WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 11:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Pylinting and typing fix.

Browse Source
This commit is contained in:
Mike Auty
2018-03-21 17:04:10 +00:00
parent e133509ea8
commit 2522d588ea
2 changed files with 17 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/interfaces/configuration.py
+2 -1
View File
@@ -627,7 +627,8 @@ class TranslationLayerRequirement(ConstructableRequirementInterface, Configurabl
obj = self._construct_class(context, config_path, args)
if obj is not None:
context.add_layer(obj)
context.config[config_path] = obj.name
# This should already be done by the _construct_class method
# context.config[config_path] = obj.name
return None
def build_configuration(self,
volatility/framework/symbols/windows/extensions/__init__.py
+15 -11
View File
@@ -1,8 +1,8 @@
import collections.abc
import datetime
import functools
import logging
import typing
import functools
from volatility.framework import constants, exceptions, interfaces, objects, renderers
from volatility.framework.symbols import generic
@@ -28,9 +28,9 @@ class _MMVAD_SHORT(objects.Struct):
try:
# TODO: instantiate a _POOL_HEADER and return PoolTag
bytesobj = self._context.object(symbol_table_name + constants.BANG + "bytes",
layer_name = self.vol.layer_name,
offset = vad_address,
length = 4)
layer_name = self.vol.layer_name,
offset = vad_address,
length = 4)
return bytesobj.decode()
except exceptions.InvalidAddressException:
@@ -70,7 +70,8 @@ class _MMVAD_SHORT(objects.Struct):
else:
# any node other than the root that doesn't have a recognized tag
# is just garbage and we skip the node entirely
vollog.log(constants.LOGLEVEL_VVV, "Skipping VAD at {} depth {} with tag {}".format(self.vol.offset, depth, tag))
vollog.log(constants.LOGLEVEL_VVV,
"Skipping VAD at {} depth {} with tag {}".format(self.vol.offset, depth, tag))
return
if target:
@@ -230,11 +231,12 @@ class _MMVAD_SHORT(objects.Struct):
"""Only long(er) vads have mapped files"""
return renderers.NotApplicableValue()
class _MMVAD(_MMVAD_SHORT):
def get_file_name(self):
"""Get the name of the file mapped into the memory range (if any)"""
file_name = renderers.NotApplicableValue()
try:
@@ -244,13 +246,15 @@ class _MMVAD(_MMVAD_SHORT):
# this is for vista through windows 7
else:
file_name = self.Subsection.ControlArea.FilePointer.dereference().cast("_FILE_OBJECT").FileName.get_string()
file_name = self.Subsection.ControlArea.FilePointer.dereference().cast(
"_FILE_OBJECT").FileName.get_string()
except exceptions.PagedInvalidAddressException:
pass
return file_name
class _EX_FAST_REF(objects.Struct):
"""This is a standard Windows structure that stores a pointer to an
object but also leverages the least significant bits to encode additional
@@ -311,8 +315,8 @@ class _DEVICE_OBJECT(objects.Struct, ExecutiveObject):
class _FILE_OBJECT(objects.Struct, ExecutiveObject):
def file_name_with_device(self) -> str:
name = renderers.UnreadableValue()
def file_name_with_device(self) -> typing.Union[str, interfaces.renderers.BaseAbsentValue]:
name = renderers.UnreadableValue() # type: typing.Union[str, interfaces.renderers.BaseAbsentValue]
if self._context.memory[self.vol.layer_name].is_valid(self.DeviceObject):
name = "\\Device\\{}".format(self.DeviceObject.get_device_name())
@@ -477,7 +481,7 @@ class _EPROCESS(generic.GenericIntelProcess):
return False
return value != 0 and value != None
def get_vad_root(self):
# windows 8 and 2012 (_MM_AVL_TABLE)
@@ -486,7 +490,7 @@ class _EPROCESS(generic.GenericIntelProcess):
# windows 8.1 and windows 10 (_RTL_AVL_TREE)
elif hasattr(self.VadRoot, "Root"):
return self.VadRoot.Root.dereference() # .cast("_MMVAD")
return self.VadRoot.Root.dereference() # .cast("_MMVAD")
else:
# windows xp and 2003