diff --git a/volatility/framework/plugins/windows/cachedump.py b/volatility/framework/plugins/windows/cachedump.py index 797cab018..d03d0b57a 100644 --- a/volatility/framework/plugins/windows/cachedump.py +++ b/volatility/framework/plugins/windows/cachedump.py @@ -81,7 +81,7 @@ class Cachedump(interfaces.plugins.PluginInterface): def _generator(self, syshive, sechive): bootkey = hashdump.Hashdump.get_bootkey(syshive) if not bootkey: - raise Exception('Unable to find bootkey') + raise ValueError('Unable to find bootkey') is_vista_or_later = poolscanner.os_distinguisher(version_check = lambda x: x >= (6, 0), fallback_checks = [("KdCopyDataBlock", None, True)]) @@ -89,15 +89,15 @@ class Cachedump(interfaces.plugins.PluginInterface): lsakey = lsadump.Lsadump.get_lsa_key(sechive, bootkey, vista_or_later) if not lsakey: - raise Exception('Unable to find lsa key') + raise ValueError('Unable to find lsa key') nlkm = self.get_nlkm(sechive, lsakey, vista_or_later) if not nlkm: - raise Exception('Unable to find nlkma key') + raise ValueError('Unable to find nlkma key') cache = sechive.get_key("Cache") if not cache: - raise Exception('Unable to find cache key') + raise ValueError('Unable to find cache key') for cache_item in cache.get_values(): diff --git a/volatility/framework/plugins/windows/hashdump.py b/volatility/framework/plugins/windows/hashdump.py index 496aa29bb..90857de67 100644 --- a/volatility/framework/plugins/windows/hashdump.py +++ b/volatility/framework/plugins/windows/hashdump.py @@ -277,7 +277,7 @@ class Hashdump(interfaces.plugins.PluginInterface): rid = int(str(user.get_name()), 16) yield (0, (name, rid, lmout, ntout)) else: - raise Exception("Hbootkey is not valid") + raise ValueError("Hbootkey is not valid") def run(self): offset = self.config.get('offset', None) diff --git a/volatility/framework/plugins/windows/lsadump.py b/volatility/framework/plugins/windows/lsadump.py index b486860a8..cf659c7ed 100644 --- a/volatility/framework/plugins/windows/lsadump.py +++ b/volatility/framework/plugins/windows/lsadump.py @@ -94,7 +94,7 @@ class Lsadump(interfaces.plugins.PluginInterface): try: enc_secret_key = sechive.get_key("Policy\\Secrets\\" + name + "\\CurrVal") except KeyError: - raise Exception("Unable to read cache from memory") + raise ValueError("Unable to read cache from memory") enc_secret_value = next(enc_secret_key.get_values()) @@ -118,7 +118,7 @@ class Lsadump(interfaces.plugins.PluginInterface): Decrypts a block of data with DES using given key. Note that key can be longer than 7 bytes.""" - decrypted_data = '' + decrypted_data = b'' j = 0 # key index for i in range(0, len(secret), 8): @@ -145,14 +145,14 @@ class Lsadump(interfaces.plugins.PluginInterface): bootkey = hashdump.Hashdump.get_bootkey(syshive) lsakey = self.get_lsa_key(sechive, bootkey, vista_or_later) if not bootkey: - raise Exception('Unable to find bootkey') + raise ValueError('Unable to find bootkey') if not lsakey: - raise Exception('Unable to find lsa key') + raise ValueError('Unable to find lsa key') secrets_key = sechive.get_key('Policy\\Secrets') if not secrets_key: - raise Exception('Unable to find secrets key') + raise ValueError('Unable to find secrets key') for key in secrets_key.get_subkeys(): @@ -171,10 +171,10 @@ class Lsadump(interfaces.plugins.PluginInterface): if not vista_or_later: secret = self.decrypt_secret(enc_secret[0xC:], lsakey) else: - secret = self.decrypt_aes(enc_secret, lsakey).decode('latin1') + secret = self.decrypt_aes(enc_secret, lsakey) - yield (0,(key.get_name()+'\n', secret+'\n', secret.encode('latin1'))) + yield (0,(key.get_name(), secret.decode('latin1'), secret)) diff --git a/volatility/framework/symbols/linux/extensions/elf.py b/volatility/framework/symbols/linux/extensions/elf.py index f09cf087b..31c60fdc8 100644 --- a/volatility/framework/symbols/linux/extensions/elf.py +++ b/volatility/framework/symbols/linux/extensions/elf.py @@ -2,27 +2,13 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -<<<<<<< HEAD from typing import Dict, Tuple - from volatility.framework import constants from volatility.framework import objects, interfaces -======= -from volatility.framework import exceptions, constants -from volatility.framework import objects, interfaces -from volatility.framework.objects import utility -from volatility.framework.renderers import conversion -from typing import Any, Dict, List, Optional, Tuple, Union, Type ->>>>>>> added hashdump - class elf(objects.StructType): ''' -<<<<<<< HEAD Class used to create elf objects. It overrides the typename to `Elf32_` or `Elf64_`, -======= - Class used to create elf objects. It overrides the typename to Elf32_ or Elf64_, ->>>>>>> added hashdump depending on the corresponding value on e_ident ''' @@ -57,11 +43,7 @@ class elf(objects.StructType): elif ei_class == 2: self._type_prefix = "Elf64_" else: -<<<<<<< HEAD raise ValueError("Unsupported ei_class value {}".format(ei_class)) -======= - self._type_prefix = None ->>>>>>> added hashdump # Construct the full header self._hdr = self._context.object(symbol_table_name + constants.BANG + self._type_prefix + "Ehdr",