Merge branch 'volatilityfoundation:develop' into feature/vadwalk

requirements-dev.txt

@@ -0,0 +1,26 @@
+# The following packages are required for core functionality.
+pefile>=2017.8.1
+
+# The following packages are optional.
+# If certain packages are not necessary, place a comment (#) at the start of the line.
+
+# This is required for the yara plugins
+yara-python>=3.8.0
+
+# This is required for several plugins that perform malware analysis and disassemble code.
+# It can also improve accuracy of Windows 8 and later memory samples.
+capstone>=3.0.5
+
+# This is required by plugins that decrypt passwords, password hashes, etc.
+pycryptodome
+
+# This can improve error messages regarding improperly configured ISF files,
+# but is only recommended for development
+# jsonschema>=2.3.0
+
+# This is required for memory acquisition via leechcore/pcileech.
+leechcorepyc>=2.4.0
+
+# This is required for analyzing Linux samples compressed using AVMLs native
+# compression format.  It is not required for AVML's standard LiME compression.
+python-snappy==0.6.0

requirements.txt

@@ -14,9 +14,6 @@ capstone>=3.0.5
 # This is required by plugins that decrypt passwords, password hashes, etc.
 pycryptodome
 
-# This can improve error messages regarding improperly configured ISF files.
-jsonschema>=2.3.0
-
 # This is required for memory acquisition via leechcore/pcileech.
 leechcorepyc>=2.4.0
 

test/test_volatility.py

@@ -14,8 +14,6 @@ import hashlib
 import ntpath
 import json
 
-import pytest
-
 #
 # HELPER FUNCTIONS
 #
@@ -61,7 +59,6 @@ def test_windows_pslist(image, volatility, python):
     assert out.find(b"svchost.exe") != -1
     assert out.count(b"\n") > 10
     assert rc == 0
-    assert rc == 0
 
     rc, out, err = runvol_plugin(
         "windows.pslist.PsList", image, volatility, python, pluginargs=["--pid", "4"])
@@ -69,7 +66,6 @@ def test_windows_pslist(image, volatility, python):
     assert out.find(b"system") != -1
     assert out.count(b"\n") < 10
     assert rc == 0
-    assert rc == 0
 
 def test_windows_psscan(image, volatility, python):
     rc, out, err = runvol_plugin("windows.psscan.PsScan", image, volatility, python)
@@ -79,21 +75,18 @@ def test_windows_psscan(image, volatility, python):
     assert out.find(b"svchost.exe") != -1
     assert out.count(b"\n") > 10
     assert rc == 0
-    assert rc == 0
 
 def test_windows_dlllist(image, volatility, python):
     rc, out, err = runvol_plugin("windows.dlllist.DllList", image, volatility, python)
     out = out.lower()
     assert out.count(b"\n") > 10
     assert rc == 0
-    assert rc == 0
 
 def test_windows_modules(image, volatility, python):
     rc, out, err = runvol_plugin("windows.modules.Modules", image, volatility, python)
     out = out.lower()
     assert out.count(b"\n") > 10
     assert rc == 0
-    assert rc == 0
 
 def test_windows_hivelist(image, volatility, python):
     rc, out, err = runvol_plugin("windows.registry.hivelist.HiveList", image, volatility, python)

volatility3/framework/automagic/module.py

@@ -1,3 +1,7 @@
+# This file is Copyright 2022 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+
 from volatility3.framework import interfaces, constants, configuration
 
 

volatility3/framework/automagic/symbol_cache.py

@@ -12,9 +12,7 @@ import urllib.request
 from abc import abstractmethod
 from typing import Dict, Generator, Iterable, List, Optional, Tuple
 
-import volatility3.framework
-import volatility3.schemas
-from volatility3 import schemas
+from volatility3 import framework, schemas
 from volatility3.framework import constants, interfaces
 from volatility3.framework.configuration import requirements
 from volatility3.framework.layers import resources
@@ -41,7 +39,7 @@ class IdentifierProcessor:
         Returns:
             identifier is valid or None if not found
         """
-        raise NotImplemented("This base class has no get_identifier method defined")
+        raise NotImplementedError("This base class has no get_identifier method defined")
 
 
 class WindowsIdentifier(IdentifierProcessor):
@@ -94,7 +92,7 @@ class CacheManagerInterface(interfaces.configuration.VersionableInterface):
         super().__init__()
         self._filename = filename
         self._classifiers = {}
-        for subclazz in volatility3.framework.class_subclasses(IdentifierProcessor):
+        for subclazz in framework.class_subclasses(IdentifierProcessor):
             self._classifiers[subclazz.operating_system] = subclazz
 
     def add_identifier(self, location: str, operating_system: str, identifier: str):
@@ -267,7 +265,7 @@ class SqliteCache(CacheManagerInterface):
                 if row['location'] in files_to_timestamp:
                     cache_update.add(row['location'])
 
-        idextractors = list(volatility3.framework.class_subclasses(IdentifierProcessor))
+        idextractors = list(framework.class_subclasses(IdentifierProcessor))
 
         # New or not recently updated
 
@@ -347,7 +345,8 @@ class SqliteCache(CacheManagerInterface):
 
         if missing_locations:
             self._database.cursor().execute(
-                f"DELETE FROM cache WHERE location IN ({','.join(['?'] * len(missing_locations))})", [x for x in missing_locations])
+                f"DELETE FROM cache WHERE location IN ({','.join(['?'] * len(missing_locations))})",
+                [x for x in missing_locations])
             self._database.commit()
 
     def get_identifier_dictionary(self, operating_system: Optional[str] = None, local_only: bool = False) -> \

volatility3/framework/automagic/symbol_finder.py

@@ -123,9 +123,8 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface):
                 requirement.construct(context, config_path)
                 break
             else:
-                if symbol_files:
-                    vollog.debug(f"Symbol library path not found: {symbol_files}")
-                    # print("Kernel", banner, hex(banner_offset))
+                vollog.debug(f"Symbol library path not found for: {banner}")
+                # print("Kernel", banner, hex(banner_offset))
         else:
             vollog.debug("No existing banners found")
             # TODO: Fallback to generic regex search?

volatility3/framework/layers/avml.py

@@ -1,3 +1,7 @@
+# This file is Copyright 2022 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+
 """Functions that read AVML files.
 
 The user of the file doesn't have to worry about the compression,

volatility3/framework/layers/codecs/__init__.py

@@ -1,3 +1,7 @@
+# This file is Copyright 2022 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+
 """Codecs used for encoding or decoding data should live here
 
 

volatility3/framework/layers/leechcore.py

@@ -1,3 +1,7 @@
+# This file is Copyright 2022 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+
 import io
 import logging
 import urllib.parse

volatility3/framework/layers/linear.py

@@ -1,3 +1,7 @@
+# This file is Copyright 2022 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+
 import functools
 from typing import List, Optional, Tuple, Iterable
 

volatility3/framework/layers/physical.py

@@ -5,7 +5,7 @@ import logging
 import threading
 from typing import Any, Dict, IO, List, Optional, Union
 
-from volatility3.framework import exceptions, interfaces, constants
+from volatility3.framework import constants, exceptions, interfaces
 from volatility3.framework.configuration import requirements
 from volatility3.framework.layers import resources
 
@@ -191,7 +191,7 @@ class FileLayer(interfaces.layers.DataLayerInterface):
         """Closes the file handle."""
         self._file.close()
 
-    def __exit__(self) -> None:
+    def __exit__(self, type, value, traceback) -> None:
         self.destroy()
 
     @classmethod

volatility3/framework/plugins/frameworkinfo.py

@@ -1,3 +1,7 @@
+# This file is Copyright 2022 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+
 from typing import List
 
 from volatility3 import framework

volatility3/framework/plugins/linux/psaux.py

@@ -4,11 +4,12 @@
 
 from typing import Optional
 
+from volatility3.framework import exceptions, interfaces, renderers
 from volatility3.framework.configuration import requirements
-from volatility3.framework import symbols, exceptions, renderers, interfaces
+from volatility3.framework.interfaces import plugins
 from volatility3.framework.objects import utility
 from volatility3.plugins.linux import pslist
-from volatility3.framework.interfaces import plugins
+
 
 class PsAux(plugins.PluginInterface):
     """ Lists processes with their command line arguments """
@@ -29,7 +30,7 @@ class PsAux(plugins.PluginInterface):
         ]
 
     def _get_command_line_args(self, task: interfaces.objects.ObjectInterface,
-                                    name: str) -> Optional[str]:
+                               name: str) -> Optional[str]:
         """
         Reads the command line arguments of a process
         These are stored on the userland stack
@@ -104,8 +105,7 @@ class PsAux(plugins.PluginInterface):
         filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None))
 
         return renderers.TreeGrid([("PID", int), ("PPID", int), ("COMM", str), ("ARGS", str)],
-                                    self._generator(
-                                        pslist.PsList.list_tasks(self.context,
-                                                                self.config['kernel'],
-                                                                filter_func = filter_func)))
-
+                                  self._generator(
+                                      pslist.PsList.list_tasks(self.context,
+                                                               self.config['kernel'],
+                                                               filter_func = filter_func)))

volatility3/framework/symbols/windows/pdbutil.py

@@ -13,7 +13,7 @@ from typing import Any, Dict, Generator, List, Optional, Tuple, Union
 from urllib import parse, request
 
 from volatility3 import symbols
-from volatility3.framework import constants, contexts, exceptions, interfaces
+from volatility3.framework import constants, exceptions, interfaces
 from volatility3.framework.automagic import symbol_cache
 from volatility3.framework.configuration import requirements
 from volatility3.framework.configuration.requirements import SymbolTableRequirement