From 95c0ca4ffa0756854a8e16d657175aa67bd7077a Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Tue, 2 Aug 2022 01:47:18 +0900 Subject: [PATCH 01/10] Remove: pytest module --- test/test_volatility.py | 7 ------- 1 file changed, 7 deletions(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index eb713783b..515bef1cc 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -14,8 +14,6 @@ import hashlib import ntpath import json -import pytest - # # HELPER FUNCTIONS # @@ -61,7 +59,6 @@ def test_windows_pslist(image, volatility, python): assert out.find(b"svchost.exe") != -1 assert out.count(b"\n") > 10 assert rc == 0 - assert rc == 0 rc, out, err = runvol_plugin( "windows.pslist.PsList", image, volatility, python, pluginargs=["--pid", "4"]) @@ -69,7 +66,6 @@ def test_windows_pslist(image, volatility, python): assert out.find(b"system") != -1 assert out.count(b"\n") < 10 assert rc == 0 - assert rc == 0 def test_windows_psscan(image, volatility, python): rc, out, err = runvol_plugin("windows.psscan.PsScan", image, volatility, python) @@ -79,21 +75,18 @@ def test_windows_psscan(image, volatility, python): assert out.find(b"svchost.exe") != -1 assert out.count(b"\n") > 10 assert rc == 0 - assert rc == 0 def test_windows_dlllist(image, volatility, python): rc, out, err = runvol_plugin("windows.dlllist.DllList", image, volatility, python) out = out.lower() assert out.count(b"\n") > 10 assert rc == 0 - assert rc == 0 def test_windows_modules(image, volatility, python): rc, out, err = runvol_plugin("windows.modules.Modules", image, volatility, python) out = out.lower() assert out.count(b"\n") > 10 assert rc == 0 - assert rc == 0 def test_windows_hivelist(image, volatility, python): rc, out, err = runvol_plugin("windows.registry.hivelist.HiveList", image, volatility, python) From 64621d90e97cbb2300689559142f009f1af83f9e Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Tue, 2 Aug 2022 14:20:01 +0900 Subject: [PATCH 02/10] Add: VSL for frameworkinfo plugin --- volatility3/framework/plugins/frameworkinfo.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility3/framework/plugins/frameworkinfo.py b/volatility3/framework/plugins/frameworkinfo.py index b7c887d5c..63ba24d09 100644 --- a/volatility3/framework/plugins/frameworkinfo.py +++ b/volatility3/framework/plugins/frameworkinfo.py @@ -1,3 +1,7 @@ +# This file is Copyright 2022 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + from typing import List from volatility3 import framework From 9bfa80e59cb1907163b5adfc054a6a192332630f Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Tue, 2 Aug 2022 14:26:21 +0900 Subject: [PATCH 03/10] Add: VSL for initialize file --- volatility3/framework/layers/codecs/__init__.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility3/framework/layers/codecs/__init__.py b/volatility3/framework/layers/codecs/__init__.py index 550161e6d..e019bcbcd 100644 --- a/volatility3/framework/layers/codecs/__init__.py +++ b/volatility3/framework/layers/codecs/__init__.py @@ -1,3 +1,7 @@ +# This file is Copyright 2022 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + """Codecs used for encoding or decoding data should live here From 54f11d7e18b12c7a8fd384fa333406e5c3dded25 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Tue, 2 Aug 2022 14:26:47 +0900 Subject: [PATCH 04/10] Add: VSL for automagic/module --- volatility3/framework/automagic/module.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility3/framework/automagic/module.py b/volatility3/framework/automagic/module.py index 3d2bb584a..6810a58e2 100644 --- a/volatility3/framework/automagic/module.py +++ b/volatility3/framework/automagic/module.py @@ -1,3 +1,7 @@ +# This file is Copyright 2022 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + from volatility3.framework import interfaces, constants, configuration From a78bf32bd8df8fc075f52fed211e0bf4a9bb7840 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Tue, 2 Aug 2022 14:26:58 +0900 Subject: [PATCH 05/10] Add: VSL for layers/avml --- volatility3/framework/layers/avml.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility3/framework/layers/avml.py b/volatility3/framework/layers/avml.py index acc4493f4..f31737232 100644 --- a/volatility3/framework/layers/avml.py +++ b/volatility3/framework/layers/avml.py @@ -1,3 +1,7 @@ +# This file is Copyright 2022 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + """Functions that read AVML files. The user of the file doesn't have to worry about the compression, From 85a94efd67c41993b15d066343c545da05c2c898 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Tue, 2 Aug 2022 14:27:08 +0900 Subject: [PATCH 06/10] Add: VSL for layers/leechcore --- volatility3/framework/layers/leechcore.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility3/framework/layers/leechcore.py b/volatility3/framework/layers/leechcore.py index 8c492ca85..fb0442cfe 100644 --- a/volatility3/framework/layers/leechcore.py +++ b/volatility3/framework/layers/leechcore.py @@ -1,3 +1,7 @@ +# This file is Copyright 2022 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + import io import logging import urllib.parse From 5c76dc88e9bf4ec809f1e914a35ace5f14b446c2 Mon Sep 17 00:00:00 2001 From: Donghyun Kim Date: Tue, 2 Aug 2022 14:27:15 +0900 Subject: [PATCH 07/10] Add: VSL for layers/linear --- volatility3/framework/layers/linear.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility3/framework/layers/linear.py b/volatility3/framework/layers/linear.py index c5cb47bdc..383f3d558 100644 --- a/volatility3/framework/layers/linear.py +++ b/volatility3/framework/layers/linear.py @@ -1,3 +1,7 @@ +# This file is Copyright 2022 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + import functools from typing import List, Optional, Tuple, Iterable From 6f991f8d4f6d663bd69d33b8c83f61ce37ea39f2 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 3 Aug 2022 22:01:21 +0100 Subject: [PATCH 08/10] Core: Fix up LGTM issues across the codebase --- volatility3/framework/automagic/symbol_cache.py | 13 ++++++------- volatility3/framework/automagic/symbol_finder.py | 5 ++--- volatility3/framework/plugins/linux/psaux.py | 16 ++++++++-------- volatility3/framework/symbols/windows/pdbutil.py | 2 +- 4 files changed, 17 insertions(+), 19 deletions(-) diff --git a/volatility3/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py index c7cb6a5b8..558bfb2f1 100644 --- a/volatility3/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -12,9 +12,7 @@ import urllib.request from abc import abstractmethod from typing import Dict, Generator, Iterable, List, Optional, Tuple -import volatility3.framework -import volatility3.schemas -from volatility3 import schemas +from volatility3 import framework, schemas from volatility3.framework import constants, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.layers import resources @@ -41,7 +39,7 @@ class IdentifierProcessor: Returns: identifier is valid or None if not found """ - raise NotImplemented("This base class has no get_identifier method defined") + raise NotImplementedError("This base class has no get_identifier method defined") class WindowsIdentifier(IdentifierProcessor): @@ -94,7 +92,7 @@ class CacheManagerInterface(interfaces.configuration.VersionableInterface): super().__init__() self._filename = filename self._classifiers = {} - for subclazz in volatility3.framework.class_subclasses(IdentifierProcessor): + for subclazz in framework.class_subclasses(IdentifierProcessor): self._classifiers[subclazz.operating_system] = subclazz def add_identifier(self, location: str, operating_system: str, identifier: str): @@ -267,7 +265,7 @@ class SqliteCache(CacheManagerInterface): if row['location'] in files_to_timestamp: cache_update.add(row['location']) - idextractors = list(volatility3.framework.class_subclasses(IdentifierProcessor)) + idextractors = list(framework.class_subclasses(IdentifierProcessor)) # New or not recently updated @@ -347,7 +345,8 @@ class SqliteCache(CacheManagerInterface): if missing_locations: self._database.cursor().execute( - f"DELETE FROM cache WHERE location IN ({','.join(['?'] * len(missing_locations))})", [x for x in missing_locations]) + f"DELETE FROM cache WHERE location IN ({','.join(['?'] * len(missing_locations))})", + [x for x in missing_locations]) self._database.commit() def get_identifier_dictionary(self, operating_system: Optional[str] = None, local_only: bool = False) -> \ diff --git a/volatility3/framework/automagic/symbol_finder.py b/volatility3/framework/automagic/symbol_finder.py index 610ed0e18..a9221a7cc 100644 --- a/volatility3/framework/automagic/symbol_finder.py +++ b/volatility3/framework/automagic/symbol_finder.py @@ -123,9 +123,8 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface): requirement.construct(context, config_path) break else: - if symbol_files: - vollog.debug(f"Symbol library path not found: {symbol_files}") - # print("Kernel", banner, hex(banner_offset)) + vollog.debug(f"Symbol library path not found for: {banner}") + # print("Kernel", banner, hex(banner_offset)) else: vollog.debug("No existing banners found") # TODO: Fallback to generic regex search? diff --git a/volatility3/framework/plugins/linux/psaux.py b/volatility3/framework/plugins/linux/psaux.py index ed91c66f2..d8b844ca4 100644 --- a/volatility3/framework/plugins/linux/psaux.py +++ b/volatility3/framework/plugins/linux/psaux.py @@ -4,11 +4,12 @@ from typing import Optional +from volatility3.framework import exceptions, interfaces, renderers from volatility3.framework.configuration import requirements -from volatility3.framework import symbols, exceptions, renderers, interfaces +from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.plugins.linux import pslist -from volatility3.framework.interfaces import plugins + class PsAux(plugins.PluginInterface): """ Lists processes with their command line arguments """ @@ -29,7 +30,7 @@ class PsAux(plugins.PluginInterface): ] def _get_command_line_args(self, task: interfaces.objects.ObjectInterface, - name: str) -> Optional[str]: + name: str) -> Optional[str]: """ Reads the command line arguments of a process These are stored on the userland stack @@ -104,8 +105,7 @@ class PsAux(plugins.PluginInterface): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("PPID", int), ("COMM", str), ("ARGS", str)], - self._generator( - pslist.PsList.list_tasks(self.context, - self.config['kernel'], - filter_func = filter_func))) - + self._generator( + pslist.PsList.list_tasks(self.context, + self.config['kernel'], + filter_func = filter_func))) diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index af3741bbe..430ad6a30 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -13,7 +13,7 @@ from typing import Any, Dict, Generator, List, Optional, Tuple, Union from urllib import parse, request from volatility3 import symbols -from volatility3.framework import constants, contexts, exceptions, interfaces +from volatility3.framework import constants, exceptions, interfaces from volatility3.framework.automagic import symbol_cache from volatility3.framework.configuration import requirements from volatility3.framework.configuration.requirements import SymbolTableRequirement From 4c4ccbf4e0e1893b8eefacdb4264ff14585a8802 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 3 Aug 2022 22:03:26 +0100 Subject: [PATCH 09/10] Core: Fix remaining LGTM error --- volatility3/framework/layers/physical.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/layers/physical.py b/volatility3/framework/layers/physical.py index 0633637ca..b09055c90 100644 --- a/volatility3/framework/layers/physical.py +++ b/volatility3/framework/layers/physical.py @@ -5,7 +5,7 @@ import logging import threading from typing import Any, Dict, IO, List, Optional, Union -from volatility3.framework import exceptions, interfaces, constants +from volatility3.framework import constants, exceptions, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.layers import resources @@ -191,7 +191,7 @@ class FileLayer(interfaces.layers.DataLayerInterface): """Closes the file handle.""" self._file.close() - def __exit__(self) -> None: + def __exit__(self, type, value, traceback) -> None: self.destroy() @classmethod From f8506862c4d92422a5e8927f70778f7faf69faf9 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 3 Aug 2022 22:59:45 +0100 Subject: [PATCH 10/10] Core: Move jsonschema to dev requirements --- requirements-dev.txt | 26 ++++++++++++++++++++++++++ requirements.txt | 3 --- 2 files changed, 26 insertions(+), 3 deletions(-) create mode 100644 requirements-dev.txt diff --git a/requirements-dev.txt b/requirements-dev.txt new file mode 100644 index 000000000..3ff7c50b8 --- /dev/null +++ b/requirements-dev.txt @@ -0,0 +1,26 @@ +# The following packages are required for core functionality. +pefile>=2017.8.1 + +# The following packages are optional. +# If certain packages are not necessary, place a comment (#) at the start of the line. + +# This is required for the yara plugins +yara-python>=3.8.0 + +# This is required for several plugins that perform malware analysis and disassemble code. +# It can also improve accuracy of Windows 8 and later memory samples. +capstone>=3.0.5 + +# This is required by plugins that decrypt passwords, password hashes, etc. +pycryptodome + +# This can improve error messages regarding improperly configured ISF files, +# but is only recommended for development +# jsonschema>=2.3.0 + +# This is required for memory acquisition via leechcore/pcileech. +leechcorepyc>=2.4.0 + +# This is required for analyzing Linux samples compressed using AVMLs native +# compression format. It is not required for AVML's standard LiME compression. +python-snappy==0.6.0 diff --git a/requirements.txt b/requirements.txt index 290d9ca97..1793012f1 100644 --- a/requirements.txt +++ b/requirements.txt @@ -14,9 +14,6 @@ capstone>=3.0.5 # This is required by plugins that decrypt passwords, password hashes, etc. pycryptodome -# This can improve error messages regarding improperly configured ISF files. -jsonschema>=2.3.0 - # This is required for memory acquisition via leechcore/pcileech. leechcorepyc>=2.4.0