From 113c23a66d4bf391eb2e1d1e6bafaa7673e7ce55 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 4 Jun 2018 23:55:38 +0100 Subject: [PATCH] Last of the typing fix-ups. --- volatility/framework/automagic/linux.py | 7 ++++--- volatility/framework/automagic/nlpdtbfinder.py | 6 ++++-- volatility/framework/automagic/pdbscan.py | 4 ++-- volatility/framework/automagic/windows.py | 18 +++++++----------- volatility/framework/interfaces/automagic.py | 2 +- volatility/framework/interfaces/context.py | 4 ++-- 6 files changed, 20 insertions(+), 21 deletions(-) diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index 0e7dc65f0..cf07e7446 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -69,7 +69,7 @@ class LinuxSymbolFinder(interfaces.automagic.AutomagicInterface): # Check if the Stacker has already found what we're looking for if layer.config.get('linux_banner', None): - banner_list = [(0, bytes(layer.config['linux_banner'], 'latin-1'))] + banner_list = [(0, bytes(layer.config['linux_banner'], 'latin-1'))] # type: typing.Iterable[typing.Any] else: # Swap to the physical layer for scanning # TODO: Fix this so it works for layers other than just Intel @@ -91,8 +91,9 @@ class LinuxSymbolFinder(interfaces.automagic.AutomagicInterface): requirement.construct(context, config_path) break else: - vollog.debug("Symbol library path not found: {}".format(symbol_files[0])) - # print("Kernel", banner, hex(banner_offset)) + if symbol_files: + vollog.debug("Symbol library path not found: {}".format(symbol_files[0])) + # print("Kernel", banner, hex(banner_offset)) else: vollog.debug("No existing linux banners found") # TODO: Fallback to generic regex search? diff --git a/volatility/framework/automagic/nlpdtbfinder.py b/volatility/framework/automagic/nlpdtbfinder.py index 649626ce7..74e55371d 100644 --- a/volatility/framework/automagic/nlpdtbfinder.py +++ b/volatility/framework/automagic/nlpdtbfinder.py @@ -38,7 +38,7 @@ class NlpDtbScanner(interfaces.layers.ScannerInterface): self._layer_class = layer_class self._physical_layer = physical_layer - def test_entries(self, valid_entries: typing.List[typing.Tuple[int, int]]) -> bool: + def test_entries(self, valid_entries: typing.Iterable[typing.Tuple[int, int]]) -> bool: """Scans through valid_entries, descending to see whether one can be successfully mapped to completion Returns the first valid DTB or None is no valid DTBs could be found @@ -156,7 +156,7 @@ class NlpDtbfinder(interfaces.automagic.AutomagicInterface): sub_config_path = interfaces.configuration.path_join(config_path, requirement.name) if (not interfaces.configuration.path_join(sub_config_path, "page_map_offset") in context.config and isinstance(requirement, requirements.TranslationLayerRequirement) and - requirement.requirements.get("class", None)): + requirement.requirements.get("class", False)): class_req = requirement.requirements["class"] for layer_class in validity_tests: if (layer_class.__module__ + "." + layer_class.__name__ == class_req.config_value(context, @@ -165,6 +165,8 @@ class NlpDtbfinder(interfaces.automagic.AutomagicInterface): if ("memory_layer" in requirement.requirements and not requirement.requirements["memory_layer"].unsatisfied(context, sub_config_path)): physical_layer = requirement.requirements["memory_layer"].config_value(context, sub_config_path) + if not isinstance(physical_layer, str): + raise ValueError("Physical Layer configuration must be a string") layer = context.memory[physical_layer] valid_entries = layer.scan(context, NlpDtbScanner(layer_class, layer), diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index 282c015bc..5516d6968 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -70,7 +70,7 @@ def scan(ctx: interfaces.context.ContextInterface, progress_callback: validity.ProgressCallback = None, start: typing.Optional[int] = None, end: typing.Optional[int] = None) \ - -> typing.Generator[typing.Dict[str, typing.Union[bytes, str, int]], None, None]: + -> typing.Generator[typing.Dict[str, typing.Optional[typing.Union[bytes, str, int]]], None, None]: """Scans through `layer_name` at `ctx` looking for RSDS headers that indicate one of four common pdb kernel names (as listed in `self.pdb_names`) and returns the tuple (GUID, age, pdb_name, signature_offset, mz_offset) @@ -200,7 +200,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): try: isf_path = intermed.IntermediateSymbolTable.file_symbol_url("windows", filter).__next__() except StopIteration: - isf_path = None + isf_path = '' if isf_path: vollog.debug("Using symbol library: {}".format(filter)) clazz = "volatility.framework.symbols.windows.WindowsKernelIntermedSymbols" diff --git a/volatility/framework/automagic/windows.py b/volatility/framework/automagic/windows.py index df5402643..383ee3e7d 100644 --- a/volatility/framework/automagic/windows.py +++ b/volatility/framework/automagic/windows.py @@ -41,10 +41,10 @@ class DtbTest(validity.ValidityRoutines): """ def __init__(self, - layer_type: typing.Type[layers.intel.Intel] = None, - ptr_struct: str = None, - ptr_reference: int = None, - mask: int = None) -> None: + layer_type: typing.Type[layers.intel.Intel], + ptr_struct: str, + ptr_reference: int, + mask: int) -> None: self.layer_type = self._check_class(layer_type, layers.intel.Intel) self.ptr_struct = self._check_type(ptr_struct, str) self.ptr_size = struct.calcsize(ptr_struct) @@ -217,11 +217,7 @@ class PageMapScanner(interfaces.layers.ScannerInterface): self.tests = tests def __call__(self, data: bytes, data_offset: int) \ - -> typing.Generator[typing.Tuple[DtbTest, typing.Set[int]], None, None]: - results = {} # type: typing.Dict[DtbTest, typing.Set[int]] - for test in self.tests: - results[test] = set() - + -> typing.Generator[typing.Tuple[DtbTest, int], None, None]: for test in self.tests: for page_offset in range(0, len(data), 0x1000): result = test(data, data_offset, page_offset) @@ -250,7 +246,7 @@ class WintelHelper(interfaces.automagic.AutomagicInterface): useful = [] sub_config_path = interfaces.configuration.path_join(config_path, requirement.name) if (isinstance(requirement, requirements.TranslationLayerRequirement) and - requirement.requirements.get("class", None)): + requirement.requirements.get("class", False)): class_req = requirement.requirements["class"] for test in self.tests: @@ -423,7 +419,7 @@ class WinSwapLayers(interfaces.automagic.AutomagicInterface): config: str, sub_config: str, requirement: interfaces.configuration.TranslationLayerRequirement) \ - -> typing.Tuple[str, str, requirements.LayerListRequirement]: + -> typing.Tuple[str, str, typing.Optional[requirements.LayerListRequirement]]: """Takes a Translation layer and returns its swap_layer requirement""" swap_req = None for req_name in requirement.requirements: diff --git a/volatility/framework/interfaces/automagic.py b/volatility/framework/interfaces/automagic.py index a176857ff..d6e7a28fd 100644 --- a/volatility/framework/interfaces/automagic.py +++ b/volatility/framework/interfaces/automagic.py @@ -51,7 +51,7 @@ class AutomagicInterface(interfaces_configuration.ConfigurableInterface, metacla context: interfaces.context.ContextInterface, config_path: str, requirement: interfaces.configuration.RequirementInterface, - progress_callback: validity.ProgressCallback = None) -> typing.List[str]: + progress_callback: validity.ProgressCallback = None) -> typing.Optional[typing.List[typing.Any]]: """Runs the automagic over the configurable""" return [] diff --git a/volatility/framework/interfaces/context.py b/volatility/framework/interfaces/context.py index 174e5ced4..23d1732d7 100644 --- a/volatility/framework/interfaces/context.py +++ b/volatility/framework/interfaces/context.py @@ -104,8 +104,8 @@ class Module(validity.ValidityRoutines, metaclass = ABCMeta): @abstractmethod def object(self, - symbol_name: str, - type_name: str, + symbol_name: str = None, + type_name: str = None, offset: int = None, **kwargs) -> 'interfaces.objects.ObjectInterface': """Returns an object created using the symbol_table and layer_name of the Module"""