diff --git a/doc/source/conf.py b/doc/source/conf.py index 8ff9b00d5..27aa3d5a1 100644 --- a/doc/source/conf.py +++ b/doc/source/conf.py @@ -64,7 +64,7 @@ def setup(app): # documentation root, use os.path.abspath to make it absolute, like shown here. sys.path.insert(0, os.path.abspath('../..')) -import volatility.framework.constants as constants +from volatility.framework import constants # -- General configuration ------------------------------------------------ diff --git a/volatility/framework/plugins/linux/malfind.py b/volatility/framework/plugins/linux/malfind.py index b16f30c59..e8f2710f7 100644 --- a/volatility/framework/plugins/linux/malfind.py +++ b/volatility/framework/plugins/linux/malfind.py @@ -4,12 +4,12 @@ from typing import List -import volatility.plugins.linux.pslist as pslist from volatility.framework import constants, interfaces from volatility.framework import renderers from volatility.framework.configuration import requirements from volatility.framework.objects import utility from volatility.framework.renderers import format_hints +from volatility.plugins.linux import pslist class Malfind(interfaces.plugins.PluginInterface): @@ -21,7 +21,8 @@ class Malfind(interfaces.plugins.PluginInterface): requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols") + requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), ] def _list_injections(self, task): diff --git a/volatility/framework/plugins/mac/malfind.py b/volatility/framework/plugins/mac/malfind.py index d58589020..c80fd9799 100644 --- a/volatility/framework/plugins/mac/malfind.py +++ b/volatility/framework/plugins/mac/malfind.py @@ -2,14 +2,13 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import volatility.plugins.mac.tasks as tasks - from volatility.framework import constants from volatility.framework import interfaces from volatility.framework import renderers from volatility.framework.configuration import requirements from volatility.framework.objects import utility from volatility.framework.renderers import format_hints +from volatility.plugins.mac import tasks class Malfind(interfaces.plugins.PluginInterface): @@ -21,7 +20,8 @@ class Malfind(interfaces.plugins.PluginInterface): requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "darwin", description = "Linux kernel symbols") + requirements.SymbolTableRequirement(name = "darwin", description = "Linux kernel symbols"), + requirements.PluginRequirement(name = 'tasks', plugin = tasks.Tasks, version = (1, 0, 0)), ] def _list_injections(self, task): diff --git a/volatility/framework/plugins/mac/proc_maps.py b/volatility/framework/plugins/mac/proc_maps.py index 232f7cc95..2160b0695 100644 --- a/volatility/framework/plugins/mac/proc_maps.py +++ b/volatility/framework/plugins/mac/proc_maps.py @@ -2,12 +2,11 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import volatility.plugins.mac.tasks as tasks - from volatility.framework import renderers, interfaces from volatility.framework.configuration import requirements from volatility.framework.objects import utility from volatility.framework.renderers import format_hints +from volatility.plugins.mac import tasks class Maps(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/windows/dlldump.py b/volatility/framework/plugins/windows/dlldump.py index 870c4b01a..1218bb972 100644 --- a/volatility/framework/plugins/windows/dlldump.py +++ b/volatility/framework/plugins/windows/dlldump.py @@ -6,15 +6,13 @@ import logging import ntpath from typing import List -import volatility.plugins.windows.pslist as pslist -import volatility.plugins.windows.vadinfo as vadinfo - from volatility.framework import interfaces, constants from volatility.framework import renderers from volatility.framework.configuration import requirements from volatility.framework.objects import utility from volatility.framework.symbols import intermed from volatility.framework.symbols.windows import extensions +from volatility.plugins.windows import pslist, vadinfo vollog = logging.getLogger(__name__) @@ -37,7 +35,9 @@ class DllDump(interfaces.plugins.PluginInterface): optional = True), requirements.IntRequirement( name = 'pid', description = "Process ID to include (all other processes are excluded)", - optional = True) + optional = True), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), + requirements.PluginRequirement(name = 'vadinfo', plugin = vadinfo.VadInfo, version = (1, 0, 0)), ] def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/driverscan.py b/volatility/framework/plugins/windows/driverscan.py index 6470ebce6..47565a161 100644 --- a/volatility/framework/plugins/windows/driverscan.py +++ b/volatility/framework/plugins/windows/driverscan.py @@ -4,11 +4,10 @@ from typing import Iterable -import volatility.plugins.windows.poolscanner as poolscanner - from volatility.framework import renderers, interfaces, exceptions from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints +from volatility.plugins.windows import poolscanner class DriverScan(interfaces.plugins.PluginInterface): @@ -23,6 +22,7 @@ class DriverScan(interfaces.plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.PluginRequirement(name = 'poolscanner', plugin = poolscanner.PoolScanner, version = (1, 0, 0)), ] @classmethod diff --git a/volatility/framework/plugins/windows/filescan.py b/volatility/framework/plugins/windows/filescan.py index fd5f6f880..45aa5e68d 100644 --- a/volatility/framework/plugins/windows/filescan.py +++ b/volatility/framework/plugins/windows/filescan.py @@ -4,11 +4,10 @@ from typing import Iterable -import volatility.plugins.windows.poolscanner as poolscanner - from volatility.framework import renderers, interfaces, exceptions from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints +from volatility.plugins.windows import poolscanner class FileScan(interfaces.plugins.PluginInterface): @@ -21,6 +20,7 @@ class FileScan(interfaces.plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.PluginRequirement(name = 'poolscanner', plugin = poolscanner.PoolScanner, version = (1, 0, 0)), ] @classmethod diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index 79e4dbbe8..a0fa03887 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -5,12 +5,11 @@ import logging from typing import List, Optional, Dict -import volatility.plugins.windows.pslist as pslist - from volatility.framework import constants, exceptions, renderers, interfaces from volatility.framework.configuration import requirements from volatility.framework.objects import utility from volatility.framework.renderers import format_hints +from volatility.plugins.windows import pslist vollog = logging.getLogger(__name__) @@ -25,6 +24,8 @@ except ImportError: class Handles(interfaces.plugins.PluginInterface): """Lists process open handles.""" + _version = (1, 0, 0) + def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self._sar_value = None @@ -42,7 +43,8 @@ class Handles(interfaces.plugins.PluginInterface): requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.IntRequirement(name = 'pid', description = "Process ID to include (all other processes are excluded)", - optional = True) + optional = True), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)) ] def _decode_pointer(self, value, magic): diff --git a/volatility/framework/plugins/windows/malfind.py b/volatility/framework/plugins/windows/malfind.py index 621e1ea89..1e240fbe4 100644 --- a/volatility/framework/plugins/windows/malfind.py +++ b/volatility/framework/plugins/windows/malfind.py @@ -3,14 +3,12 @@ # from typing import Iterable, Tuple -import volatility.plugins.windows.pslist as pslist -import volatility.plugins.windows.vadinfo as vadinfo - from volatility.framework import interfaces, symbols from volatility.framework import renderers from volatility.framework.configuration import requirements from volatility.framework.objects import utility from volatility.framework.renderers import format_hints +from volatility.plugins.windows import pslist, vadinfo class Malfind(interfaces.plugins.PluginInterface): @@ -26,7 +24,9 @@ class Malfind(interfaces.plugins.PluginInterface): requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.IntRequirement(name = 'pid', description = "Process ID to include (all other processes are excluded)", - optional = True) + optional = True), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), + requirements.PluginRequirement(name = 'vadinfo', plugin = vadinfo.VadInfo, version = (1, 0, 0)), ] @classmethod diff --git a/volatility/framework/plugins/windows/moddump.py b/volatility/framework/plugins/windows/moddump.py index fd99c8f34..5c4f6be6b 100644 --- a/volatility/framework/plugins/windows/moddump.py +++ b/volatility/framework/plugins/windows/moddump.py @@ -20,6 +20,8 @@ vollog = logging.getLogger(__name__) class ModDump(interfaces.plugins.PluginInterface): """Dumps kernel modules.""" + _version = (1, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Reuse the requirements from the plugins we use diff --git a/volatility/framework/plugins/windows/mutantscan.py b/volatility/framework/plugins/windows/mutantscan.py index 9c19e6e87..10f5c776d 100644 --- a/volatility/framework/plugins/windows/mutantscan.py +++ b/volatility/framework/plugins/windows/mutantscan.py @@ -4,11 +4,10 @@ from typing import Iterable -import volatility.plugins.windows.poolscanner as poolscanner - from volatility.framework import renderers, interfaces, exceptions from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints +from volatility.plugins.windows import poolscanner class MutantScan(interfaces.plugins.PluginInterface): @@ -21,6 +20,7 @@ class MutantScan(interfaces.plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.PluginRequirement(name = 'poolscanner', plugin = poolscanner.PoolScanner, version = (1, 0, 0)), ] @classmethod diff --git a/volatility/framework/plugins/windows/poolscanner.py b/volatility/framework/plugins/windows/poolscanner.py index b30c3915a..38a3110c9 100644 --- a/volatility/framework/plugins/windows/poolscanner.py +++ b/volatility/framework/plugins/windows/poolscanner.py @@ -6,8 +6,6 @@ import enum import logging from typing import Dict, Generator, List, Optional, Tuple, Callable -import volatility.plugins.windows.handles as handles - from volatility.framework import constants, interfaces, renderers, exceptions, symbols from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins, configuration @@ -15,6 +13,7 @@ from volatility.framework.layers import scanners from volatility.framework.renderers import format_hints from volatility.framework.symbols import intermed from volatility.framework.symbols.windows import extensions +from volatility.plugins.windows import handles vollog = logging.getLogger(__name__) @@ -188,7 +187,8 @@ class PoolScanner(plugins.PluginInterface): requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.PluginRequirement(name = 'handles', plugin = handles.Handles, version = (1, 0, 0)), ] is_windows_10 = os_distinguisher(version_check = lambda x: x >= (10, 0), diff --git a/volatility/framework/plugins/windows/procdump.py b/volatility/framework/plugins/windows/procdump.py index 76da1f17e..5ba39601e 100644 --- a/volatility/framework/plugins/windows/procdump.py +++ b/volatility/framework/plugins/windows/procdump.py @@ -5,13 +5,12 @@ import logging from typing import List -import volatility.plugins.windows.pslist as pslist - from volatility.framework import interfaces, exceptions, constants, renderers from volatility.framework.configuration import requirements from volatility.framework.objects import utility from volatility.framework.symbols import intermed from volatility.framework.symbols.windows.extensions import pe +from volatility.plugins.windows import pslist vollog = logging.getLogger(__name__) @@ -29,7 +28,8 @@ class ProcDump(interfaces.plugins.PluginInterface): requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.IntRequirement(name = 'pid', description = "Process ID to include (all other processes are excluded)", - optional = True) + optional = True), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), ] def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/registry/hivescan.py b/volatility/framework/plugins/windows/registry/hivescan.py index f1de5f962..7aa6ee7ef 100644 --- a/volatility/framework/plugins/windows/registry/hivescan.py +++ b/volatility/framework/plugins/windows/registry/hivescan.py @@ -4,11 +4,10 @@ from typing import Iterable -import volatility.plugins.windows.poolscanner as poolscanner - from volatility.framework import renderers, interfaces from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints +from volatility.plugins.windows import poolscanner class HiveScan(interfaces.plugins.PluginInterface): @@ -22,6 +21,7 @@ class HiveScan(interfaces.plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.PluginRequirement(name = 'poolscanner', plugin = poolscanner.PoolScanner, version = (1, 0, 0)), ] @classmethod diff --git a/volatility/framework/plugins/windows/registry/userassist.py b/volatility/framework/plugins/windows/registry/userassist.py index f06d26d54..0085e29e2 100644 --- a/volatility/framework/plugins/windows/registry/userassist.py +++ b/volatility/framework/plugins/windows/registry/userassist.py @@ -9,14 +9,13 @@ import logging import os from typing import Any, List, Tuple, Generator -import volatility.plugins.windows.registry.hivelist as hivelist - from volatility.framework import exceptions, renderers, constants, interfaces from volatility.framework.configuration import requirements from volatility.framework.layers.physical import BufferDataLayer from volatility.framework.layers.registry import RegistryHive from volatility.framework.renderers import format_hints, conversion from volatility.framework.symbols import intermed +from volatility.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/ssdt.py b/volatility/framework/plugins/windows/ssdt.py index bbd34a823..ceae3e195 100644 --- a/volatility/framework/plugins/windows/ssdt.py +++ b/volatility/framework/plugins/windows/ssdt.py @@ -10,7 +10,6 @@ from volatility.framework import contexts from volatility.framework import exceptions, symbols from volatility.framework import renderers from volatility.framework.configuration import requirements -from volatility.framework.constants import windows as windows_constants from volatility.framework.interfaces import plugins from volatility.framework.renderers import format_hints from volatility.plugins.windows import modules @@ -59,7 +58,7 @@ class SSDT(plugins.PluginInterface): module_name = os.path.splitext(module_name_with_ext)[0] symbol_table_name = None - if module_name in windows_constants.KERNEL_MODULE_NAMES: + if module_name in constants.windows.KERNEL_MODULE_NAMES: symbol_table_name = symbol_table context_module = contexts.SizedModule(context, diff --git a/volatility/framework/plugins/windows/vaddump.py b/volatility/framework/plugins/windows/vaddump.py index ed36d44b7..4ca5483d3 100644 --- a/volatility/framework/plugins/windows/vaddump.py +++ b/volatility/framework/plugins/windows/vaddump.py @@ -5,12 +5,10 @@ import logging from typing import List -import volatility.plugins.windows.pslist as pslist -import volatility.plugins.windows.vadinfo as vadinfo - from volatility.framework import renderers, interfaces, exceptions from volatility.framework.configuration import requirements from volatility.framework.objects import utility +from volatility.plugins.windows import pslist, vadinfo vollog = logging.getLogger(__name__) @@ -33,7 +31,9 @@ class VadDump(interfaces.plugins.PluginInterface): optional = True), requirements.IntRequirement( name = 'pid', description = "Process ID to include (all other processes are excluded)", - optional = True) + optional = True), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), + requirements.PluginRequirement(name = 'vadinfo', plugin = vadinfo.VadInfo, version = (1, 0, 0)), ] def _generator(self, procs): diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility/framework/plugins/windows/vadinfo.py index 47a540c7e..2608026de 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility/framework/plugins/windows/vadinfo.py @@ -5,12 +5,11 @@ import logging from typing import Callable, List, Generator, Iterable -import volatility.plugins.windows.pslist as pslist - from volatility.framework import renderers, interfaces from volatility.framework.configuration import requirements from volatility.framework.objects import utility from volatility.framework.renderers import format_hints +from volatility.plugins.windows import pslist vollog = logging.getLogger(__name__) @@ -34,6 +33,8 @@ winnt_protections = { class VadInfo(interfaces.plugins.PluginInterface): """Lists process memory ranges.""" + _version = (1, 0, 0) + def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self._protect_values = None @@ -53,7 +54,8 @@ class VadInfo(interfaces.plugins.PluginInterface): optional = True), requirements.IntRequirement( name = 'pid', description = "Process ID to include (all other processes are excluded)", - optional = True) + optional = True), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), ] @classmethod diff --git a/volatility/framework/plugins/windows/verinfo.py b/volatility/framework/plugins/windows/verinfo.py index de1e5ed54..3ccdcd1cb 100644 --- a/volatility/framework/plugins/windows/verinfo.py +++ b/volatility/framework/plugins/windows/verinfo.py @@ -6,15 +6,12 @@ import io import logging from typing import Generator, List, Tuple, Union -import volatility.plugins.windows.moddump as moddump -import volatility.plugins.windows.modules as modules - from volatility.framework import exceptions, renderers, constants, interfaces from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints from volatility.framework.symbols import intermed from volatility.framework.symbols.windows import extensions -from volatility.plugins.windows import pslist +from volatility.plugins.windows import pslist, moddump, modules vollog = logging.getLogger(__name__) @@ -34,6 +31,8 @@ class VerInfo(interfaces.plugins.PluginInterface): ## TODO: and we don't want any CLI options from pslist, modules, or moddump return [ requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), + requirements.PluginRequirement(name = 'modules', plugin = modules.Modules, version = (1, 0, 0)), + requirements.PluginRequirement(name = 'moddump', plugin = moddump.ModDump, version = (1, 0, 0)), requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),