WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 03:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Reformat all python files using yapf with custom volatility style.

Browse Source
This commit is contained in:
Mike Auty
2018-12-16 16:50:17 +00:00
parent 5bf2b78884
commit 19572b6e1e
99 changed files with 1672 additions and 2158 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/linux/bash.py
+24 -32
View File
@@ -21,11 +21,11 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
return [requirements.TranslationLayerRequirement(name = 'primary',
description = 'Kernel Address Space',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux",
description = "Linux Kernel")]
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "vmlinux", description = "Linux Kernel")
]
def _generator(self, tasks):
is_32bit = not symbols.symbol_table_is_64bit(self.context, self.config["vmlinux"])
@@ -36,13 +36,10 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
pack_format = "Q"
bash_json_file = "bash64"
bash_table_name = BashIntermedSymbols.create(self.context,
self.config_path,
"linux",
bash_json_file)
bash_table_name = BashIntermedSymbols.create(self.context, self.config_path, "linux", bash_json_file)
ts_offset = self.context.symbol_space.get_type(
bash_table_name + constants.BANG + "hist_entry").relative_child_offset("timestamp")
ts_offset = self.context.symbol_space.get_type(bash_table_name + constants.BANG +
"hist_entry").relative_child_offset("timestamp")
for task in tasks:
task_name = utility.array_to_string(task.comm)
@@ -58,19 +55,22 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
bang_addrs = []
# find '#' values on the heap
for address in proc_layer.scan(self.context,
scanners.BytesScanner(b"#"),
sections = task.get_process_memory_sections(heap_only = True)):
for address in proc_layer.scan(
self.context,
scanners.BytesScanner(b"#"),
sections = task.get_process_memory_sections(heap_only = True)):
bang_addrs.append(struct.pack(pack_format, address))
history_entries = []
for address, _ in proc_layer.scan(self.context,
scanners.MultiStringScanner(bang_addrs),
sections = task.get_process_memory_sections(heap_only = True)):
hist = self.context.object(bash_table_name + constants.BANG + "hist_entry",
offset = address - ts_offset,
layer_name = proc_layer_name)
for address, _ in proc_layer.scan(
self.context,
scanners.MultiStringScanner(bang_addrs),
sections = task.get_process_memory_sections(heap_only = True)):
hist = self.context.object(
bash_table_name + constants.BANG + "hist_entry",
offset = address - ts_offset,
layer_name = proc_layer_name)
if hist.is_valid():
history_entries.append(hist)
@@ -84,24 +84,16 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
plugin = pslist.PsList.list_tasks
return renderers.TreeGrid(
[("PID", int),
("Process", str),
("CommandTime", datetime.datetime),
("Command", str)],
self._generator(plugin(self.context,
self.config['primary'],
self.config['vmlinux'],
filter = filt)))
[("PID", int), ("Process", str), ("CommandTime", datetime.datetime), ("Command", str)],
self._generator(plugin(self.context, self.config['primary'], self.config['vmlinux'], filter = filt)))
def generate_timeline(self):
filt = pslist.PsList.create_filter([self.config.get('pid', None)])
plugin = pslist.PsList.list_tasks
for row in self._generator(plugin(self.context,
self.config['primary'],
self.config['vmlinux'],
filter = filt)):
for row in self._generator(
plugin(self.context, self.config['primary'], self.config['vmlinux'], filter = filt)):
_depth, row_data = row
description = "{} ({}): \"{}\"".format(row_data[0], row_data[1], row_data[3])
yield (description, timeliner.TimeLinerType.CREATED, row_data[2])