.objects import utility +from volatility3.framework.renderers import conversion +from volatility3.framework.symbols import generic class proc(generic.GenericIntelProcess): @@ -517,7 +517,7 @@ class sysctl_oid(objects.StructType): Returns: A combination of: - R - readable + R - readable W - writeable L - self handles locking """ diff --git a/volatility/framework/symbols/metadata.py b/volatility3/framework/symbols/metadata.py similarity index 96% rename from volatility/framework/symbols/metadata.py rename to volatility3/framework/symbols/metadata.py index 444fb6481..7cde686ee 100644 --- a/volatility/framework/symbols/metadata.py +++ b/volatility3/framework/symbols/metadata.py @@ -4,7 +4,7 @@ from typing import Optional, Tuple -from volatility.framework import interfaces +from volatility3.framework import interfaces class WindowsMetadata(interfaces.symbols.MetadataInterface): diff --git a/volatility/framework/symbols/native.py b/volatility3/framework/symbols/native.py similarity index 98% rename from volatility/framework/symbols/native.py rename to volatility3/framework/symbols/native.py index 26d12bd7e..fdc161322 100644 --- a/volatility/framework/symbols/native.py +++ b/volatility3/framework/symbols/native.py @@ -5,7 +5,7 @@ import copy from typing import Any, Dict, Iterable, Optional, Type -from volatility.framework import constants, interfaces, objects +from volatility3.framework import constants, interfaces, objects class NativeTable(interfaces.symbols.NativeTableInterface): diff --git a/volatility/framework/symbols/windows/__init__.py b/volatility3/framework/symbols/windows/__init__.py similarity index 92% rename from volatility/framework/symbols/windows/__init__.py rename to volatility3/framework/symbols/windows/__init__.py index d99706022..3aa607574 100755 --- a/volatility/framework/symbols/windows/__init__.py +++ b/volatility3/framework/symbols/windows/__init__.py @@ -1,10 +1,10 @@ # This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import volatility.framework.symbols.windows.extensions.pool -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import extensions -from volatility.framework.symbols.windows.extensions import registry, pool +import volatility3.framework.symbols.windows.extensions.pool +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import extensions +from volatility3.framework.symbols.windows.extensions import registry, pool class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): diff --git a/volatility/framework/symbols/windows/bigpools-vista-x64.json b/volatility3/framework/symbols/windows/bigpools-vista-x64.json similarity index 100% rename from volatility/framework/symbols/windows/bigpools-vista-x64.json rename to volatility3/framework/symbols/windows/bigpools-vista-x64.json diff --git a/volatility/framework/symbols/windows/bigpools-vista-x86.json b/volatility3/framework/symbols/windows/bigpools-vista-x86.json similarity index 100% rename from volatility/framework/symbols/windows/bigpools-vista-x86.json rename to volatility3/framework/symbols/windows/bigpools-vista-x86.json diff --git a/volatility/framework/symbols/windows/bigpools-win10-x64.json b/volatility3/framework/symbols/windows/bigpools-win10-x64.json similarity index 100% rename from volatility/framework/symbols/windows/bigpools-win10-x64.json rename to volatility3/framework/symbols/windows/bigpools-win10-x64.json diff --git a/volatility/framework/symbols/windows/bigpools-win10-x86.json b/volatility3/framework/symbols/windows/bigpools-win10-x86.json similarity index 100% rename from volatility/framework/symbols/windows/bigpools-win10-x86.json rename to volatility3/framework/symbols/windows/bigpools-win10-x86.json diff --git a/volatility/framework/symbols/windows/bigpools-x64.json b/volatility3/framework/symbols/windows/bigpools-x64.json similarity index 100% rename from volatility/framework/symbols/windows/bigpools-x64.json rename to volatility3/framework/symbols/windows/bigpools-x64.json diff --git a/volatility/framework/symbols/windows/bigpools-x86.json b/volatility3/framework/symbols/windows/bigpools-x86.json similarity index 100% rename from volatility/framework/symbols/windows/bigpools-x86.json rename to volatility3/framework/symbols/windows/bigpools-x86.json diff --git a/volatility/framework/symbols/windows/callbacks-x64.json b/volatility3/framework/symbols/windows/callbacks-x64.json similarity index 100% rename from volatility/framework/symbols/windows/callbacks-x64.json rename to volatility3/framework/symbols/windows/callbacks-x64.json diff --git a/volatility/framework/symbols/windows/callbacks-x86.json b/volatility3/framework/symbols/windows/callbacks-x86.json similarity index 100% rename from volatility/framework/symbols/windows/callbacks-x86.json rename to volatility3/framework/symbols/windows/callbacks-x86.json diff --git a/volatility/framework/symbols/windows/crash.json b/volatility3/framework/symbols/windows/crash.json similarity index 100% rename from volatility/framework/symbols/windows/crash.json rename to volatility3/framework/symbols/windows/crash.json diff --git a/volatility/framework/symbols/windows/crash64.json b/volatility3/framework/symbols/windows/crash64.json similarity index 100% rename from volatility/framework/symbols/windows/crash64.json rename to volatility3/framework/symbols/windows/crash64.json diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py similarity index 99% rename from volatility/framework/symbols/windows/extensions/__init__.py rename to volatility3/framework/symbols/windows/extensions/__init__.py index b320566aa..f402c800f 100755 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -9,11 +9,11 @@ import logging import math from typing import Iterable, Iterator, Optional, Union, Tuple, List -from volatility.framework import constants, exceptions, interfaces, objects, renderers, symbols -from volatility.framework.layers import intel -from volatility.framework.renderers import conversion -from volatility.framework.symbols import generic -from volatility.framework.symbols.windows.extensions import pool, pe, kdbg +from volatility3.framework import constants, exceptions, interfaces, objects, renderers, symbols +from volatility3.framework.layers import intel +from volatility3.framework.renderers import conversion +from volatility3.framework.symbols import generic +from volatility3.framework.symbols.windows.extensions import pool, pe, kdbg vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/windows/extensions/kdbg.py b/volatility3/framework/symbols/windows/extensions/kdbg.py similarity index 93% rename from volatility/framework/symbols/windows/extensions/kdbg.py rename to volatility3/framework/symbols/windows/extensions/kdbg.py index 6a98d62b9..437edf823 100644 --- a/volatility/framework/symbols/windows/extensions/kdbg.py +++ b/volatility3/framework/symbols/windows/extensions/kdbg.py @@ -2,8 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import constants -from volatility.framework import objects +from volatility3.framework import constants +from volatility3.framework import objects class KDDEBUGGER_DATA64(objects.StructType): diff --git a/volatility/framework/symbols/windows/extensions/network.py b/volatility3/framework/symbols/windows/extensions/network.py similarity index 97% rename from volatility/framework/symbols/windows/extensions/network.py rename to volatility3/framework/symbols/windows/extensions/network.py index c3f8d17cc..78b4c77d7 100644 --- a/volatility/framework/symbols/windows/extensions/network.py +++ b/volatility3/framework/symbols/windows/extensions/network.py @@ -6,10 +6,10 @@ import logging import socket from typing import Dict, Tuple, List, Union -from volatility.framework import exceptions -from volatility.framework import objects, interfaces -from volatility.framework.objects import Array -from volatility.framework.renderers import conversion +from volatility3.framework import exceptions +from volatility3.framework import objects, interfaces +from volatility3.framework.objects import Array +from volatility3.framework.renderers import conversion vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/windows/extensions/pe.py b/volatility3/framework/symbols/windows/extensions/pe.py similarity index 98% rename from volatility/framework/symbols/windows/extensions/pe.py rename to volatility3/framework/symbols/windows/extensions/pe.py index 39bbf00c0..b7b6d71df 100644 --- a/volatility/framework/symbols/windows/extensions/pe.py +++ b/volatility3/framework/symbols/windows/extensions/pe.py @@ -5,9 +5,9 @@ from typing import Generator, Tuple import logging -from volatility.framework import constants -from volatility.framework import objects, interfaces -from volatility.framework.renderers import conversion +from volatility3.framework import constants +from volatility3.framework import objects, interfaces +from volatility3.framework.renderers import conversion vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/windows/extensions/pool.py b/volatility3/framework/symbols/windows/extensions/pool.py similarity index 99% rename from volatility/framework/symbols/windows/extensions/pool.py rename to volatility3/framework/symbols/windows/extensions/pool.py index c029964af..895533840 100644 --- a/volatility/framework/symbols/windows/extensions/pool.py +++ b/volatility3/framework/symbols/windows/extensions/pool.py @@ -3,8 +3,8 @@ import logging import struct from typing import Optional, Tuple, List, Dict, Union -from volatility.framework import objects, interfaces, constants, symbols, exceptions, renderers -from volatility.framework.renderers import conversion +from volatility3.framework import objects, interfaces, constants, symbols, exceptions, renderers +from volatility3.framework.renderers import conversion vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py similarity index 98% rename from volatility/framework/symbols/windows/extensions/registry.py rename to volatility3/framework/symbols/windows/extensions/registry.py index cf15e6c18..3cf2469ff 100644 --- a/volatility/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -7,8 +7,8 @@ import logging import struct from typing import Optional, Iterable, Union -from volatility.framework import constants, exceptions, objects, interfaces -from volatility.framework.layers.registry import RegistryHive, RegistryInvalidIndex, RegistryFormatException +from volatility3.framework import constants, exceptions, objects, interfaces +from volatility3.framework.layers.registry import RegistryHive, RegistryInvalidIndex, RegistryFormatException vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/windows/extensions/services.py b/volatility3/framework/symbols/windows/extensions/services.py similarity index 96% rename from volatility/framework/symbols/windows/extensions/services.py rename to volatility3/framework/symbols/windows/extensions/services.py index fa372609e..5e04c51b6 100644 --- a/volatility/framework/symbols/windows/extensions/services.py +++ b/volatility3/framework/symbols/windows/extensions/services.py @@ -2,10 +2,10 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import objects, interfaces -from volatility.framework import exceptions -from volatility.framework.symbols.wrappers import Flags -from volatility.framework import renderers +from volatility3.framework import objects, interfaces +from volatility3.framework import exceptions +from volatility3.framework.symbols.wrappers import Flags +from volatility3.framework import renderers from typing import Union diff --git a/volatility/framework/symbols/windows/kdbg.json b/volatility3/framework/symbols/windows/kdbg.json similarity index 100% rename from volatility/framework/symbols/windows/kdbg.json rename to volatility3/framework/symbols/windows/kdbg.json diff --git a/volatility/framework/symbols/windows/netscan-vista-sp12-x64.json b/volatility3/framework/symbols/windows/netscan-vista-sp12-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-vista-sp12-x64.json rename to volatility3/framework/symbols/windows/netscan-vista-sp12-x64.json diff --git a/volatility/framework/symbols/windows/netscan-vista-x64.json b/volatility3/framework/symbols/windows/netscan-vista-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-vista-x64.json rename to volatility3/framework/symbols/windows/netscan-vista-x64.json diff --git a/volatility/framework/symbols/windows/netscan-vista-x86.json b/volatility3/framework/symbols/windows/netscan-vista-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-vista-x86.json rename to volatility3/framework/symbols/windows/netscan-vista-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win10-14393-x86.json b/volatility3/framework/symbols/windows/netscan-win10-14393-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-14393-x86.json rename to volatility3/framework/symbols/windows/netscan-win10-14393-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win10-15063-x64.json b/volatility3/framework/symbols/windows/netscan-win10-15063-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-15063-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-15063-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-15063-x86.json b/volatility3/framework/symbols/windows/netscan-win10-15063-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-15063-x86.json rename to volatility3/framework/symbols/windows/netscan-win10-15063-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win10-16299-x64.json b/volatility3/framework/symbols/windows/netscan-win10-16299-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-16299-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-16299-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-17134-x64.json b/volatility3/framework/symbols/windows/netscan-win10-17134-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-17134-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-17134-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-17134-x86.json b/volatility3/framework/symbols/windows/netscan-win10-17134-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-17134-x86.json rename to volatility3/framework/symbols/windows/netscan-win10-17134-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win10-17763-x64.json b/volatility3/framework/symbols/windows/netscan-win10-17763-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-17763-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-17763-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-18363-x64.json b/volatility3/framework/symbols/windows/netscan-win10-18363-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-18363-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-18363-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-19041-x64.json b/volatility3/framework/symbols/windows/netscan-win10-19041-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-19041-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-19041-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-19041-x86.json b/volatility3/framework/symbols/windows/netscan-win10-19041-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-19041-x86.json rename to volatility3/framework/symbols/windows/netscan-win10-19041-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win10-x64.json b/volatility3/framework/symbols/windows/netscan-win10-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-x86.json b/volatility3/framework/symbols/windows/netscan-win10-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-x86.json rename to volatility3/framework/symbols/windows/netscan-win10-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win7-x64.json b/volatility3/framework/symbols/windows/netscan-win7-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win7-x64.json rename to volatility3/framework/symbols/windows/netscan-win7-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win7-x86.json b/volatility3/framework/symbols/windows/netscan-win7-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win7-x86.json rename to volatility3/framework/symbols/windows/netscan-win7-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win8-x64.json b/volatility3/framework/symbols/windows/netscan-win8-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win8-x64.json rename to volatility3/framework/symbols/windows/netscan-win8-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win8-x86.json b/volatility3/framework/symbols/windows/netscan-win8-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win8-x86.json rename to volatility3/framework/symbols/windows/netscan-win8-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win81-x64.json b/volatility3/framework/symbols/windows/netscan-win81-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win81-x64.json rename to volatility3/framework/symbols/windows/netscan-win81-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win81-x86.json b/volatility3/framework/symbols/windows/netscan-win81-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win81-x86.json rename to volatility3/framework/symbols/windows/netscan-win81-x86.json diff --git a/volatility/framework/symbols/windows/pdb.json b/volatility3/framework/symbols/windows/pdb.json similarity index 100% rename from volatility/framework/symbols/windows/pdb.json rename to volatility3/framework/symbols/windows/pdb.json diff --git a/volatility/framework/symbols/windows/pdbconv.py b/volatility3/framework/symbols/windows/pdbconv.py similarity index 99% rename from volatility/framework/symbols/windows/pdbconv.py rename to volatility3/framework/symbols/windows/pdbconv.py index d2dbcfc50..5116b8f78 100644 --- a/volatility/framework/symbols/windows/pdbconv.py +++ b/volatility3/framework/symbols/windows/pdbconv.py @@ -10,8 +10,8 @@ from bisect import bisect from typing import Tuple, Dict, Any, Optional, Union, List from urllib import request, error -from volatility.framework import contexts, interfaces, constants -from volatility.framework.layers import physical, msf, resources +from volatility3.framework import contexts, interfaces, constants +from volatility3.framework.layers import physical, msf, resources vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py similarity index 96% rename from volatility/framework/symbols/windows/pdbutil.py rename to volatility3/framework/symbols/windows/pdbutil.py index 7e1558304..653c953b1 100644 --- a/volatility/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -11,11 +11,11 @@ import struct from typing import Any, Dict, Generator, List, Optional, Tuple, Union from urllib import request -from volatility import symbols -from volatility.framework import constants, interfaces -from volatility.framework.configuration.requirements import SymbolTableRequirement -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import pdbconv +from volatility3 import symbols +from volatility3.framework import constants, interfaces +from volatility3.framework.configuration.requirements import SymbolTableRequirement +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import pdbconv vollog = logging.getLogger(__name__) @@ -29,7 +29,7 @@ class PDBUtility: context: interfaces.context.ContextInterface, layer_name: str, offset: int, - symbol_table_class: str = "volatility.framework.symbols.intermed.IntermediateSymbolTable", + symbol_table_class: str = "volatility3.framework.symbols.intermed.IntermediateSymbolTable", config_path: str = None, progress_callback: constants.ProgressCallback = None) -> Optional[str]: """Produces the name of a symbol table loaded from the offset for an MZ header @@ -274,7 +274,7 @@ class PDBUtility: class PdbSignatureScanner(interfaces.layers.ScannerInterface): - """A :class:`~volatility.framework.interfaces.layers.ScannerInterface` + """A :class:`~volatility3.framework.interfaces.layers.ScannerInterface` based scanner use to identify Windows PDB records. Args: diff --git a/volatility/framework/symbols/windows/pe.json b/volatility3/framework/symbols/windows/pe.json similarity index 100% rename from volatility/framework/symbols/windows/pe.json rename to volatility3/framework/symbols/windows/pe.json diff --git a/volatility/framework/symbols/windows/poolheader-x64-win7.json b/volatility3/framework/symbols/windows/poolheader-x64-win7.json similarity index 100% rename from volatility/framework/symbols/windows/poolheader-x64-win7.json rename to volatility3/framework/symbols/windows/poolheader-x64-win7.json diff --git a/volatility/framework/symbols/windows/poolheader-x64.json b/volatility3/framework/symbols/windows/poolheader-x64.json similarity index 100% rename from volatility/framework/symbols/windows/poolheader-x64.json rename to volatility3/framework/symbols/windows/poolheader-x64.json diff --git a/volatility/framework/symbols/windows/poolheader-x86.json b/volatility3/framework/symbols/windows/poolheader-x86.json similarity index 100% rename from volatility/framework/symbols/windows/poolheader-x86.json rename to volatility3/framework/symbols/windows/poolheader-x86.json diff --git a/volatility/framework/symbols/windows/registry.json b/volatility3/framework/symbols/windows/registry.json similarity index 100% rename from volatility/framework/symbols/windows/registry.json rename to volatility3/framework/symbols/windows/registry.json diff --git a/volatility/framework/symbols/windows/services-vista-x64.json b/volatility3/framework/symbols/windows/services-vista-x64.json similarity index 100% rename from volatility/framework/symbols/windows/services-vista-x64.json rename to volatility3/framework/symbols/windows/services-vista-x64.json diff --git a/volatility/framework/symbols/windows/services-vista-x86.json b/volatility3/framework/symbols/windows/services-vista-x86.json similarity index 100% rename from volatility/framework/symbols/windows/services-vista-x86.json rename to volatility3/framework/symbols/windows/services-vista-x86.json diff --git a/volatility/framework/symbols/windows/services-win10-15063-x64.json b/volatility3/framework/symbols/windows/services-win10-15063-x64.json similarity index 100% rename from volatility/framework/symbols/windows/services-win10-15063-x64.json rename to volatility3/framework/symbols/windows/services-win10-15063-x64.json diff --git a/volatility/framework/symbols/windows/services-win10-15063-x86.json b/volatility3/framework/symbols/windows/services-win10-15063-x86.json similarity index 100% rename from volatility/framework/symbols/windows/services-win10-15063-x86.json rename to volatility3/framework/symbols/windows/services-win10-15063-x86.json diff --git a/volatility/framework/symbols/windows/services-win10-16299-x64.json b/volatility3/framework/symbols/windows/services-win10-16299-x64.json similarity index 100% rename from volatility/framework/symbols/windows/services-win10-16299-x64.json rename to volatility3/framework/symbols/windows/services-win10-16299-x64.json diff --git a/volatility/framework/symbols/windows/services-win10-16299-x86.json b/volatility3/framework/symbols/windows/services-win10-16299-x86.json similarity index 100% rename from volatility/framework/symbols/windows/services-win10-16299-x86.json rename to volatility3/framework/symbols/windows/services-win10-16299-x86.json diff --git a/volatility/framework/symbols/windows/services-win8-x64.json b/volatility3/framework/symbols/windows/services-win8-x64.json similarity index 100% rename from volatility/framework/symbols/windows/services-win8-x64.json rename to volatility3/framework/symbols/windows/services-win8-x64.json diff --git a/volatility/framework/symbols/windows/services-win8-x86.json b/volatility3/framework/symbols/windows/services-win8-x86.json similarity index 100% rename from volatility/framework/symbols/windows/services-win8-x86.json rename to volatility3/framework/symbols/windows/services-win8-x86.json diff --git a/volatility/framework/symbols/windows/services-xp-2003-x64.json b/volatility3/framework/symbols/windows/services-xp-2003-x64.json similarity index 100% rename from volatility/framework/symbols/windows/services-xp-2003-x64.json rename to volatility3/framework/symbols/windows/services-xp-2003-x64.json diff --git a/volatility/framework/symbols/windows/services-xp-x86.json b/volatility3/framework/symbols/windows/services-xp-x86.json similarity index 100% rename from volatility/framework/symbols/windows/services-xp-x86.json rename to volatility3/framework/symbols/windows/services-xp-x86.json diff --git a/volatility/framework/symbols/windows/versions.py b/volatility3/framework/symbols/windows/versions.py similarity index 98% rename from volatility/framework/symbols/windows/versions.py rename to volatility3/framework/symbols/windows/versions.py index 3a7e84b5b..d38cdb701 100644 --- a/volatility/framework/symbols/windows/versions.py +++ b/volatility3/framework/symbols/windows/versions.py @@ -1,7 +1,7 @@ import logging from typing import Callable, Tuple, List, Optional -from volatility.framework import interfaces, constants, exceptions +from volatility3.framework import interfaces, constants, exceptions vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/wrappers.py b/volatility3/framework/symbols/wrappers.py similarity index 94% rename from volatility/framework/symbols/wrappers.py rename to volatility3/framework/symbols/wrappers.py index 307da4ec9..8cf51df23 100644 --- a/volatility/framework/symbols/wrappers.py +++ b/volatility3/framework/symbols/wrappers.py @@ -4,7 +4,7 @@ from typing import List, Mapping -from volatility.framework import interfaces +from volatility3.framework import interfaces class Flags: diff --git a/volatility/plugins/__init__.py b/volatility3/plugins/__init__.py similarity index 94% rename from volatility/plugins/__init__.py rename to volatility3/plugins/__init__.py index 8ecd9c946..6afa8baf4 100644 --- a/volatility/plugins/__init__.py +++ b/volatility3/plugins/__init__.py @@ -12,6 +12,6 @@ are dependent upon, please DO NOT alter or remove this file unless you know the The framework is configured this way to allow plugin developers/users to override any plugin functionality whether existing or new. """ -from volatility.framework import constants +from volatility3.framework import constants __path__ = constants.PLUGINS_PATH diff --git a/volatility/plugins/linux/__init__.py b/volatility3/plugins/linux/__init__.py similarity index 100% rename from volatility/plugins/linux/__init__.py rename to volatility3/plugins/linux/__init__.py diff --git a/volatility/plugins/mac/__init__.py b/volatility3/plugins/mac/__init__.py similarity index 100% rename from volatility/plugins/mac/__init__.py rename to volatility3/plugins/mac/__init__.py diff --git a/volatility/plugins/windows/__init__.py b/volatility3/plugins/windows/__init__.py similarity index 100% rename from volatility/plugins/windows/__init__.py rename to volatility3/plugins/windows/__init__.py diff --git a/volatility/plugins/windows/registry/__init__.py b/volatility3/plugins/windows/registry/__init__.py similarity index 100% rename from volatility/plugins/windows/registry/__init__.py rename to volatility3/plugins/windows/registry/__init__.py diff --git a/volatility/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py similarity index 93% rename from volatility/plugins/windows/registry/certificates.py rename to volatility3/plugins/windows/registry/certificates.py index 8fd574670..fac98423a 100644 --- a/volatility/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -1,10 +1,10 @@ import struct from typing import List, Iterator, Tuple -from volatility.framework import interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.symbols.windows.extensions.registry import RegValueTypes -from volatility.plugins.windows.registry import hivelist, printkey +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes +from volatility3.plugins.windows.registry import hivelist, printkey class Certificates(interfaces.plugins.PluginInterface): diff --git a/volatility/plugins/windows/statistics.py b/volatility3/plugins/windows/statistics.py similarity index 93% rename from volatility/plugins/windows/statistics.py rename to volatility3/plugins/windows/statistics.py index 2e637bf6f..e6f2016ed 100644 --- a/volatility/plugins/windows/statistics.py +++ b/volatility3/plugins/windows/statistics.py @@ -4,10 +4,10 @@ import logging from typing import List -from volatility.framework import renderers, exceptions, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.layers import intel +from volatility3.framework import renderers, exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.layers import intel vollog = logging.getLogger(__name__) diff --git a/volatility/schemas/__init__.py b/volatility3/schemas/__init__.py similarity index 98% rename from volatility/schemas/__init__.py rename to volatility3/schemas/__init__.py index 40bc235f4..ea7f0579d 100644 --- a/volatility/schemas/__init__.py +++ b/volatility3/schemas/__init__.py @@ -8,7 +8,7 @@ import logging import os from typing import Set, Any, Dict -from volatility.framework import constants +from volatility3.framework import constants vollog = logging.getLogger(__name__) diff --git a/volatility/schemas/schema-0.1.0.json b/volatility3/schemas/schema-0.1.0.json similarity index 100% rename from volatility/schemas/schema-0.1.0.json rename to volatility3/schemas/schema-0.1.0.json diff --git a/volatility/schemas/schema-2.0.0.json b/volatility3/schemas/schema-2.0.0.json similarity index 100% rename from volatility/schemas/schema-2.0.0.json rename to volatility3/schemas/schema-2.0.0.json diff --git a/volatility/schemas/schema-2.1.0.json b/volatility3/schemas/schema-2.1.0.json similarity index 100% rename from volatility/schemas/schema-2.1.0.json rename to volatility3/schemas/schema-2.1.0.json diff --git a/volatility/schemas/schema-4.0.0.json b/volatility3/schemas/schema-4.0.0.json similarity index 100% rename from volatility/schemas/schema-4.0.0.json rename to volatility3/schemas/schema-4.0.0.json diff --git a/volatility/schemas/schema-4.1.0.json b/volatility3/schemas/schema-4.1.0.json similarity index 100% rename from volatility/schemas/schema-4.1.0.json rename to volatility3/schemas/schema-4.1.0.json diff --git a/volatility/schemas/schema-6.0.0.json b/volatility3/schemas/schema-6.0.0.json similarity index 100% rename from volatility/schemas/schema-6.0.0.json rename to volatility3/schemas/schema-6.0.0.json diff --git a/volatility/schemas/schema-6.1.0.json b/volatility3/schemas/schema-6.1.0.json similarity index 100% rename from volatility/schemas/schema-6.1.0.json rename to volatility3/schemas/schema-6.1.0.json diff --git a/volatility/schemas/schema-6.2.0.json b/volatility3/schemas/schema-6.2.0.json similarity index 100% rename from volatility/schemas/schema-6.2.0.json rename to volatility3/schemas/schema-6.2.0.json diff --git a/volatility/symbols/__init__.py b/volatility3/symbols/__init__.py similarity index 89% rename from volatility/symbols/__init__.py rename to volatility3/symbols/__init__.py index e656d0649..c35f07cbe 100644 --- a/volatility/symbols/__init__.py +++ b/volatility3/symbols/__init__.py @@ -6,6 +6,6 @@ This is the namespace for all volatility symbols, and determines the path for loading symbol ISF files """ -from volatility.framework import constants +from volatility3.framework import constants __path__ = constants.SYMBOL_BASEPATHS diff --git a/volshell.py b/volshell.py index 4de304daf..590994324 100644 --- a/volshell.py +++ b/volshell.py @@ -4,7 +4,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.cli import volshell +from volatility3.cli import volshell if __name__ == '__main__': volshell.main() diff --git a/volshell.spec b/volshell.spec index 832332c23..6654772ca 100644 --- a/volshell.spec +++ b/volshell.spec @@ -31,16 +31,16 @@ sys.path.append(os.getcwd()) vol_analysis = Analysis(['volshell.py'], pathex = [], binaries = binaries, - datas = collect_data_files('volatility.framework') + \ - collect_data_files('volatility.framework.automagic', include_py_files = True) + \ - collect_data_files('volatility.framework.plugins', include_py_files = True) + \ - collect_data_files('volatility.framework.layers', include_py_files = True) + \ - collect_data_files('volatility.cli', include_py_files = True) + \ - collect_data_files('volatility.schemas') + \ - collect_data_files('volatility.plugins', include_py_files = True), - hiddenimports = collect_submodules('volatility.framework.automagic') + \ - collect_submodules('volatility.framework.plugins') + \ - collect_submodules('volatility.framework.symbols'), + datas = collect_data_files('volatility3.framework') + \ + collect_data_files('volatility3.framework.automagic', include_py_files = True) + \ + collect_data_files('volatility3.framework.plugins', include_py_files = True) + \ + collect_data_files('volatility3.framework.layers', include_py_files = True) + \ + collect_data_files('volatility3.cli', include_py_files = True) + \ + collect_data_files('volatility3.schemas') + \ + collect_data_files('volatility3.plugins', include_py_files = True), + hiddenimports = collect_submodules('volatility3.framework.automagic') + \ + collect_submodules('volatility3.framework.plugins') + \ + collect_submodules('volatility3.framework.symbols'), hookspath = [], runtime_hooks = [], excludes = [], From d14ba9e96e8a34d1cf3ac81e7bfa7d3a79dd990e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 20 Jan 2021 21:29:30 +0000 Subject: [PATCH 19/28] Core: Roll the version number back to 1.0.0 --- volatility3/cli/__init__.py | 2 +- volatility3/cli/volshell/__init__.py | 2 +- volatility3/cli/volshell/generic.py | 2 +- volatility3/framework/constants/__init__.py | 2 +- volatility3/framework/interfaces/plugins.py | 4 ++-- volatility3/framework/plugins/banners.py | 2 +- volatility3/framework/plugins/configwriter.py | 2 +- volatility3/framework/plugins/frameworkinfo.py | 2 +- volatility3/framework/plugins/isfinfo.py | 2 +- volatility3/framework/plugins/layerwriter.py | 2 +- volatility3/framework/plugins/linux/bash.py | 2 +- volatility3/framework/plugins/linux/check_afinfo.py | 2 +- volatility3/framework/plugins/linux/check_creds.py | 2 +- volatility3/framework/plugins/linux/check_idt.py | 2 +- volatility3/framework/plugins/linux/check_modules.py | 2 +- volatility3/framework/plugins/linux/check_syscall.py | 2 +- volatility3/framework/plugins/linux/elfs.py | 2 +- volatility3/framework/plugins/linux/keyboard_notifiers.py | 2 +- volatility3/framework/plugins/linux/lsmod.py | 2 +- volatility3/framework/plugins/linux/lsof.py | 2 +- volatility3/framework/plugins/linux/malfind.py | 2 +- volatility3/framework/plugins/linux/proc.py | 2 +- volatility3/framework/plugins/linux/pslist.py | 2 +- volatility3/framework/plugins/linux/pstree.py | 2 +- volatility3/framework/plugins/linux/tty_check.py | 2 +- volatility3/framework/plugins/mac/bash.py | 2 +- volatility3/framework/plugins/mac/check_syscall.py | 2 +- volatility3/framework/plugins/mac/check_sysctl.py | 2 +- volatility3/framework/plugins/mac/check_trap_table.py | 2 +- volatility3/framework/plugins/mac/ifconfig.py | 2 +- volatility3/framework/plugins/mac/kauth_listeners.py | 2 +- volatility3/framework/plugins/mac/kauth_scopes.py | 2 +- volatility3/framework/plugins/mac/kevents.py | 2 +- volatility3/framework/plugins/mac/lsmod.py | 2 +- volatility3/framework/plugins/mac/lsof.py | 2 +- volatility3/framework/plugins/mac/malfind.py | 2 +- volatility3/framework/plugins/mac/mount.py | 2 +- volatility3/framework/plugins/mac/netstat.py | 2 +- volatility3/framework/plugins/mac/proc_maps.py | 2 +- volatility3/framework/plugins/mac/psaux.py | 2 +- volatility3/framework/plugins/mac/pslist.py | 2 +- volatility3/framework/plugins/mac/pstree.py | 2 +- volatility3/framework/plugins/mac/socket_filters.py | 2 +- volatility3/framework/plugins/mac/timers.py | 2 +- volatility3/framework/plugins/mac/trustedbsd.py | 2 +- volatility3/framework/plugins/mac/vfsevents.py | 2 +- volatility3/framework/plugins/timeliner.py | 2 +- volatility3/framework/plugins/windows/bigpools.py | 2 +- volatility3/framework/plugins/windows/cachedump.py | 2 +- volatility3/framework/plugins/windows/callbacks.py | 2 +- volatility3/framework/plugins/windows/cmdline.py | 2 +- volatility3/framework/plugins/windows/dlllist.py | 2 +- volatility3/framework/plugins/windows/driverirp.py | 2 +- volatility3/framework/plugins/windows/driverscan.py | 2 +- volatility3/framework/plugins/windows/dumpfiles.py | 2 +- volatility3/framework/plugins/windows/envars.py | 2 +- volatility3/framework/plugins/windows/filescan.py | 2 +- volatility3/framework/plugins/windows/getservicesids.py | 2 +- volatility3/framework/plugins/windows/getsids.py | 2 +- volatility3/framework/plugins/windows/handles.py | 2 +- volatility3/framework/plugins/windows/hashdump.py | 2 +- volatility3/framework/plugins/windows/info.py | 2 +- volatility3/framework/plugins/windows/lsadump.py | 2 +- volatility3/framework/plugins/windows/malfind.py | 2 +- volatility3/framework/plugins/windows/memmap.py | 2 +- volatility3/framework/plugins/windows/modscan.py | 2 +- volatility3/framework/plugins/windows/modules.py | 2 +- volatility3/framework/plugins/windows/mutantscan.py | 2 +- volatility3/framework/plugins/windows/netscan.py | 2 +- volatility3/framework/plugins/windows/poolscanner.py | 2 +- volatility3/framework/plugins/windows/privileges.py | 2 +- volatility3/framework/plugins/windows/pslist.py | 2 +- volatility3/framework/plugins/windows/psscan.py | 2 +- volatility3/framework/plugins/windows/pstree.py | 2 +- volatility3/framework/plugins/windows/registry/hivelist.py | 4 ++-- volatility3/framework/plugins/windows/registry/hivescan.py | 2 +- volatility3/framework/plugins/windows/registry/printkey.py | 2 +- volatility3/framework/plugins/windows/registry/userassist.py | 2 +- volatility3/framework/plugins/windows/ssdt.py | 2 +- volatility3/framework/plugins/windows/strings.py | 2 +- volatility3/framework/plugins/windows/svcscan.py | 2 +- volatility3/framework/plugins/windows/symlinkscan.py | 2 +- volatility3/framework/plugins/windows/vadinfo.py | 2 +- volatility3/framework/plugins/windows/vadyarascan.py | 2 +- volatility3/framework/plugins/windows/verinfo.py | 2 +- volatility3/framework/plugins/windows/virtmap.py | 2 +- volatility3/framework/plugins/yarascan.py | 2 +- volatility3/plugins/windows/registry/certificates.py | 2 +- volatility3/plugins/windows/statistics.py | 2 +- 89 files changed, 91 insertions(+), 91 deletions(-) diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index a90404d0a..02b8d1cb0 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -87,7 +87,7 @@ class CommandLine: """Executes the command line module, taking the system arguments, determining the plugin to run and then running it.""" - volatility3.framework.require_interface_version(2, 0, 0) + volatility3.framework.require_interface_version(1, 0, 0) renderers = dict([(x.name.lower(), x) for x in framework.class_subclasses(text_renderer.CLIRenderer)]) diff --git a/volatility3/cli/volshell/__init__.py b/volatility3/cli/volshell/__init__.py index 122107d0f..4a7cb5380 100644 --- a/volatility3/cli/volshell/__init__.py +++ b/volatility3/cli/volshell/__init__.py @@ -42,7 +42,7 @@ class VolShell(cli.CommandLine): determining the plugin to run and then running it.""" sys.stdout.write("Volshell (Volatility 3 Framework) {}\n".format(constants.PACKAGE_VERSION)) - framework.require_interface_version(2, 0, 0) + framework.require_interface_version(1, 0, 0) parser = argparse.ArgumentParser(prog = 'volshell', description = "A tool for interactivate forensic analysis of memory images") diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index a2a156ac4..19d398ba9 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -26,7 +26,7 @@ except ImportError: class Volshell(interfaces.plugins.PluginInterface): """Shell environment to directly interact with a memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/constants/__init__.py b/volatility3/framework/constants/__init__.py index 9e014122b..5a5e5f1c5 100644 --- a/volatility3/framework/constants/__init__.py +++ b/volatility3/framework/constants/__init__.py @@ -38,7 +38,7 @@ BANG = "!" """Constant used to delimit table names from type names when referring to a symbol""" # We use the SemVer 2.0.0 versioning scheme -VERSION_MAJOR = 2 # Number of releases of the library with a breaking change +VERSION_MAJOR = 1 # Number of releases of the library with a breaking change VERSION_MINOR = 0 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" diff --git a/volatility3/framework/interfaces/plugins.py b/volatility3/framework/interfaces/plugins.py index 3ab602903..5649629ca 100644 --- a/volatility3/framework/interfaces/plugins.py +++ b/volatility3/framework/interfaces/plugins.py @@ -94,8 +94,8 @@ class PluginInterface(interfaces.configuration.ConfigurableInterface, and configuration information in the context it is passed. """ - # Be careful with inheritance around this - _required_framework_version = (1, 0, 0) # type: Tuple[int, int, int] + # Be careful with inheritance around this (We default to requiring a version which doesn't exist, so it must be set) + _required_framework_version = (0, 0, 0) # type: Tuple[int, int, int] """The _version variable is a quick way for plugins to define their current interface, it should follow SemVer rules""" def __init__(self, diff --git a/volatility3/framework/plugins/banners.py b/volatility3/framework/plugins/banners.py index ac2006207..c907497ed 100644 --- a/volatility3/framework/plugins/banners.py +++ b/volatility3/framework/plugins/banners.py @@ -15,7 +15,7 @@ vollog = logging.getLogger(__name__) class Banners(interfaces.plugins.PluginInterface): """Attempts to identify potential linux banners in an image""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/configwriter.py b/volatility3/framework/plugins/configwriter.py index 3c2da6ce3..6dc504fb5 100644 --- a/volatility3/framework/plugins/configwriter.py +++ b/volatility3/framework/plugins/configwriter.py @@ -17,7 +17,7 @@ class ConfigWriter(plugins.PluginInterface): """Runs the automagics and both prints and outputs configuration in the output directory.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/frameworkinfo.py b/volatility3/framework/plugins/frameworkinfo.py index b7c887d5c..8d9f3b013 100644 --- a/volatility3/framework/plugins/frameworkinfo.py +++ b/volatility3/framework/plugins/frameworkinfo.py @@ -8,7 +8,7 @@ from volatility3.framework.interfaces import plugins class FrameworkInfo(plugins.PluginInterface): """Plugin to list the various modular components of Volatility""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/isfinfo.py b/volatility3/framework/plugins/isfinfo.py index 929c95cdf..c1f5daef1 100644 --- a/volatility3/framework/plugins/isfinfo.py +++ b/volatility3/framework/plugins/isfinfo.py @@ -22,7 +22,7 @@ vollog = logging.getLogger(__name__) class IsfInfo(plugins.PluginInterface): """Determines information about the currently available ISF files, or a specific one""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/layerwriter.py b/volatility3/framework/plugins/layerwriter.py index 53f07701f..721845fd3 100644 --- a/volatility3/framework/plugins/layerwriter.py +++ b/volatility3/framework/plugins/layerwriter.py @@ -17,7 +17,7 @@ class LayerWriter(plugins.PluginInterface): default_block_size = 0x500000 - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (2, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/linux/bash.py b/volatility3/framework/plugins/linux/bash.py index 9d43a59d3..8e6de7241 100644 --- a/volatility3/framework/plugins/linux/bash.py +++ b/volatility3/framework/plugins/linux/bash.py @@ -21,7 +21,7 @@ from volatility3.plugins.linux import pslist class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): """Recovers bash command history from memory.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/check_afinfo.py b/volatility3/framework/plugins/linux/check_afinfo.py index 1b38fe9be..29e697540 100644 --- a/volatility3/framework/plugins/linux/check_afinfo.py +++ b/volatility3/framework/plugins/linux/check_afinfo.py @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class Check_afinfo(plugins.PluginInterface): """Verifies the operation function pointers of network protocols.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/check_creds.py b/volatility3/framework/plugins/linux/check_creds.py index 0d87bce2a..2333eb123 100644 --- a/volatility3/framework/plugins/linux/check_creds.py +++ b/volatility3/framework/plugins/linux/check_creds.py @@ -14,7 +14,7 @@ vollog = logging.getLogger(__name__) class Check_creds(interfaces.plugins.PluginInterface): """Checks if any processes are sharing credential structures""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/linux/check_idt.py b/volatility3/framework/plugins/linux/check_idt.py index 0e021bb5c..f171ab846 100644 --- a/volatility3/framework/plugins/linux/check_idt.py +++ b/volatility3/framework/plugins/linux/check_idt.py @@ -17,7 +17,7 @@ vollog = logging.getLogger(__name__) class Check_idt(interfaces.plugins.PluginInterface): """ Checks if the IDT has been altered """ - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index bdd8d921d..449046e86 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class Check_modules(plugins.PluginInterface): """Compares module list to sysfs info, if available""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/check_syscall.py b/volatility3/framework/plugins/linux/check_syscall.py index 4a4381b8b..b845ad4aa 100644 --- a/volatility3/framework/plugins/linux/check_syscall.py +++ b/volatility3/framework/plugins/linux/check_syscall.py @@ -25,7 +25,7 @@ except ImportError: class Check_syscall(plugins.PluginInterface): """Check system call table for hooks.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/elfs.py b/volatility3/framework/plugins/linux/elfs.py index ac8b9fbfb..89909f4ff 100644 --- a/volatility3/framework/plugins/linux/elfs.py +++ b/volatility3/framework/plugins/linux/elfs.py @@ -17,7 +17,7 @@ from volatility3.plugins.linux import pslist class Elfs(plugins.PluginInterface): """Lists all memory mapped ELF files for all processes.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/keyboard_notifiers.py b/volatility3/framework/plugins/linux/keyboard_notifiers.py index cd7a70b34..290c0a180 100644 --- a/volatility3/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility3/framework/plugins/linux/keyboard_notifiers.py @@ -16,7 +16,7 @@ vollog = logging.getLogger(__name__) class Keyboard_notifiers(interfaces.plugins.PluginInterface): """Parses the keyboard notifier call chain""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index d75a9dff4..2d390cc82 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/linux/lsof.py b/volatility3/framework/plugins/linux/lsof.py index b9a686a44..153d28f6a 100644 --- a/volatility3/framework/plugins/linux/lsof.py +++ b/volatility3/framework/plugins/linux/lsof.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Lsof(plugins.PluginInterface): """Lists all memory maps for all processes.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py index 41339cca2..149222f37 100644 --- a/volatility3/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -15,7 +15,7 @@ from volatility3.plugins.linux import pslist class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/proc.py b/volatility3/framework/plugins/linux/proc.py index 53e9297de..8bd0db538 100644 --- a/volatility3/framework/plugins/linux/proc.py +++ b/volatility3/framework/plugins/linux/proc.py @@ -15,7 +15,7 @@ from volatility3.plugins.linux import pslist class Maps(plugins.PluginInterface): """Lists all memory maps for all processes.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index 4c6d294e1..78fce978b 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -12,7 +12,7 @@ from volatility3.framework.objects import utility class PsList(interfaces.plugins.PluginInterface): """Lists the processes present in a particular linux memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) diff --git a/volatility3/framework/plugins/linux/pstree.py b/volatility3/framework/plugins/linux/pstree.py index ff47be760..a187ea907 100644 --- a/volatility3/framework/plugins/linux/pstree.py +++ b/volatility3/framework/plugins/linux/pstree.py @@ -10,7 +10,7 @@ class PsTree(pslist.PsList): """Plugin for listing processes in a tree based on their parent process ID.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/linux/tty_check.py b/volatility3/framework/plugins/linux/tty_check.py index 3693b6150..fe35d8fa3 100644 --- a/volatility3/framework/plugins/linux/tty_check.py +++ b/volatility3/framework/plugins/linux/tty_check.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class tty_check(plugins.PluginInterface): """Checks tty devices for hooks""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/bash.py b/volatility3/framework/plugins/mac/bash.py index 3540db6fb..6b453759e 100644 --- a/volatility3/framework/plugins/mac/bash.py +++ b/volatility3/framework/plugins/mac/bash.py @@ -20,7 +20,7 @@ from volatility3.plugins.mac import pslist class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): """Recovers bash command history from memory.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/check_syscall.py b/volatility3/framework/plugins/mac/check_syscall.py index 530e2f031..4f367001e 100644 --- a/volatility3/framework/plugins/mac/check_syscall.py +++ b/volatility3/framework/plugins/mac/check_syscall.py @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class Check_syscall(plugins.PluginInterface): """Check system call table for hooks.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/check_sysctl.py b/volatility3/framework/plugins/mac/check_sysctl.py index 2096b291a..4ea1d8af0 100644 --- a/volatility3/framework/plugins/mac/check_sysctl.py +++ b/volatility3/framework/plugins/mac/check_sysctl.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class Check_sysctl(plugins.PluginInterface): """Check sysctl handlers for hooks.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/check_trap_table.py b/volatility3/framework/plugins/mac/check_trap_table.py index b2861d5d5..0584d9ff7 100644 --- a/volatility3/framework/plugins/mac/check_trap_table.py +++ b/volatility3/framework/plugins/mac/check_trap_table.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Check_trap_table(plugins.PluginInterface): """Check mach trap table for hooks.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/ifconfig.py b/volatility3/framework/plugins/mac/ifconfig.py index 501ba8a56..5c4e5728e 100644 --- a/volatility3/framework/plugins/mac/ifconfig.py +++ b/volatility3/framework/plugins/mac/ifconfig.py @@ -11,7 +11,7 @@ from volatility3.framework.symbols import mac class Ifconfig(plugins.PluginInterface): """Lists loaded kernel modules""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/kauth_listeners.py b/volatility3/framework/plugins/mac/kauth_listeners.py index f4bbeaa4c..930239db9 100644 --- a/volatility3/framework/plugins/mac/kauth_listeners.py +++ b/volatility3/framework/plugins/mac/kauth_listeners.py @@ -13,7 +13,7 @@ from volatility3.plugins.mac import lsmod, kauth_scopes class Kauth_listeners(interfaces.plugins.PluginInterface): """ Lists kauth listeners and their status """ - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/kauth_scopes.py b/volatility3/framework/plugins/mac/kauth_scopes.py index d63c72322..a5f57d9a1 100644 --- a/volatility3/framework/plugins/mac/kauth_scopes.py +++ b/volatility3/framework/plugins/mac/kauth_scopes.py @@ -16,7 +16,7 @@ class Kauth_scopes(interfaces.plugins.PluginInterface): """ Lists kauth scopes and their status """ _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/kevents.py b/volatility3/framework/plugins/mac/kevents.py index 45bb29305..a6d905102 100644 --- a/volatility3/framework/plugins/mac/kevents.py +++ b/volatility3/framework/plugins/mac/kevents.py @@ -14,7 +14,7 @@ from volatility3.plugins.mac import pslist class Kevents(interfaces.plugins.PluginInterface): """ Lists event handlers registered by processes """ - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) event_types = { 1: "EVFILT_READ", diff --git a/volatility3/framework/plugins/mac/lsmod.py b/volatility3/framework/plugins/mac/lsmod.py index 81639115d..b536a112b 100644 --- a/volatility3/framework/plugins/mac/lsmod.py +++ b/volatility3/framework/plugins/mac/lsmod.py @@ -13,7 +13,7 @@ from volatility3.framework.renderers import format_hints class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) diff --git a/volatility3/framework/plugins/mac/lsof.py b/volatility3/framework/plugins/mac/lsof.py index 38351009a..f4fb725a0 100644 --- a/volatility3/framework/plugins/mac/lsof.py +++ b/volatility3/framework/plugins/mac/lsof.py @@ -16,7 +16,7 @@ vollog = logging.getLogger(__name__) class Lsof(plugins.PluginInterface): """Lists all open file descriptors for all processes.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/malfind.py b/volatility3/framework/plugins/mac/malfind.py index 64d7b5010..20b46528b 100644 --- a/volatility3/framework/plugins/mac/malfind.py +++ b/volatility3/framework/plugins/mac/malfind.py @@ -14,7 +14,7 @@ from volatility3.plugins.mac import pslist class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/mount.py b/volatility3/framework/plugins/mac/mount.py index 57ea9e5b6..3500e5ff1 100644 --- a/volatility3/framework/plugins/mac/mount.py +++ b/volatility3/framework/plugins/mac/mount.py @@ -14,7 +14,7 @@ class Mount(plugins.PluginInterface): """A module containing a collection of plugins that produce data typically foundin Mac's mount command""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) diff --git a/volatility3/framework/plugins/mac/netstat.py b/volatility3/framework/plugins/mac/netstat.py index 3e04d5899..4b9f539fd 100644 --- a/volatility3/framework/plugins/mac/netstat.py +++ b/volatility3/framework/plugins/mac/netstat.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Netstat(plugins.PluginInterface): """Lists all network connections for all processes.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/proc_maps.py b/volatility3/framework/plugins/mac/proc_maps.py index 3a0bef5ba..2ff80c47e 100644 --- a/volatility3/framework/plugins/mac/proc_maps.py +++ b/volatility3/framework/plugins/mac/proc_maps.py @@ -12,7 +12,7 @@ from volatility3.plugins.mac import pslist class Maps(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/psaux.py b/volatility3/framework/plugins/mac/psaux.py index 1bb720575..97f61c02e 100644 --- a/volatility3/framework/plugins/mac/psaux.py +++ b/volatility3/framework/plugins/mac/psaux.py @@ -14,7 +14,7 @@ from volatility3.plugins.mac import pslist class Psaux(plugins.PluginInterface): """Recovers program command line arguments.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/pslist.py b/volatility3/framework/plugins/mac/pslist.py index c9253e093..8ef7876f1 100644 --- a/volatility3/framework/plugins/mac/pslist.py +++ b/volatility3/framework/plugins/mac/pslist.py @@ -16,7 +16,7 @@ vollog = logging.getLogger(__name__) class PsList(interfaces.plugins.PluginInterface): """Lists the processes present in a particular mac memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (2, 0, 0) pslist_methods = ['tasks', 'allproc', 'process_group', 'sessions', 'pid_hash_table'] diff --git a/volatility3/framework/plugins/mac/pstree.py b/volatility3/framework/plugins/mac/pstree.py index e499aa300..ea70a5d4c 100644 --- a/volatility3/framework/plugins/mac/pstree.py +++ b/volatility3/framework/plugins/mac/pstree.py @@ -13,7 +13,7 @@ class PsTree(plugins.PluginInterface): """Plugin for listing processes in a tree based on their parent process ID.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/mac/socket_filters.py b/volatility3/framework/plugins/mac/socket_filters.py index b2bcba759..40fc6ffe0 100644 --- a/volatility3/framework/plugins/mac/socket_filters.py +++ b/volatility3/framework/plugins/mac/socket_filters.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Socket_filters(plugins.PluginInterface): """Enumerates kernel socket filters.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/timers.py b/volatility3/framework/plugins/mac/timers.py index 3169b2aeb..912388ffb 100644 --- a/volatility3/framework/plugins/mac/timers.py +++ b/volatility3/framework/plugins/mac/timers.py @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class Timers(plugins.PluginInterface): """Check for malicious kernel timers.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/trustedbsd.py b/volatility3/framework/plugins/mac/trustedbsd.py index d515959fb..b03663625 100644 --- a/volatility3/framework/plugins/mac/trustedbsd.py +++ b/volatility3/framework/plugins/mac/trustedbsd.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class Trustedbsd(plugins.PluginInterface): """Checks for malicious trustedbsd modules""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/vfsevents.py b/volatility3/framework/plugins/mac/vfsevents.py index 9d4db7b97..97b23168c 100644 --- a/volatility3/framework/plugins/mac/vfsevents.py +++ b/volatility3/framework/plugins/mac/vfsevents.py @@ -10,7 +10,7 @@ from volatility3.framework.objects import utility class VFSevents(interfaces.plugins.PluginInterface): """ Lists processes that are filtering file system events """ - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) event_types = [ "CREATE_FILE", "DELETE", "STAT_CHANGED", "RENAME", "CONTENT_MODIFIED", "EXCHANGE", "FINDER_INFO_CHANGED", diff --git a/volatility3/framework/plugins/timeliner.py b/volatility3/framework/plugins/timeliner.py index 2ec4d6961..bd6377ca1 100644 --- a/volatility3/framework/plugins/timeliner.py +++ b/volatility3/framework/plugins/timeliner.py @@ -42,7 +42,7 @@ class Timeliner(interfaces.plugins.PluginInterface): """Runs all relevant plugins that provide time related information and orders the results by time.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/bigpools.py b/volatility3/framework/plugins/windows/bigpools.py index 12d4d1f28..a2c23a31c 100644 --- a/volatility3/framework/plugins/windows/bigpools.py +++ b/volatility3/framework/plugins/windows/bigpools.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class BigPools(interfaces.plugins.PluginInterface): """List big page pools.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 02e3a540c..42bb93a73 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -17,7 +17,7 @@ from volatility3.plugins.windows.registry import hivelist class Cachedump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py index 7702d67a7..545ff9811 100644 --- a/volatility3/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Callbacks(interfaces.plugins.PluginInterface): """Lists kernel callbacks and notification routines.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/cmdline.py b/volatility3/framework/plugins/windows/cmdline.py index dfcf07f38..bf5cc4bfe 100644 --- a/volatility3/framework/plugins/windows/cmdline.py +++ b/volatility3/framework/plugins/windows/cmdline.py @@ -15,7 +15,7 @@ vollog = logging.getLogger(__name__) class CmdLine(interfaces.plugins.PluginInterface): """Lists process command line arguments.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index c5912afa9..4740e5751 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the loaded modules in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (2, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/driverirp.py b/volatility3/framework/plugins/windows/driverirp.py index 27f86f3b0..64231b9db 100644 --- a/volatility3/framework/plugins/windows/driverirp.py +++ b/volatility3/framework/plugins/windows/driverirp.py @@ -22,7 +22,7 @@ MAJOR_FUNCTIONS = [ class DriverIrp(interfaces.plugins.PluginInterface): """List IRPs for drivers in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/windows/driverscan.py b/volatility3/framework/plugins/windows/driverscan.py index be941836f..7b44d4ebc 100644 --- a/volatility3/framework/plugins/windows/driverscan.py +++ b/volatility3/framework/plugins/windows/driverscan.py @@ -13,7 +13,7 @@ from volatility3.plugins.windows import poolscanner class DriverScan(interfaces.plugins.PluginInterface): """Scans for drivers present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py index e73de42fa..757dbd3c3 100755 --- a/volatility3/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -25,7 +25,7 @@ EXTENSION_CACHE_MAP = { class DumpFiles(interfaces.plugins.PluginInterface): """Dumps cached file contents from Windows memory samples.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py index 7abcfa159..8d3ee8506 100644 --- a/volatility3/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -16,7 +16,7 @@ class Envars(interfaces.plugins.PluginInterface): "Display process environment variables" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/windows/filescan.py b/volatility3/framework/plugins/windows/filescan.py index b53352b6e..e1756630d 100644 --- a/volatility3/framework/plugins/windows/filescan.py +++ b/volatility3/framework/plugins/windows/filescan.py @@ -13,7 +13,7 @@ from volatility3.plugins.windows import poolscanner class FileScan(interfaces.plugins.PluginInterface): """Scans for file objects present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py index c2029b937..2b5ab11f4 100644 --- a/volatility3/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -31,7 +31,7 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): """Lists process token sids.""" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index c9aa9cc5c..30503b2bf 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -29,7 +29,7 @@ class GetSIDs(interfaces.plugins.PluginInterface): """Print the SIDs owning each process""" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 2951a5bdc..d08f888e3 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -24,7 +24,7 @@ except ImportError: class Handles(interfaces.plugins.PluginInterface): """Lists process open handles.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) def __init__(self, *args, **kwargs): diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index d78684beb..ed2f1988a 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -21,7 +21,7 @@ vollog = logging.getLogger(__name__) class Hashdump(interfaces.plugins.PluginInterface): """Dumps user hashes from memory""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/windows/info.py b/volatility3/framework/plugins/windows/info.py index 3cb4f1bb7..76b81eb00 100644 --- a/volatility3/framework/plugins/windows/info.py +++ b/volatility3/framework/plugins/windows/info.py @@ -16,7 +16,7 @@ from volatility3.framework.symbols.windows import extensions class Info(plugins.PluginInterface): """Show OS & kernel details of the memory sample being analyzed.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 538933f7b..b9f8df9fe 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Lsadump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py index ed35ef649..eedd3b715 100644 --- a/volatility3/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -17,7 +17,7 @@ vollog = logging.getLogger(__name__) class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/windows/memmap.py b/volatility3/framework/plugins/windows/memmap.py index 42cf3b9b0..86d453115 100644 --- a/volatility3/framework/plugins/windows/memmap.py +++ b/volatility3/framework/plugins/windows/memmap.py @@ -15,7 +15,7 @@ vollog = logging.getLogger(__name__) class Memmap(interfaces.plugins.PluginInterface): """Prints the memory map""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/windows/modscan.py b/volatility3/framework/plugins/windows/modscan.py index 0a5cb7c9a..13b23577f 100644 --- a/volatility3/framework/plugins/windows/modscan.py +++ b/volatility3/framework/plugins/windows/modscan.py @@ -17,7 +17,7 @@ vollog = logging.getLogger(__name__) class ModScan(interfaces.plugins.PluginInterface): """Scans for modules present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index e1384a015..b030066db 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Modules(interfaces.plugins.PluginInterface): """Lists the loaded kernel modules.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 1, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/mutantscan.py b/volatility3/framework/plugins/windows/mutantscan.py index c886960c6..c0a47d38e 100644 --- a/volatility3/framework/plugins/windows/mutantscan.py +++ b/volatility3/framework/plugins/windows/mutantscan.py @@ -13,7 +13,7 @@ from volatility3.plugins.windows import poolscanner class MutantScan(interfaces.plugins.PluginInterface): """Scans for mutexes present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py index cb455aa03..0f58c97f5 100644 --- a/volatility3/framework/plugins/windows/netscan.py +++ b/volatility3/framework/plugins/windows/netscan.py @@ -21,7 +21,7 @@ vollog = logging.getLogger(__name__) class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for network objects present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index f61c8566b..b2ea449ea 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -115,7 +115,7 @@ class PoolScanner(plugins.PluginInterface): """A generic pool scanner plugin.""" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/windows/privileges.py b/volatility3/framework/plugins/windows/privileges.py index cfd2d70e0..8c652daa6 100644 --- a/volatility3/framework/plugins/windows/privileges.py +++ b/volatility3/framework/plugins/windows/privileges.py @@ -17,7 +17,7 @@ class Privs(interfaces.plugins.PluginInterface): """Lists process token privileges""" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index 1428936f0..f9fb20aaf 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the processes present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (2, 0, 0) PHYSICAL_DEFAULT = False diff --git a/volatility3/framework/plugins/windows/psscan.py b/volatility3/framework/plugins/windows/psscan.py index 2458ee42e..a5e20ef62 100644 --- a/volatility3/framework/plugins/windows/psscan.py +++ b/volatility3/framework/plugins/windows/psscan.py @@ -22,7 +22,7 @@ vollog = logging.getLogger(__name__) class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for processes present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 1, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/pstree.py b/volatility3/framework/plugins/windows/pstree.py index 0d79d3d5b..3b695ea70 100644 --- a/volatility3/framework/plugins/windows/pstree.py +++ b/volatility3/framework/plugins/windows/pstree.py @@ -14,7 +14,7 @@ class PsTree(interfaces.plugins.PluginInterface): """Plugin for listing processes in a tree based on their parent process ID.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs) -> None: super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/registry/hivelist.py b/volatility3/framework/plugins/windows/registry/hivelist.py index d5ac804a5..249118c8e 100644 --- a/volatility3/framework/plugins/windows/registry/hivelist.py +++ b/volatility3/framework/plugins/windows/registry/hivelist.py @@ -17,7 +17,7 @@ class HiveGenerator: """Walks the registry HiveList linked list in a given direction and stores an invalid offset if it's unable to fully walk the list""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, cmhive, forward = True): self._cmhive = cmhive @@ -40,7 +40,7 @@ class HiveList(interfaces.plugins.PluginInterface): """Lists the registry hives present in a particular memory image.""" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/windows/registry/hivescan.py b/volatility3/framework/plugins/windows/registry/hivescan.py index 558638cfd..ac04fcc02 100644 --- a/volatility3/framework/plugins/windows/registry/hivescan.py +++ b/volatility3/framework/plugins/windows/registry/hivescan.py @@ -15,7 +15,7 @@ class HiveScan(interfaces.plugins.PluginInterface): """Scans for registry hives present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index 5709b246d..5b0a909fc 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class PrintKey(interfaces.plugins.PluginInterface): """Lists the registry keys under a hive or specific key value.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index 16e997d0f..b2ce971bf 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -23,7 +23,7 @@ vollog = logging.getLogger(__name__) class UserAssist(interfaces.plugins.PluginInterface): """Print userassist registry keys and information.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/ssdt.py b/volatility3/framework/plugins/windows/ssdt.py index c510dec92..8092beb2f 100644 --- a/volatility3/framework/plugins/windows/ssdt.py +++ b/volatility3/framework/plugins/windows/ssdt.py @@ -18,7 +18,7 @@ from volatility3.plugins.windows import modules class SSDT(plugins.PluginInterface): """Lists the system call table.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/strings.py b/volatility3/framework/plugins/windows/strings.py index 8b18ef812..3e9fdfb85 100644 --- a/volatility3/framework/plugins/windows/strings.py +++ b/volatility3/framework/plugins/windows/strings.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Strings(interfaces.plugins.PluginInterface): """Reads output from the strings command and indicates which process(es) each string belongs to.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) strings_pattern = re.compile(rb"(?:\W*)([0-9]+)(?:\W*)(\w[\w\W]+)\n?") @classmethod diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py index 23648ada2..4820e5735 100644 --- a/volatility3/framework/plugins/windows/svcscan.py +++ b/volatility3/framework/plugins/windows/svcscan.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class SvcScan(interfaces.plugins.PluginInterface): """Scans for windows services.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/symlinkscan.py b/volatility3/framework/plugins/windows/symlinkscan.py index 7d8a54869..abfbd1d6d 100644 --- a/volatility3/framework/plugins/windows/symlinkscan.py +++ b/volatility3/framework/plugins/windows/symlinkscan.py @@ -15,7 +15,7 @@ from volatility3.plugins.windows import poolscanner class SymlinkScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for links present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py index 8d4ca027a..d50f596aa 100644 --- a/volatility3/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -33,7 +33,7 @@ winnt_protections = { class VadInfo(interfaces.plugins.PluginInterface): """Lists process memory ranges.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (2, 0, 0) MAXSIZE_DEFAULT = 0 diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index bf597140f..cdb349cf8 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -17,7 +17,7 @@ vollog = logging.getLogger(__name__) class VadYaraScan(interfaces.plugins.PluginInterface): """Scans all the Virtual Address Descriptor memory maps using yara.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/verinfo.py b/volatility3/framework/plugins/windows/verinfo.py index 52c8e462a..d65402a6a 100644 --- a/volatility3/framework/plugins/windows/verinfo.py +++ b/volatility3/framework/plugins/windows/verinfo.py @@ -25,7 +25,7 @@ except ImportError: class VerInfo(interfaces.plugins.PluginInterface): """Lists version information from PE files.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/windows/virtmap.py b/volatility3/framework/plugins/windows/virtmap.py index 93ec763cc..552564cad 100644 --- a/volatility3/framework/plugins/windows/virtmap.py +++ b/volatility3/framework/plugins/windows/virtmap.py @@ -16,7 +16,7 @@ vollog = logging.getLogger(__name__) class VirtMap(interfaces.plugins.PluginInterface): """Lists virtual mapped sections.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py index 8c49c0824..1c04e2311 100644 --- a/volatility3/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -37,7 +37,7 @@ class YaraScanner(interfaces.layers.ScannerInterface): class YaraScan(plugins.PluginInterface): """Scans kernel memory using yara rules (string or file).""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index fac98423a..909e852fb 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -10,7 +10,7 @@ from volatility3.plugins.windows.registry import hivelist, printkey class Certificates(interfaces.plugins.PluginInterface): """Lists the certificates in the registry's Certificate Store.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/plugins/windows/statistics.py b/volatility3/plugins/windows/statistics.py index e6f2016ed..b3bc8044f 100644 --- a/volatility3/plugins/windows/statistics.py +++ b/volatility3/plugins/windows/statistics.py @@ -13,7 +13,7 @@ vollog = logging.getLogger(__name__) class Statistics(plugins.PluginInterface): - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From 79e2a1494bfe189fc74b4c5a244b8a043042de48 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 20 Jan 2021 21:46:20 +0000 Subject: [PATCH 20/28] Documentation: Minor rename fixes. --- .gitignore | 2 +- doc/Makefile | 2 +- doc/source/conf.py | 2 +- doc/source/index.rst | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index eba1ee1a5..c6da33754 100644 --- a/.gitignore +++ b/.gitignore @@ -4,7 +4,7 @@ __pycache__ # Sphinx generated files doc/build -doc/source/volatility.* +doc/source/volatility3.* # Pycharm/PyDev development files workspace.xml diff --git a/doc/Makefile b/doc/Makefile index ffbbdf26e..2e1d1408a 100644 --- a/doc/Makefile +++ b/doc/Makefile @@ -15,7 +15,7 @@ help: # Ensure we clean the autodoc files when we clean clean: - -rm source/volatility.*.rst + -rm source/volatility3.*.rst @$(SPHINXBUILD) -M clean "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O) # Catch-all target: route all unknown targets to Sphinx using the new diff --git a/doc/source/conf.py b/doc/source/conf.py index 6a382be3b..eab5c2c94 100644 --- a/doc/source/conf.py +++ b/doc/source/conf.py @@ -66,7 +66,7 @@ def setup(app): elif filename == 'volatility3.plugins.rst': with open(os.path.join(dir, filename), "rb") as contents: lines = contents.readlines() - with open(os.path.join(dir, 'volatility.framework.plugins.rst'), "rb") as contents: + with open(os.path.join(dir, 'volatility3.framework.plugins.rst'), "rb") as contents: real_lines = contents.readlines() # Process real_lines diff --git a/doc/source/index.rst b/doc/source/index.rst index c61e6e847..f8cdb690f 100644 --- a/doc/source/index.rst +++ b/doc/source/index.rst @@ -5,7 +5,7 @@ This is the documentation for Volatility 3, the most advanced memory forensics framework in the world. Like previous versions of the Volatility framework, Volatility 3 is Open Source. -:doc:`List of plugins ` +:doc:`List of plugins ` Here are some guidelines for using Volatility 3 effectively: @@ -22,7 +22,7 @@ Python Packages =============== .. toctree:: - volatility + volatility3 Indices and tables ================== From fc75c14002fa86a5d79b3a94ae51c58609fd1a6f Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 20 Jan 2021 21:47:12 +0000 Subject: [PATCH 21/28] CLI: Make sure the program name doesn't look weird --- volatility3/cli/__init__.py | 2 +- volatility3/cli/volshell/__init__.py | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index 02b8d1cb0..27d85a22b 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -71,7 +71,7 @@ class MuteProgress(PrintedProgress): class CommandLine: """Constructs a command-line interface object for users to run plugins.""" - CLI_NAME = 'volatility3' + CLI_NAME = 'volatility' def __init__(self): self.setup_logging() diff --git a/volatility3/cli/volshell/__init__.py b/volatility3/cli/volshell/__init__.py index 4a7cb5380..6dde83905 100644 --- a/volatility3/cli/volshell/__init__.py +++ b/volatility3/cli/volshell/__init__.py @@ -33,6 +33,8 @@ class VolShell(cli.CommandLine): python terminal with all the volatility support calls available. """ + CLI_NAME = "volshell" + def __init__(self): super().__init__() self.output_dir = None @@ -44,7 +46,7 @@ class VolShell(cli.CommandLine): framework.require_interface_version(1, 0, 0) - parser = argparse.ArgumentParser(prog = 'volshell', + parser = argparse.ArgumentParser(prog = self.CLI_NAME, description = "A tool for interactivate forensic analysis of memory images") parser.add_argument("-c", "--config", From 5235f434168806d7a3318f3ec6d8adc7d47a4564 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 20 Jan 2021 21:55:32 +0000 Subject: [PATCH 22/28] Plugins: Fix list_files with suitable required version. --- volatility/framework/plugins/mac/list_files.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/volatility/framework/plugins/mac/list_files.py b/volatility/framework/plugins/mac/list_files.py index a1a062113..3c341b2d0 100644 --- a/volatility/framework/plugins/mac/list_files.py +++ b/volatility/framework/plugins/mac/list_files.py @@ -18,6 +18,8 @@ vollog = logging.getLogger(__name__) class List_Files(plugins.PluginInterface): """Lists all open file descriptors for all processes.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls): return [ From 5cabf271ea6099e847aeb60a1d0090f2f13eabe7 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 20 Jan 2021 21:55:32 +0000 Subject: [PATCH 23/28] Plugins: Fix list_files with suitable required version. --- volatility3/framework/plugins/mac/list_files.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/volatility3/framework/plugins/mac/list_files.py b/volatility3/framework/plugins/mac/list_files.py index e9901c478..557e735ed 100644 --- a/volatility3/framework/plugins/mac/list_files.py +++ b/volatility3/framework/plugins/mac/list_files.py @@ -18,6 +18,8 @@ vollog = logging.getLogger(__name__) class List_Files(plugins.PluginInterface): """Lists all open file descriptors for all processes.""" + _required_framework_version = (1, 0, 0) + @classmethod def get_requirements(cls): return [ From eae2ad8748a4eb58c2fc8933f024c10c3d911ce8 Mon Sep 17 00:00:00 2001 From: "Nick L. Petroni, Jr" Date: Thu, 28 Jan 2021 10:01:53 -0500 Subject: [PATCH 24/28] add GitHub Action to build PyPI and source artifacts --- .github/workflows/build-pypi.yml | 42 ++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 .github/workflows/build-pypi.yml diff --git a/.github/workflows/build-pypi.yml b/.github/workflows/build-pypi.yml new file mode 100644 index 000000000..f007620ce --- /dev/null +++ b/.github/workflows/build-pypi.yml @@ -0,0 +1,42 @@ +name: build-pypi + +on: + push: + branches: + - master + - develop + - 'release/**' + + pull_request: + branches: + - develop + - 'release/**' + +jobs: + + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v2 + + - name: Set up Python 3.x + uses: actions/setup-python@v2 + with: + python-version: '3.x' + + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install setuptools wheel + + - name: Build PyPi packages + run: | + python setup.py sdist --formats=gztar,zip + python setup.py bdist_wheel + + - name: Archive dist + uses: actions/upload-artifact@v2 + with: + name: volatility3-pypi + path: | + dist/ From 888ed1fbb8d548d90cd07e0bfb7fdd727d690645 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 29 Jan 2021 09:17:25 +0000 Subject: [PATCH 25/28] Documentation: Ensure the JSON files are included --- MANIFEST.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/MANIFEST.in b/MANIFEST.in index 4e5bbf6a1..504c7d89a 100644 --- a/MANIFEST.in +++ b/MANIFEST.in @@ -2,5 +2,5 @@ prune development include * .* include doc/make.bat doc/Makefile recursive-include doc/source * -recursive-include volatility *.json -recursive-exclude doc/source volatility*.rst +recursive-include volatility3 *.json +recursive-exclude doc/source volatility3.*.rst From cc58360ebb96fcd92456960253966868ccd262c2 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 30 Jan 2021 13:47:00 +0000 Subject: [PATCH 26/28] Documentation fix remaining volatility path issues --- README.md | 2 +- doc/source/complex-plugin.rst | 2 +- doc/source/symbol-tables.rst | 4 ++-- setup.py | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 1da1d4bdf..f48bf728f 100644 --- a/README.md +++ b/README.md @@ -77,7 +77,7 @@ The hashes to verify whether any of the symbol pack files have downloaded succes -Symbol tables zip files must be placed, as named, into the `volatility/symbols` directory (or just the symbols directory next to the executable file). +Symbol tables zip files must be placed, as named, into the `volatility3/symbols` directory (or just the symbols directory next to the executable file). Windows symbols that cannot be found will be queried, downloaded, generated and cached. Mac and Linux symbol tables must be manually produced by a tool such as [dwarf2json](https://github.com/volatilityfoundation/dwarf2json). diff --git a/doc/source/complex-plugin.rst b/doc/source/complex-plugin.rst index e7852aaf5..23a45f079 100644 --- a/doc/source/complex-plugin.rst +++ b/doc/source/complex-plugin.rst @@ -115,7 +115,7 @@ Constructing an appropriate file, the file can be loaded into a symbol table as table_name = intermed.IntermediateSymbolTable.create(context, config_path, 'sub_path', 'filename') -This code will load a JSON file from one of the standard symbol paths (volatility/symbols and volatility/framework/symbols) +This code will load a JSON file from one of the standard symbol paths (volatility3/symbols and volatility3/framework/symbols) under the additional directory sub_path, with a name matching filename.json (the extension should not be included in the filename). diff --git a/doc/source/symbol-tables.rst b/doc/source/symbol-tables.rst index 4e44e8368..fd94dea4d 100644 --- a/doc/source/symbol-tables.rst +++ b/doc/source/symbol-tables.rst @@ -12,7 +12,7 @@ Volatility will automatically decompress them on use. It will also cache their under the user's home directory, in :file:`.cache/volatility3`, along with other useful data. The cache directory currently cannot be altered. -Symbol table JSON files live, by default, under the :file:`volatility/symbols`, underneath an operating system directory +Symbol table JSON files live, by default, under the :file:`volatility3/symbols`, underneath an operating system directory (currently one of :file:`windows`, :file:`mac` or :file:`linux`). The symbols directory is configurable within the framework and can usually be set within the user interface. @@ -33,7 +33,7 @@ Windows symbol tables can be manually constructed from an appropriate PDB file. is built into Volatility 3, called :file:`pdbconv.py`. It can be run from the top-level Volatility path, using the following command: -:command:`PYTHONPATH="." python volatility/framework/symbols/windows/pdbconv.py` +:command:`PYTHONPATH="." python volatility3/framework/symbols/windows/pdbconv.py` The :envvar:`PYTHONPATH` environment variable is not required if the Volatility library is installed in the system's library path or a virtual environment. diff --git a/setup.py b/setup.py index 168c7a4cf..64d9bf2d1 100644 --- a/setup.py +++ b/setup.py @@ -16,7 +16,7 @@ setuptools.setup(name = "volatility3", url = "https://volatilityfoundation.org/volatility/", project_urls = { "Bug Tracker": "https://github.com/volatilityfoundation/volatility3/issues", - "Documentation": "https://volatilityfoundation.org/volatility/docs/", + "Documentation": "https://volatility3.readthedocs.io/", "Source Code": "https://github.com/volatilityfoundation/volatility3", }, include_package_data = True, From 77fc5b636065ec2161e2074cc87f44f9caaff892 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 30 Jan 2021 17:24:08 +0000 Subject: [PATCH 27/28] Documentation: Ensure all references in the docs are accurate --- doc/source/basics.rst | 56 ++++++++++++------------- doc/source/complex-plugin.rst | 68 +++++++++++++++---------------- doc/source/simple-plugin.rst | 56 ++++++++++++------------- doc/source/using-as-a-library.rst | 46 ++++++++++----------- doc/source/vol2to3.rst | 18 ++++---- 5 files changed, 122 insertions(+), 122 deletions(-) diff --git a/doc/source/basics.rst b/doc/source/basics.rst index 77dedf63b..d493c61b3 100644 --- a/doc/source/basics.rst +++ b/doc/source/basics.rst @@ -7,7 +7,7 @@ Volatility splits memory analysis down to several components: * Templates and Objects * Symbol Tables -Volatility 3 stores all of these within a :py:class:`Context `, +Volatility 3 stores all of these within a :py:class:`Context `, which acts as a container for all the various layers and tables necessary to conduct memory analysis. Memory layers @@ -21,8 +21,8 @@ two other sources. These are typically handled by programs that process file fo processor, but these are all translations (either in the geometric or linguistic sense) of the original data. In Volatility 3 this is represented by a directed graph, whose end nodes are -:py:class:`DataLayers ` and whose internal nodes are -specifically called a :py:class:`TranslationLayer `. +:py:class:`DataLayers ` and whose internal nodes are +specifically called a :py:class:`TranslationLayer `. In this way, a raw memory image in the LiME file format and a page file can be combined to form a single Intel virtual memory layer. When requesting addresses from the Intel layer, it will use the Intel memory mapping algorithm, along with the address of the directory table base or page table map, to translate that @@ -39,17 +39,17 @@ Templates and Objects Once we can address contiguous chunks of memory with a means to translate a virtual address (as seen by the programs) into the actual data used by the processor, we can start pulling out -:py:class:`Objects ` by taking a -:py:class:`~volatility.framework.interfaces.objects.Template` and constructing -it on the memory layer at a specific offset. A :py:class:`~volatility.framework.interfaces.objects.Template` contains +:py:class:`Objects ` by taking a +:py:class:`~volatility3.framework.interfaces.objects.Template` and constructing +it on the memory layer at a specific offset. A :py:class:`~volatility3.framework.interfaces.objects.Template` contains all the information you can know about the structure of the object without actually being populated by any data. -As such a :py:class:`~volatility.framework.interfaces.objects.Template` can tell you the size of a structure and its +As such a :py:class:`~volatility3.framework.interfaces.objects.Template` can tell you the size of a structure and its members, how far into the structure a particular member lives and potentially what various values in that field would mean, but not what resides in a particular member. -Using a :py:class:`~volatility.framework.interfaces.objects.Template` on a memory layer at a particular offset, an -:py:class:`Object ` can be constructed. In Volatility 3, once an -:py:class:`Object ` has been created, the data has been read from the +Using a :py:class:`~volatility3.framework.interfaces.objects.Template` on a memory layer at a particular offset, an +:py:class:`Object ` can be constructed. In Volatility 3, once an +:py:class:`Object ` has been created, the data has been read from the layer and is not read again. An object allows its members to be interrogated and in particular allows pointers to be followed, providing easy access to the data contained in the object. @@ -62,23 +62,23 @@ Symbol Tables ------------- Most compiled programs know of their own templates, and define the structure (and location within the program) of these -templates as a :py:class:`Symbol `. A -:py:class:`Symbol ` is often an address and a template and can +templates as a :py:class:`Symbol `. A +:py:class:`Symbol ` is often an address and a template and can be used to refer to either independently. Lookup tables of these symbols are often produced as debugging information alongside the compilation of the program. Volatility 3 provides access to these through a -:py:class:`SymbolTable `, many of which can be collected -within a :py:class:`~volatility.framework.contexts.Context` as a :py:class:`SymbolSpace `. -A :py:class:`~volatility.framework.contexts.Context` can store only one :py:class:`~volatility.framework.symbols.SymbolSpace` -at a time, although a :py:class:`~volatility.framework.symbols.SymbolSpace` can store as -many :py:class:`~volatility.framework.symbols.SymbolTable` items as necessary. +:py:class:`SymbolTable `, many of which can be collected +within a :py:class:`~volatility3.framework.contexts.Context` as a :py:class:`SymbolSpace `. +A :py:class:`~volatility3.framework.contexts.Context` can store only one :py:class:`~volatility.framework.symbols.SymbolSpace` +at a time, although a :py:class:`~volatility3.framework.symbols.SymbolSpace` can store as +many :py:class:`~volatility3.framework.symbols.SymbolTable` items as necessary. Volatility 3 uses the de facto naming convention for symbols of `module!symbol` to refer to them. It reads them from its own JSON formatted file, which acts as a common intermediary between Windows PDB files, Linux DWARF files, other symbol formats and the internal Python format that Volatility 3 uses to represent -a :py:class:`~volatility.framework.interfaces.objects.Template` or -a :py:class:`Symbol `. +a :py:class:`~volatility3.framework.interfaces.objects.Template` or +a :py:class:`Symbol `. -.. note:: Volatility 2's name for a :py:class:`~volatility.framework.symbols.SymbolSpace` was a profile, but it could +.. note:: Volatility 2's name for a :py:class:`~volatility3.framework.symbols.SymbolSpace` was a profile, but it could not differentiate between symbols from different modules and required special handling for 32-bit programs that used Wow64 on Windows. This meant that all symbols lived in a single namespace with the possibility of symbol name collisions. It read the symbols using a format called *vtypes*, written in Python code directly. @@ -88,18 +88,18 @@ Plugins ------- A plugin acts as a means of requesting data from the user interface (and so the user) and then using it to carry out a -specific form of analysis on the :py:class:`Context ` +specific form of analysis on the :py:class:`Context ` (containing whatever symbol tables and memory layers it may). The means of communication between the user interface and -the library is the configuration tree, which is used by components within the :py:class:`~volatility.framework.contexts.Context` +the library is the configuration tree, which is used by components within the :py:class:`~volatility3.framework.contexts.Context` to store configurable data. After the plugin has been run, it then returns the results in a specific format known as a -:py:class:`~volatility.framework.interfaces.renderers.TreeGrid`. This ensures that the data can be handled by consumers of +:py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`. This ensures that the data can be handled by consumers of the library, without knowing exactly what the data is or how it's formatted. Output Renderers ---------------- User interfaces can choose how best to present the output of the results to their users. The library always responds from -every plugin with a :py:class:`~volatility.framework.renderers.TreeGrid`, and the user interface can then determine how +every plugin with a :py:class:`~volatility3.framework.renderers.TreeGrid`, and the user interface can then determine how best to display it. For the Command Line Interface, that might be via text output as a table, or it might output to an SQLite database or a CSV file. For a web interface, the best output is probably as JSON where it could be displayed as a table, or inserted into a database like Elastic Search and trawled using an existing frontend such as Kibana. @@ -111,9 +111,9 @@ Configuration Tree ------------------ The configuration tree acts as the interface between the calling program and Volatility 3 library. Elements of the -library (such as a :py:class:`Plugin `, -a :py:class:`TranslationLayer `, -an :py:class:`Automagic `, etc.) can use the configuration +library (such as a :py:class:`Plugin `, +a :py:class:`TranslationLayer `, +an :py:class:`Automagic `, etc.) can use the configuration tree to inform the calling program of the options they require and/or optionally support, and allows the calling program to provide that information when the library is then called. @@ -122,7 +122,7 @@ Automagic There are certain setup tasks that establish the context in a way favorable to a plugin before it runs, removing several tasks that are repetitive and also easy to get wrong. These are called -:py:class:`Automagic `, since they do things like magically +:py:class:`Automagic `, since they do things like magically taking a raw memory image and automatically providing the plugin with an appropriate Intel translation layer and an accurate symbol table without either the plugin or the calling program having to specify all the necessary details. diff --git a/doc/source/complex-plugin.rst b/doc/source/complex-plugin.rst index 23a45f079..f06b398e8 100644 --- a/doc/source/complex-plugin.rst +++ b/doc/source/complex-plugin.rst @@ -6,17 +6,17 @@ which are discussed below. Writing Reusable Methods ------------------------ -Classes which inherit from :py:class:`~volatility.framework.interfaces.plugins.PluginInterface` all have a :py:meth:`run()` method -which takes no parameters and will return a :py:class:`~volatility.framework.interfaces.renderers.TreeGrid`. Since most useful +Classes which inherit from :py:class:`~volatility3.framework.interfaces.plugins.PluginInterface` all have a :py:meth:`run()` method +which takes no parameters and will return a :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`. Since most useful functions are parameterized, to provide parameters to a plugin the `configuration` for the context must be appropriately manipulated. There is scope for this, in order to run multiple plugins (see `Writing plugins that run other plugins`) but a much simpler method is to provide a parameterized `classmethod` within the plugin, which will allow the method to yield whatever kind of output it will generate and take whatever parameters it might need. This is how processes are listed, which is an often used function. The code lives within the -:py:class:`~volatility.plugins.windows.pslist.PsList` plugin but can be used by other plugins by providing the +:py:class:`~volatility3.plugins.windows.pslist.PsList` plugin but can be used by other plugins by providing the appropriate parameters (see -:py:meth:`~volatility.plugins.windows.pslist.PsList.list_processes`). +:py:meth:`~volatility3.plugins.windows.pslist.PsList.list_processes`). It is up to the author of a plugin to validate that any required plugins are present and are the appropriate version. Writing plugins that run other plugins @@ -34,7 +34,7 @@ available plugins that feature a Timeliner interface). This can be achieved wit This code will first generate suitable automagics for running against the context. Unfortunately this must be re-run for each plugin in order to populate the context's configuration correctly based on the plugin's requirements (which may vary between plugins). Once the automagics have been constructed, the plugin can be instantiated using the helper function -:py:func:`~volatility.framework.plugins.construct_plugin` providing: +:py:func:`~volatility3.framework.plugins.construct_plugin` providing: * the base context (containing the configuration and any already loaded layers or symbol tables), * the plugin class to run, @@ -43,7 +43,7 @@ between plugins). Once the automagics have been constructed, the plugin can be * an open method for the plugin to create files during the run With the constructed plugin, it can either be run by calling its -:py:meth:`~volatility.framework.interfaces.plugins.PluginInterface.run` method, or any other known method can +:py:meth:`~volatility3.framework.interfaces.plugins.PluginInterface.run` method, or any other known method can be invoked on it. Writing plugins that output files @@ -55,7 +55,7 @@ an abstraction layer is used. The user interface specifies an open_method (which is actually a class constructor that can double as a python ContextManager, so it can be used by the python `with` keyword). This is set on the plugin using `plugin.set_open_method` and can then be called or accessed using `plugin.open(preferred_filename)`. There are no additional options -that can be set on the filename, and a :py:class:`~volatility.framework.interfaces.plugins.FileHandlerInterface` is the result. +that can be set on the filename, and a :py:class:`~volatility3.framework.interfaces.plugins.FileHandlerInterface` is the result. This mimics an `IO[bytes]` object, which closely mimics a standard python file-like object. As such code for outputting to a file would be expected to look something like: @@ -73,10 +73,10 @@ closed to allow the preferred filename to be changed (or data to be added/modifi Writing Scanners ---------------- -Scanners are objects that adhere to the :py:class:`~volatility.framework.interfaces.layers.ScannerInterface`. They are -passed to the :py:meth:`~volatility.framework.interfaces.layers.TranslationLayerInterface.scan` method on layers which will +Scanners are objects that adhere to the :py:class:`~volatility3.framework.interfaces.layers.ScannerInterface`. They are +passed to the :py:meth:`~volatility3.framework.interfaces.layers.TranslationLayerInterface.scan` method on layers which will divide the provided range of sections (or the entire layer -if none are provided) and call the :py:meth:`~volatility.framework.interfaces.layers.ScannerInterface`'s call method +if none are provided) and call the :py:meth:`~volatility3.framework.interfaces.layers.ScannerInterface`'s call method method with each chunk as a parameter, ensuring a suitable amount of overlap (as defined by the scanner). The offset of the chunk, within the layer, is also provided as a parameter. @@ -96,7 +96,7 @@ Writing/Using Intermediate Symbol Format Files ---------------------------------------------- It can occasionally be useful to create a data file containing the static structures that can create a -:py:class:`~volatility.framework.interfaces.objects.Template` to be instantiated on a layer. +:py:class:`~volatility3.framework.interfaces.objects.Template` to be instantiated on a layer. Volatility has all the machinery necessary to construct these for you from properly formatted JSON data. The JSON format is documented by the JSON schema files located in schemas. These are versioned using standard .so @@ -136,7 +136,7 @@ Another useful parameter is `table_mapping` which allows for type referenced ins table_mapping = {'one_table': 'another_table'}) The last parameter that can be used is called `class_types` which allows a particular structure to be instantiated on -a class other than :py:class:`~volatility.framework.objects.StructType`, allowing for additional methods to be defined +a class other than :py:class:`~volatility3.framework.objects.StructType`, allowing for additional methods to be defined and associated with the type. The table name can then by used to access the constructed table from the context, such as: @@ -152,7 +152,7 @@ Translation layers offer a way for data to be translated from a higher (domain) The main method that must be overloaded for a translation layer is the `mapping` method. Usually this is a linear mapping whereby a value at an offset in the domain maps directly to an offset in the range. -Most new layers should inherit from :py:class:`~volatility.framework.layers.linear.LinearlyMappedLayer` where they +Most new layers should inherit from :py:class:`~volatility3.framework.layers.linear.LinearlyMappedLayer` where they can define a mapping method as follows: .. code-block:: python @@ -205,7 +205,7 @@ This mechanism also allowed for some minor optimization in scanning such a layer scanning of layers be needed, please refer to the Layer Scanning page. Whilst it may seem as though some of the data seems redundant (the length values are always the same) this is not the -case for :py:class:`~volatility.framework.layers.segmented.NonLinearlySegmentedLayer`. These layers do not guarantee +case for :py:class:`~volatility3.framework.layers.segmented.NonLinearlySegmentedLayer`. These layers do not guarantee that each domain address maps directly to a range address, and in fact can carry out processing on the data. These layers are most commonly encountered as compression or encryption layers (whereby a domain address may map into a chunk of the range, but not directly). In this instance, the mapping will likely define additional methods that can @@ -285,8 +285,8 @@ Writing new Templates and Objects --------------------------------- In most cases, a whole new type of object is unnecessary. It will usually be derived from an -:py:class:`~volatility.framework.objects.StructType` (which is itself just another name for a -:py:class:`~volatility.framework.objects.AggregateType`, but it's better to use `StructType` for readability). +:py:class:`~volatility3.framework.objects.StructType` (which is itself just another name for a +:py:class:`~volatility3.framework.objects.AggregateType`, but it's better to use `StructType` for readability). This can be used as a class override for a particular symbol table, so that an existing structure can be augmented with additional methods. An example of this would be: @@ -300,27 +300,27 @@ This will mean that when a specific structure is loaded from the symbol_space, i `StructType`, but instead is instantiated using the NewStructureClass, meaning new methods can be called directly on it. If the situation really calls for an entirely new object, that isn't covered by one of the existing -:py:class:`~volatility.framework.objects.PrimativeObject` objects (such as -:py:class:`~volatility.framework.objects.Integer`, -:py:class:`~volatility.framework.objects.Boolean`, -:py:class:`~volatility.framework.objects.Float`, -:py:class:`~volatility.framework.objects.Char`, -:py:class:`~volatility.framework.objects.Bytes`) +:py:class:`~volatility3.framework.objects.PrimativeObject` objects (such as +:py:class:`~volatility3.framework.objects.Integer`, +:py:class:`~volatility3.framework.objects.Boolean`, +:py:class:`~volatility3.framework.objects.Float`, +:py:class:`~volatility3.framework.objects.Char`, +:py:class:`~volatility3.framework.objects.Bytes`) or the other builtins (such as -:py:class:`~volatility.framework.objects.Array`, -:py:class:`~volatility.framework.objects.Bitfield`, -:py:class:`~volatility.framework.objects.Enumeration`, -:py:class:`~volatility.framework.objects.Pointer`, -:py:class:`~volatility.framework.objects.String`, -:py:class:`~volatility.framework.objects.Void`) then you can review the following information about defining an entirely +:py:class:`~volatility3.framework.objects.Array`, +:py:class:`~volatility3.framework.objects.Bitfield`, +:py:class:`~volatility3.framework.objects.Enumeration`, +:py:class:`~volatility3.framework.objects.Pointer`, +:py:class:`~volatility3.framework.objects.String`, +:py:class:`~volatility3.framework.objects.Void`) then you can review the following information about defining an entirely new object. -All objects must inherit from :py:class:`~volatility.framework.interfaces.objects.ObjectInterface` which defines a -constructor that takes a context, a `type_name`, an :py:class:`~volatility.framework.interfaces.objects.ObjectInformation` +All objects must inherit from :py:class:`~volatility3.framework.interfaces.objects.ObjectInterface` which defines a +constructor that takes a context, a `type_name`, an :py:class:`~volatility3.framework.interfaces.objects.ObjectInformation` object and then can accept additional keywords (which will not necessarily be provided if the object is constructed from a JSON reference). -The :py:class:`~volatility.framework.interfaces.objects.ObjectInformation` class contains all the basic elements that +The :py:class:`~volatility3.framework.interfaces.objects.ObjectInformation` class contains all the basic elements that define an object, which include: * layer_name @@ -345,10 +345,10 @@ should be. Note, the size can change throughout the lifespan of the object, and it compensates for such a change. Objects must also contain a specific class called `VolTemplateProxy` which must inherit from -:py:class:`~volatility.framework.interfaces.objects.ObjectInterface`. This is used to access information about +:py:class:`~volatility3.framework.interfaces.objects.ObjectInterface`. This is used to access information about a structure before it has been associated with data and becomes an Object. The -:py:class:`~volatility.framework.interfaces.objects.ObjectInterface.VolTemplateProxy` class contains a number of -abstract classmethods, which take a :py:class:`~volatility.framework.interfaces.objects.Template`. The main method +:py:class:`~volatility3.framework.interfaces.objects.ObjectInterface.VolTemplateProxy` class contains a number of +abstract classmethods, which take a :py:class:`~volatility3.framework.interfaces.objects.Template`. The main method that is likely to need overwriting is the `size` method, which should return the size of the object (for the template of a dynamically-sized object, this should be a suitable value, and calculated based on the best available information). For most objects, this can be determined from the JSON data used to construct a normal `Struct` and therefore only needs diff --git a/doc/source/simple-plugin.rst b/doc/source/simple-plugin.rst index e857e830c..52dabfd4f 100644 --- a/doc/source/simple-plugin.rst +++ b/doc/source/simple-plugin.rst @@ -3,19 +3,19 @@ How to Write a Simple Plugin This guide will step through how to construct a simple plugin using Volatility 3. -The example plugin we'll use is :py:class:`~volatility.plugins.windows.dlllist.DllList`, which features the main traits +The example plugin we'll use is :py:class:`~volatility3.plugins.windows.dlllist.DllList`, which features the main traits of a normal plugin, and reuses other plugins appropriately. Inherit from PluginInterface ---------------------------- -The first step is to define a class that inherits from :py:class:`~volatility.framework.interfaces.plugins.PluginInterface`. +The first step is to define a class that inherits from :py:class:`~volatility3.framework.interfaces.plugins.PluginInterface`. Volatility automatically finds all plugins defined under the various plugin directories by importing them and then -making use of any classes that inherit from :py:class:`~volatility.framework.interfaces.plugins.PluginInterface`. +making use of any classes that inherit from :py:class:`~volatility3.framework.interfaces.plugins.PluginInterface`. :: - from volatility.framework import interfaces + from volatility3.framework import interfaces class DllList(interfaces.plugins.PluginInterface): @@ -56,7 +56,7 @@ to instantiate the plugin). At the moment these requirements are fairly straigh architectures = ["Intel32", "Intel64"]), This requirement indicates that the plugin will operate on a single -:py:class:`TranslationLayer `. The name of the +:py:class:`TranslationLayer `. The name of the loaded layer will appear in the plugin's configuration under the name ``primary``. Requirement values can be accessed within the plugin through the plugin's `config` attribute (for example ``self.config['pid']``). @@ -71,7 +71,7 @@ layers, for example a plugin that carries out some form of difference or statist This requirement (and the next two) are known as Complex Requirements, and user interfaces will likely not directly request a value for this from a user. The value stored in the configuration tree for a -:py:class:`~volatility.framework.configuration.requirements.TranslationLayerRequirement` is +:py:class:`~volatility3.framework.configuration.requirements.TranslationLayerRequirement` is the string name of a layer present in the context's memory that satisfies the requirement. :: @@ -80,14 +80,14 @@ the string name of a layer present in the context's memory that satisfies the re description = "Windows kernel symbols"), This requirement specifies the need for a particular -:py:class:`SymbolTable ` +:py:class:`SymbolTable ` to be loaded. This gets populated by various -:py:class:`Automagic ` as the nearest sibling to a particular -:py:class:`~volatility.framework.configuration.requirements.TranslationLayerRequirement`. -This means that if the :py:class:`~volatility.framework.configuration.requirements.TranslationLayerRequirement` -is satisfied and the :py:class:`Automagic ` can determine -the appropriate :py:class:`SymbolTable `, the -name of the :py:class:`SymbolTable ` will be stored in the configuration. +:py:class:`Automagic ` as the nearest sibling to a particular +:py:class:`~volatility3.framework.configuration.requirements.TranslationLayerRequirement`. +This means that if the :py:class:`~volatility3.framework.configuration.requirements.TranslationLayerRequirement` +is satisfied and the :py:class:`Automagic ` can determine +the appropriate :py:class:`SymbolTable `, the +name of the :py:class:`SymbolTable ` will be stored in the configuration. This requirement is also a Complex Requirement and therefore will not be requested directly from the user. @@ -119,10 +119,10 @@ Define the `run` method The run method is the primary method called on a plugin. It takes no parameters (these have been passed through the context's configuration tree, and the context is provided at plugin initialization time) and returns an unpopulated -:py:class:`~volatility.framework.interfaces.renderers.TreeGrid` object. These are typically constructed based on a +:py:class:`~volatility3.framework.interfaces.renderers.TreeGrid` object. These are typically constructed based on a generator that carries out the bulk of the plugin's processing. The -:py:class:`~volatility.framework.interfaces.renderers.TreeGrid` also specifies the column names and types -that will be output as part of the :py:class:`~volatility.framework.interfaces.renderers.TreeGrid`. +:py:class:`~volatility3.framework.interfaces.renderers.TreeGrid` also specifies the column names and types +that will be output as part of the :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`. :: @@ -143,28 +143,28 @@ that will be output as part of the :py:class:`~volatility.framework.interfaces.r In this instance, the plugin constructs a filter (using the PsList plugin's *classmethod* for creating filters). It checks the plugin's configuration for the ``pid`` value, and passes it in as a list if it finds it, or None if -it does not. The :py:func:`~volatility.plugins.windows.pslist.PsList.create_pid_filter` method accepts a list of process +it does not. The :py:func:`~volatility3.plugins.windows.pslist.PsList.create_pid_filter` method accepts a list of process identifiers that are included in the list. If the list is empty, all processes are returned. The next line specifies the columns by their name and type. The types are simple types (int, str, bytes, float, and bool) but can also provide hints as to how the output should be displayed (such as a hexidecimal number, using -:py:class:`volatility.framework.renderers.format_hints.Hex`). +:py:class:`volatility3.framework.renderers.format_hints.Hex`). This indicates to user interfaces that the value should be displayed in a particular way, but does not guarantee that the value will be displayed that way (for example, if it doesn't make sense to do so in a particular interface). Finally, the generator is provided. The generator accepts a list of processes, which is gathered using a different plugin, -the :py:class:`~volatility.plugins.windows.pslist.PsList` plugin. That plugin features a *classmethod*, +the :py:class:`~volatility3.plugins.windows.pslist.PsList` plugin. That plugin features a *classmethod*, so that other plugins can call it. As such, it takes all the necessary parameters rather than accessing them from a configuration. Since it must be portable code, it takes a context, as well as the layer name, symbol table and optionally a filter. In this instance we unconditionally pass it the values from the configuration for the ``primary`` and ``nt_symbols`` requirements. This will generate a list -of :py:class:`~volatility.framework.symbols.windows.extensions.EPROCESS` objects, as provided by the :py:class:`~volatility.plugins.windows.pslist.PsList` plugin, +of :py:class:`~volatility3.framework.symbols.windows.extensions.EPROCESS` objects, as provided by the :py:class:`~volatility.plugins.windows.pslist.PsList` plugin, and is not covered here but is used as an example for how to share code across plugins (both as the provider and the consumer of the shared code). Define the generator -------------------- -The :py:class:`~volatility.framework.interfaces.renderers.TreeGrid` can be populated without a generator, +The :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid` can be populated without a generator, but it is quite a common model to use. This is where the main processing for this plugin lives. :: @@ -189,10 +189,10 @@ but it is quite a common model to use. This is where the main processing for th format_hints.Hex(entry.DllBase), format_hints.Hex(entry.SizeOfImage), BaseDllName, FullDllName)) -This iterates through the list of processes and for each one calls the :py:meth:`~volatility.framework.symbols.windows.extensions.EPROCESS.load_order_modules` method on it. This provides +This iterates through the list of processes and for each one calls the :py:meth:`~volatility3.framework.symbols.windows.extensions.EPROCESS.load_order_modules` method on it. This provides a list of the loaded modules within the process. -The plugin then defaults the ``BaseDllName`` and ``FullDllName`` variables to an :py:class:`~volatility.framework.renderers.UnreadableValue`, +The plugin then defaults the ``BaseDllName`` and ``FullDllName`` variables to an :py:class:`~volatility3.framework.renderers.UnreadableValue`, which is a way of indicating to the user interface that the value couldn't be read for some reason (but that it isn't fatal). There are currently four different reasons a value may be unreadable: @@ -204,7 +204,7 @@ There are currently four different reasons a value may be unreadable: This is a safety provision to ensure that the data returned by the Volatility library is accurate and describes why information may not be provided. -The plugin then takes the process's ``BaseDllName`` value, and calls :py:meth:`~volatility.framework.symbols.windows.extensions.UNICODE_STRING.get_string` on it. All structure attributes, +The plugin then takes the process's ``BaseDllName`` value, and calls :py:meth:`~volatility3.framework.symbols.windows.extensions.UNICODE_STRING.get_string` on it. All structure attributes, as defined by the symbols, are directly accessible and use the case-style of the symbol library it came from (in Windows, attributes are CamelCase), such as ``entry.BaseDllName`` in this instance. Any attribtues not defined by the symbol but added by Volatility extensions cannot be properties (in case they overlap with the attributes defined in the symbol libraries) @@ -215,16 +215,16 @@ read the data at a particular offset. This will cause an exception to be thrown as a means of communicating when something exceptional happens. It is the responsibility of the plugin developer to appropriately catch and handle any non-fatal exceptions and otherwise allow the exception to be thrown by the user interface. -In this instance, the :py:class:`~volatility.framework.exceptions.InvalidAddressException` class is caught, which is thrown +In this instance, the :py:class:`~volatility3.framework.exceptions.InvalidAddressException` class is caught, which is thrown by any layer which cannot access an offset requested of it. Since we have already populated both values with ``UnreadableValue`` we do not need to write code for the exception handler. -Finally, we yield the record in the format required by the :py:class:`~volatility.framework.interfaces.renderers.TreeGrid`, +Finally, we yield the record in the format required by the :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`, a tuple, listing the indentation level (for trees) and then the list of values for each column. This plugin demonstrates casting a value ``ImageFileName`` to ensure it's returned as a string with a specific maximum length, rather than its original type (potentially an array of characters, etc). -This is carried out using the :py:meth:`~volatility.framework.interfaces.objects.ObjectInterface.cast` method which takes a type (either a native type, such as string or pointer, or a -structure type defined in a :py:class:`SymbolTable ` +This is carried out using the :py:meth:`~volatility3.framework.interfaces.objects.ObjectInterface.cast` method which takes a type (either a native type, such as string or pointer, or a +structure type defined in a :py:class:`SymbolTable ` such as ``!_UNICODE``) and the parameters to that type. Since the cast value must populate a string typed column, it had to be a Python string (such as being cast to the native diff --git a/doc/source/using-as-a-library.rst b/doc/source/using-as-a-library.rst index abed65225..ded861de4 100644 --- a/doc/source/using-as-a-library.rst +++ b/doc/source/using-as-a-library.rst @@ -25,7 +25,7 @@ from versions 1.1 or 1.2: :: - volatility.framework.require_interface_version(1, 0, 0) + volatility3.framework.require_interface_version(1, 0, 0) Contexts can be spun up quite easily, just construct one. It's not a singleton, so multiple contexts can be constructed and operate independently, but be aware of which context you're handing where and make sure to use @@ -42,20 +42,20 @@ Determine what plugins are available ------------------------------------ You can also interrogate the framework to see which plugins are available. First we have to try to load all -available plugins. The :py:func:`~volatility.framework.import_files` method will automatically use the module -paths for the provided module (in this case, volatility.plugins) and walk the directory (or directories) loading up +available plugins. The :py:func:`~volatility3.framework.import_files` method will automatically use the module +paths for the provided module (in this case, volatility3.plugins) and walk the directory (or directories) loading up all python files. Any import failures will be provided in the failures return value, unless the second parameter is False in which case the call will raise any exceptions encountered. Any additional directories containing plugins -should be added to the `__path__` attribute for the `volatility.plugins` module. The standard paths should generally -also be included, which can be found in `volatility.constants.PLUGINS_PATH`. +should be added to the `__path__` attribute for the `volatility3.plugins` module. The standard paths should generally +also be included, which can be found in `volatility3.constants.PLUGINS_PATH`. :: - volatility.plugins.__path__ = + constants.PLUGINS_PATH - failures = framework.import_files(volatility.plugins, True) + volatility3.plugins.__path__ = + constants.PLUGINS_PATH + failures = framework.import_files(volatility3.plugins, True) Once the plugins have been imported, we can interrogate which plugins are available. The -:py:func:`~volatility.framework.list_plugins` call will +:py:func:`~volatility3.framework.list_plugins` call will return a dictionary of plugin names and the plugin classes. :: @@ -68,9 +68,9 @@ Determine what configuration options a plugin requires ------------------------------------------------------ For each plugin class, we can call the classmethod `requirements` on it, which will return a list of objects that -adhere to the :py:class:`~volatility.framework.interfaces.configuration.RequirementInterface` method. The various +adhere to the :py:class:`~volatility3.framework.interfaces.configuration.RequirementInterface` method. The various types of Requirement are split roughly in two, -:py:class:`~volatility.framework.interfaces.configuration.SimpleTypeRequirement` (such as integers, booleans, floats +:py:class:`~volatility3.framework.interfaces.configuration.SimpleTypeRequirement` (such as integers, booleans, floats and strings) and more complex requirements (such as lists, choices, multiple requirements, translation layer requirements or symbol table requirements). A requirement just specifies a type of data and a name, and must be combined with a configuration hierarchy to have meaning. @@ -98,7 +98,7 @@ underneaths its own branch). To set the hierarchy, you'll need to know where th For this example, we'll assume plugins' base_config_path is set as `plugins`, and that automagics are configured under the `automagic` tree. We'll see later how to ensure this matches up with the plugins and automagic when they're constructed. Joining configuration options should always be carried out using -:py:func:`~volatility.framework.interfaces.configuration.path_join` +:py:func:`~volatility3.framework.interfaces.configuration.path_join` in case the separator value gets changed in the future. Configuration items can then be set as follows: :: @@ -170,7 +170,7 @@ be called whenever a plugin produces an auxiliary file. constructed = plugin(context, plugin_config_path, progress_callback = progress_callback) constructed.set_open_method(file_handler) -The file_handler must adhere to the :py:class:`~volatility.framework.interfaces.plugins.FileHandlerInterface`, +The file_handler must adhere to the :py:class:`~volatility3.framework.interfaces.plugins.FileHandlerInterface`, which represents an IO[bytes] object but also contains a `preferred_filename` attribute as a hint. All of this functionality has been condensed into a framework method called `construct_plugin` which will @@ -181,7 +181,7 @@ accepts an optional progress_callback and an optional file_consumer. constructed = plugins.construct_plugin(ctx, automagics, plugin, base_config_path, progress_callback, file_consumer) -Finally the plugin can be run, and will return a :py:class:`~volatility.framework.interfaces.renderers.TreeGrid`. +Finally the plugin can be run, and will return a :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid`. :: @@ -201,22 +201,22 @@ does the actual work. This can return an exception if one occurs during the run The results can be accessed either as the results are being processed, or by visiting the nodes in the tree once it is fully populated. In either case, a visitor method will be required. The visitor method -should accept a :py:class:`~volatility.framework.interfaces.renderers.TreeNode` and an `accumulator`. It will +should accept a :py:class:`~volatility3.framework.interfaces.renderers.TreeNode` and an `accumulator`. It will return an updated accumulator. -When provided a :py:class:`~volatility.framework.interfaces.renderers.TreeNode`, it can be accessed as a dictionary +When provided a :py:class:`~volatility3.framework.interfaces.renderers.TreeNode`, it can be accessed as a dictionary based on the column names that the treegrid contains. It should be noted that each column can contain only the type specified in the `column.type` field (which can be a simple type like string, integer, float, bytes or a more complex type, like a DateTime, a Disassembly or a descendant of -:py:class:`~volatility.framework.interfaces.renderers.BaseAbsentValue`). The various fields may also be wrapped in +:py:class:`~volatility3.framework.interfaces.renderers.BaseAbsentValue`). The various fields may also be wrapped in `format_hints` designed to tell the user interface how to render the data. These hints can be things like Bin, Hex or HexBytes, so that fields like offsets are displayed in hex form or so that bytes are displayed in their hex form rather -than their raw form. Descendants of :py:class:`~volatility.framework.interfaces.renderers.BaseAbsentValue` can currently +than their raw form. Descendants of :py:class:`~volatility3.framework.interfaces.renderers.BaseAbsentValue` can currently be one of -:py:class:`~volatility.framework.renderers.UnreadableValue`, -:py:class:`~volatility.framework.renderers.UnparsableValue`, -:py:class:`~volatility.framework.renderers.NotApplicableValue` or -:py:class:`~volatility.framework.renderers.NotAvailableValue`. These indicate that data could not be read from the +:py:class:`~volatility3.framework.renderers.UnreadableValue`, +:py:class:`~volatility3.framework.renderers.UnparsableValue`, +:py:class:`~volatility3.framework.renderers.NotApplicableValue` or +:py:class:`~volatility3.framework.renderers.NotAvailableValue`. These indicate that data could not be read from the memory for some reason, could not be parsed properly, was not applicable or was not available. A simple text renderer (that returns output immediately) would appear as follows. This doesn't use @@ -240,5 +240,5 @@ the accumulator, but instead uses print to directly produce the output. This is grid.populate(visitor, None) More complex examples of renderers can be found in the default CLI implementation, such as the -:py:class:`~volatility.cli.text_renderer.QuickTextRenderer` or the -:py:class:`~volatility.cli.text_renderer.PrettyTextRenderer`. +:py:class:`~volatility3.cli.text_renderer.QuickTextRenderer` or the +:py:class:`~volatility3.cli.text_renderer.PrettyTextRenderer`. diff --git a/doc/source/vol2to3.rst b/doc/source/vol2to3.rst index 8e82ba8a2..bc1733dcf 100644 --- a/doc/source/vol2to3.rst +++ b/doc/source/vol2to3.rst @@ -6,7 +6,7 @@ Library and Context Volatility 3 has been designed from the ground up to be a library, this means the components are independent and all state required to run a particular plugin at a particular time is self-contained in an object derived from -a :py:class:`~volatility.framework.interfaces.context.ContextInterface`. +a :py:class:`~volatility3.framework.interfaces.context.ContextInterface`. The context contains the two core components that make up Volatility, layers of data and the available symbols. @@ -14,7 +14,7 @@ Symbols and Types ----------------- Volatility 3 no longer uses profiles, it comes with an extensive library of -:py:class:`symbol tables `, and can generate new symbol +:py:class:`symbol tables `, and can generate new symbol tables for most windows memory images, based on the memory image itself. This allows symbol tables to include specific offsets for locations (symbol locations) based on that operating system in particular. This means it is easier and quicker to identify structures within an operating system, by having known offsets for those structures provided by the official @@ -37,11 +37,11 @@ re-read many times over for no benefit (particularly since each re-read could re from following page table translations). Finally, in order to provide Volatility specific information without impact on the ability for structures to have members -with arbitrary names, all the metadata about the object (such as its layer or offset) have been moved to a read-only :py:meth:`~volatility.framework.interfaces.objects.ObjectInterface.vol` +with arbitrary names, all the metadata about the object (such as its layer or offset) have been moved to a read-only :py:meth:`~volatility3.framework.interfaces.objects.ObjectInterface.vol` dictionary. -Further the distinction between a :py:class:`~volatility.framework.interfaces.objects.Template` (the thing that -constructs an object) and the :py:class:`Object ` itself has +Further the distinction between a :py:class:`~volatility3.framework.interfaces.objects.Template` (the thing that +constructs an object) and the :py:class:`Object ` itself has been made more explicit. In Volatility 2, some information (such as size) could only be determined from a constructed object, leading to instantiating a template on an empty buffer, just to determine the size. In Volatility 3, templates contain information such as their size, which can be queried directly without constructing the object. @@ -49,7 +49,7 @@ information such as their size, which can be queried directly without constructi Layer and Layer dependencies ---------------------------- Address spaces in Volatility 2, are now more accurately referred to as -:py:class:`Translation Layers `, since each one typically sits +:py:class:`Translation Layers `, since each one typically sits atop another and can translate addresses between the higher logical layer and the lower physical layer. Address spaces in Volatility 2 were strictly limited to a stack, one on top of one other. In Volatility 3, layers can have multiple "dependencies" (lower layers), which allows for the integration of features such as swap space. @@ -65,13 +65,13 @@ included a stacker automagic to emulate the most common feature of Volatility 2, Searching and Scanning ---------------------- Scanning is very similar to scanning in Volatility 2, a scanner object (such as a -:py:class:`~volatility.framework.layers.scanners.BytesScanner` or :py:class:`~volatility.framework.layers.scanners.RegExScanner`) is -primed with the data to be searched for, and the :py:meth:`~volatility.framework.interfaces.layers.DataLayerInterface.scan` method is called on the layer to be searched. +:py:class:`~volatility3.framework.layers.scanners.BytesScanner` or :py:class:`~volatility.framework.layers.scanners.RegExScanner`) is +primed with the data to be searched for, and the :py:meth:`~volatility3.framework.interfaces.layers.DataLayerInterface.scan` method is called on the layer to be searched. Output Rendering ---------------- This is extremely similar to Volatility 2, because we were developing it for Volatility 3 when we added it to Volatility 2. -We now require that all plugins produce output in a :py:class:`~volatility.framework.interfaces.renderers.TreeGrid` object, +We now require that all plugins produce output in a :py:class:`~volatility3.framework.interfaces.renderers.TreeGrid` object, which ensure that the library can be used regardless of which interface is driving it. An example web GUI is also available called Volumetric which allows all the plugins that can be run from the command line to be run from a webpage, and offers features such as automatic formatting and sorting of the data, which previously couldn't be provided easily from the CLI. From c4b7dfa5995a00e5fd8da71e2afea8e895547a3c Mon Sep 17 00:00:00 2001 From: "Nick L. Petroni, Jr" Date: Sun, 31 Jan 2021 11:11:08 -0500 Subject: [PATCH 28/28] rename master branch to stable in github workflows --- .github/workflows/build-pypi.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-pypi.yml b/.github/workflows/build-pypi.yml index f007620ce..77fe26931 100644 --- a/.github/workflows/build-pypi.yml +++ b/.github/workflows/build-pypi.yml @@ -3,13 +3,13 @@ name: build-pypi on: push: branches: - - master + - stable - develop - 'release/**' pull_request: branches: - - develop + - stable - 'release/**' jobs: