mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-22 09:34:52 +02:00
More minor cleanup.
This commit is contained in:
@@ -2,7 +2,7 @@
|
||||
typically found in Mac's lsmod command.
|
||||
"""
|
||||
|
||||
from volatility.framework import renderers, constants, interfaces
|
||||
from volatility.framework import renderers, interfaces
|
||||
from volatility.framework.automagic import mac
|
||||
from volatility.framework.configuration import requirements
|
||||
from volatility.framework.interfaces import plugins
|
||||
|
||||
@@ -25,7 +25,7 @@ class Malfind(interfaces_plugins.PluginInterface):
|
||||
"""
|
||||
|
||||
proc_layer_name = task.add_process_layer()
|
||||
if proc_layer_name == None:
|
||||
if proc_layer_name is None:
|
||||
return
|
||||
|
||||
proc_layer = self.context.memory[proc_layer_name]
|
||||
@@ -57,11 +57,11 @@ class Malfind(interfaces_plugins.PluginInterface):
|
||||
vma.get_perms(), format_hints.HexBytes(data), disasm))
|
||||
|
||||
def run(self):
|
||||
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
|
||||
filt = pslist.PsList.create_filter([self.config.get('pid', None)])
|
||||
|
||||
plugin = pslist.PsList.list_tasks
|
||||
|
||||
return renderers.TreeGrid(
|
||||
[("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex),
|
||||
("Protection", str), ("Hexdump", format_hints.HexBytes), ("Disasm", interfaces_renderers.Disassembly)],
|
||||
self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filter)))
|
||||
self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filt)))
|
||||
|
||||
@@ -2,14 +2,9 @@
|
||||
typically found in Linux's /proc file system.
|
||||
"""
|
||||
|
||||
import datetime
|
||||
import struct
|
||||
from operator import attrgetter
|
||||
|
||||
from volatility.framework import exceptions, constants, renderers, symbols
|
||||
from volatility.framework import exceptions, renderers
|
||||
from volatility.framework.interfaces import plugins
|
||||
from volatility.framework.objects import utility
|
||||
from volatility.framework.renderers import format_hints
|
||||
from volatility.plugins.mac import pslist
|
||||
|
||||
|
||||
@@ -26,7 +21,7 @@ class Psaux(plugins.PluginInterface):
|
||||
task_name = utility.array_to_string(task.p_comm)
|
||||
|
||||
proc_layer_name = task.add_process_layer()
|
||||
if proc_layer_name == None:
|
||||
if proc_layer_name is None:
|
||||
print("no proc layer")
|
||||
continue
|
||||
|
||||
@@ -34,7 +29,7 @@ class Psaux(plugins.PluginInterface):
|
||||
|
||||
argsstart = task.user_stack - task.p_argslen
|
||||
|
||||
if (not proc_layer.is_valid(argsstart) or task.p_argslen == 0 or task.p_argc == 0):
|
||||
if not proc_layer.is_valid(argsstart) or task.p_argslen == 0 or task.p_argc == 0:
|
||||
print("bad check")
|
||||
continue
|
||||
|
||||
@@ -85,10 +80,10 @@ class Psaux(plugins.PluginInterface):
|
||||
yield (0, (task.p_pid, task_name, task.p_argc, args_str))
|
||||
|
||||
def run(self):
|
||||
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
|
||||
filt = pslist.PsList.create_filter([self.config.get('pid', None)])
|
||||
|
||||
plugin = pslist.PsList.list_tasks
|
||||
|
||||
return renderers.TreeGrid(
|
||||
[("PID", int), ("Process", str), ("Argc", int), ("Arguments", str)],
|
||||
self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filter)))
|
||||
self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filt)))
|
||||
|
||||
@@ -23,13 +23,21 @@ class PsList(interfaces_plugins.PluginInterface):
|
||||
|
||||
@classmethod
|
||||
def create_filter(cls, pid_list: typing.List[int] = None) -> typing.Callable[[int], bool]:
|
||||
filter = lambda _: False
|
||||
|
||||
def nullfilter():
|
||||
return False
|
||||
|
||||
filt = nullfilter
|
||||
# FIXME: mypy #4973 or #2608
|
||||
pid_list = pid_list or []
|
||||
filter_list = [x for x in pid_list if x is not None]
|
||||
if filter_list:
|
||||
filter = lambda x: x not in filter_list
|
||||
return filter
|
||||
|
||||
def list_filter(x):
|
||||
return x not in filter_list
|
||||
|
||||
filt = list_filter
|
||||
return filt
|
||||
|
||||
def _generator(self):
|
||||
for task in self.list_tasks(
|
||||
@@ -56,7 +64,7 @@ class PsList(interfaces_plugins.PluginInterface):
|
||||
proc = darwin.object(symbol_name = "allproc").lh_first
|
||||
|
||||
seen = {}
|
||||
while proc != None and proc.vol.offset != 0:
|
||||
while proc is not None and proc.vol.offset != 0:
|
||||
if proc.vol.offset in seen:
|
||||
vollog.log(logging.INFO, "Recursive process list detected (a result of non-atomic acquisition).")
|
||||
break
|
||||
|
||||
Reference in New Issue
Block a user