diff --git a/development/dtbfinder.py b/development/dtbfinder.py index 31c807a2f..7a267a92c 100644 --- a/development/dtbfinder.py +++ b/development/dtbfinder.py @@ -35,13 +35,13 @@ if __name__ == '__main__': "filename")] = filename data = layers.physical.FileLayer(ctx, 'config' + str(args.filenames.index(filename)), 'data' + str(args.filenames.index(filename))) - ctx.memory.add_layer(data) + ctx.layers.add_layer(data) if args.lime: ctx.config[interfaces.configuration.path_join('lime-config' + str(args.filenames.index(filename)), "base_layer")] = 'data' + str(args.filenames.index(filename)) data = layers.lime.LimeLayer(ctx, 'lime-config' + str(args.filenames.index(filename)), 'lime-data' + str(args.filenames.index(filename))) - ctx.memory.add_layer(data) + ctx.layers.add_layer(data) layername = 'data' if args.lime: @@ -64,7 +64,7 @@ if __name__ == '__main__': if tests: for i in range(len(args.filenames)): print("[*] Scanning " + args.filenames[i] + "...") - scan_results = ctx.memory[layername + str(i)].scan(ctx, windows.PageMapScanner(tests)) + scan_results = ctx.layers[layername + str(i)].scan(ctx, windows.PageMapScanner(tests)) # Self-referential tests need post-processing to gather the most likely offset if args.selfref: diff --git a/development/nlpdtbfinder.py b/development/nlpdtbfinder.py index f4e15185e..adae682ef 100644 --- a/development/nlpdtbfinder.py +++ b/development/nlpdtbfinder.py @@ -85,7 +85,7 @@ def find_pd_mapping(ctx, layer_name, entries): pt_offset = (entry & PHYS_MASK) >> 12 try: - pt = ctx.memory.read(baselayer_name, pt_offset, PAGE_SIZE) + pt = ctx.layers.read(baselayer_name, pt_offset, PAGE_SIZE) except exceptions.InvalidAddressException: # print("page fault at " + hex(pt_offset)) return False @@ -109,7 +109,7 @@ def find_pdpt_mapping(ctx, layer_name, entries): pd_offset = (entry & PHYS_MASK) >> 12 try: - pd = ctx.memory.read(baselayer_name, pd_offset, PAGE_SIZE) + pd = ctx.layers.read(baselayer_name, pd_offset, PAGE_SIZE) except exceptions.InvalidAddressException: # print("page fault at " + hex(pd_offset)) return False @@ -129,7 +129,7 @@ def find_pml4_mapping(ctx, layer_name, entries): pdpte_offset = (entry & PHYS_MASK) >> 12 try: - pdpte = ctx.memory.read(baselayer_name, pdpte_offset, PAGE_SIZE) + pdpte = ctx.layers.read(baselayer_name, pdpte_offset, PAGE_SIZE) except exceptions.InvalidAddressException: # print("page fault at " + hex(pdpte_offset)) return False @@ -158,13 +158,13 @@ if __name__ == '__main__': "filename")] = filename data = layers.physical.FileLayer(ctx, 'config' + str(args.filenames.index(filename)), 'data' + str(args.filenames.index(filename))) - ctx.memory.add_layer(data) + ctx.layers.add_layer(data) if args.lime: ctx.config[interfaces.configuration.path_join('lime-config' + str(args.filenames.index(filename)), "base_layer")] = 'data' + str(args.filenames.index(filename)) data = layers.lime.LimeLayer(ctx, 'lime-config' + str(args.filenames.index(filename)), 'lime-data' + str(args.filenames.index(filename))) - ctx.memory.add_layer(data) + ctx.layers.add_layer(data) layername = 'data' if args.lime: @@ -175,7 +175,7 @@ if __name__ == '__main__': for i in range(len(args.filenames)): print("[*] Scanning " + args.filenames[i] + "...") baselayer_name = layername + str(i) - scan_results = ctx.memory[baselayer_name].scan(ctx, PML4EScanner()) + scan_results = ctx.layers[baselayer_name].scan(ctx, PML4EScanner()) for (dtb, entries) in scan_results: # print("trying: " + hex(dtb)) diff --git a/development/pdbscanner.py b/development/pdbscanner.py index 7024fd7fb..127bc374b 100644 --- a/development/pdbscanner.py +++ b/development/pdbscanner.py @@ -27,17 +27,17 @@ if __name__ == '__main__': ctx.config[interfaces.configuration.path_join(config_name, "filename")] = filename base = layers.physical.FileLayer(ctx, config_name, base_name) - ctx.memory.add_layer(base) + ctx.layers.add_layer(base) # XXX What's the right way to check for LiME? - (magic, ) = struct.unpack(' Optional[interfaces.layers.DataLayerInterface]: """Attempts to identify linux within this layer""" # Bail out by default unless we can stack properly - layer = context.memory[layer_name] + layer = context.layers[layer_name] join = interfaces.configuration.path_join # Never stack on top of an intel layer @@ -96,7 +96,7 @@ class LintelStacker(interfaces.automagic.StackerLayerInterface): table.get_symbol(dtb_symbol_name).address + kaslr_shift) # Build the new layer - new_layer_name = context.memory.free_layer_name("IntelLayer") + new_layer_name = context.layers.free_layer_name("IntelLayer") config_path = join("IntelHelper", new_layer_name) context.config[join(config_path, "memory_layer")] = layer_name context.config[join(config_path, "page_map_offset")] = dtb @@ -274,7 +274,7 @@ class LinuxUtilities(object): aslr_shift = 0): sym_table = context.symbol_space[symbol_table] - sym_layer = context.memory[layer_name] + sym_layer = context.layers[layer_name] if aslr_shift == 0: if not isinstance(sym_layer, layers.intel.Intel): @@ -297,7 +297,7 @@ class LinuxUtilities(object): swapper_signature = rb"swapper(\/0|\x00\x00)\x00\x00\x00\x00\x00\x00" module = context.module(symbol_table, layer_name, 0) - for offset in context.memory[layer_name].scan( + for offset in context.layers[layer_name].scan( scanner = scanners.RegExScanner(swapper_signature), context = context, progress_callback = progress_callback): diff --git a/volatility/framework/automagic/mac.py b/volatility/framework/automagic/mac.py index 3eb7ba439..c76adff06 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility/framework/automagic/mac.py @@ -56,7 +56,7 @@ class MacintelStacker(interfaces.automagic.StackerLayerInterface): progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]: """Attempts to identify mac within this layer""" # Bail out by default unless we can stack properly - layer = context.memory[layer_name] + layer = context.layers[layer_name] new_layer = None join = interfaces.configuration.path_join @@ -102,7 +102,7 @@ class MacintelStacker(interfaces.automagic.StackerLayerInterface): bootpml4_addr = MacUtilities.virtual_to_physical_address( table.get_symbol("BootPML4").address + kaslr_shift) - new_layer_name = context.memory.free_layer_name("MacDTBTempLayer") + new_layer_name = context.layers.free_layer_name("MacDTBTempLayer") config_path = join("automagic", "MacIntelHelper", new_layer_name) context.config[join(config_path, "memory_layer")] = layer_name context.config[join(config_path, "page_map_offset")] = bootpml4_addr @@ -117,7 +117,7 @@ class MacintelStacker(interfaces.automagic.StackerLayerInterface): dtb = idlepml4_addr # Build the new layer - new_layer_name = context.memory.free_layer_name("IntelLayer") + new_layer_name = context.layers.free_layer_name("IntelLayer") config_path = join("automagic", "MacIntelHelper", new_layer_name) context.config[join(config_path, "memory_layer")] = layer_name context.config[join(config_path, "page_map_offset")] = dtb @@ -142,7 +142,7 @@ class MacUtilities(object): aslr_shift = 0): sym_table = context.symbol_space[symbol_table] - sym_layer = context.memory[layer_name] + sym_layer = context.layers[layer_name] if aslr_shift == 0: if not isinstance(sym_layer, layers.intel.Intel): @@ -156,11 +156,11 @@ class MacUtilities(object): def _scan_generator(cls, context, layer_name, progress_callback): darwin_signature = rb"Darwin Kernel Version \d{1,3}\.\d{1,3}\.\d{1,3}: [^\x00]+\x00" - for offset in context.memory[layer_name].scan( + for offset in context.layers[layer_name].scan( scanner = scanners.RegExScanner(darwin_signature), context = context, progress_callback = progress_callback): - banner = context.memory[layer_name].read(offset, 128) + banner = context.layers[layer_name].read(offset, 128) idx = banner.find(b"\x00") if idx != -1: @@ -200,13 +200,13 @@ class MacUtilities(object): tmp_aslr_shift = offset - cls.virtual_to_physical_address(version_json_address) - major_string = context.memory[layer_name].read(version_major_phys_offset + tmp_aslr_shift, 4) + major_string = context.layers[layer_name].read(version_major_phys_offset + tmp_aslr_shift, 4) major = struct.unpack(" configuration.HierarchicalDict: """Builds the appropriate configuration for the specified requirement""" - return context.memory[value].build_configuration() + return context.layers[value].build_configuration() class SymbolTableRequirement(configuration.ConstructableRequirementInterface, diff --git a/volatility/framework/contexts/__init__.py b/volatility/framework/contexts/__init__.py index d065c591d..719837f8c 100644 --- a/volatility/framework/contexts/__init__.py +++ b/volatility/framework/contexts/__init__.py @@ -46,7 +46,7 @@ class Context(interfaces.context.ContextInterface): """Initializes the context.""" super().__init__() self._symbol_space = symbols.SymbolSpace() - self._memory = interfaces.layers.Memory() + self._memory = interfaces.layers.LayerContainer() self._config = interfaces.configuration.HierarchicalDict() # ## Symbol Space Functions @@ -69,8 +69,8 @@ class Context(interfaces.context.ContextInterface): return self._symbol_space @property - def memory(self) -> interfaces.layers.Memory: - """A Memory object, allowing access to all data and translation layers currently available within the context""" + def layers(self) -> interfaces.layers.LayerContainer: + """A LayerContainer object, allowing access to all data and translation layers currently available within the context""" return self._memory # ## Translation Layer Functions @@ -240,7 +240,7 @@ class SizedModule(Module): The mapping should be sorted and should be quicker than reading the data We turn it into JSON to make a common string and use a quick hash, because collissions are unlikely""" - layer = self._context.memory[self.layer_name] + layer = self._context.layers[self.layer_name] if not isinstance(layer, interfaces.layers.TranslationLayerInterface): raise TypeError("Hashing modules on non-TranslationLayers is not allowed") return hashlib.md5(bytes(str(list(layer.mapping(self.offset, self.size, ignore_errors = True))), diff --git a/volatility/framework/interfaces/context.py b/volatility/framework/interfaces/context.py index c82995ac9..e9177f054 100644 --- a/volatility/framework/interfaces/context.py +++ b/volatility/framework/interfaces/context.py @@ -58,9 +58,9 @@ class ContextInterface(object, metaclass = ABCMeta): @property @abstractmethod - def memory(self) -> 'interfaces.layers.Memory': + def layers(self) -> 'interfaces.layers.LayerContainer': """Returns the memory object for the context""" - raise NotImplementedError("Memory has not been implemented.") + raise NotImplementedError("LayerContainer has not been implemented.") def add_layer(self, layer: 'interfaces.layers.DataLayerInterface'): """Adds a named translation layer to the context memory @@ -68,7 +68,7 @@ class ContextInterface(object, metaclass = ABCMeta): Args: layer: Layer object to be added to the context memory """ - self.memory.add_layer(layer) + self.layers.add_layer(layer) # ## Object Factory Functions diff --git a/volatility/framework/interfaces/layers.py b/volatility/framework/interfaces/layers.py index 8916c8130..75baca86b 100644 --- a/volatility/framework/interfaces/layers.py +++ b/volatility/framework/interfaces/layers.py @@ -296,7 +296,7 @@ class DataLayerInterface(interfaces.configuration.ConfigurableInterface, metacla data = b'' for layer_name, address, chunk_size in data_to_scan: try: - data += self.context.memory[layer_name].read(address, chunk_size) + data += self.context.layers[layer_name].read(address, chunk_size) except exceptions.InvalidAddressException: vollog.debug("Invalid address in layer {} found scanning {} at address {:x}".format( layer_name, self.name, address)) @@ -329,7 +329,7 @@ class DataLayerInterface(interfaces.configuration.ConfigurableInterface, metacla @property def metadata(self) -> Mapping: """Returns a ReadOnly copy of the metadata published by this layer""" - maps = [self.context.memory[layer_name].metadata for layer_name in self.dependencies] + maps = [self.context.layers[layer_name].metadata for layer_name in self.dependencies] return interfaces.objects.ReadOnlyMapping(collections.ChainMap({}, self._direct_metadata, *maps)) @@ -384,7 +384,7 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): elif offset < current_offset: raise exceptions.LayerException("Mapping returned an overlapping element") if mapped_length > 0: - output += [self._context.memory.read(layer, mapped_offset, mapped_length, pad)] + output += [self._context.layers.read(layer, mapped_offset, mapped_length, pad)] current_offset += mapped_length recovered_data = b"".join(output) return recovered_data + b"\x00" * (length - len(recovered_data)) @@ -399,7 +399,7 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): self.name, current_offset, "Layer {} cannot map offset: {}".format(self.name, current_offset)) elif offset < current_offset: raise exceptions.LayerException("Mapping returned an overlapping element") - self._context.memory.write(layer, mapped_offset, value) + self._context.layers.write(layer, mapped_offset, value) current_offset += length # ## Scan implementation with knowledge of pages @@ -420,7 +420,7 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): offset += chunk_size -class Memory(collections.abc.Mapping): +class LayerContainer(collections.abc.Mapping): """Container for multiple layers of data""" def __init__(self) -> None: diff --git a/volatility/framework/interfaces/objects.py b/volatility/framework/interfaces/objects.py index 750519370..5aa290ad3 100644 --- a/volatility/framework/interfaces/objects.py +++ b/volatility/framework/interfaces/objects.py @@ -104,7 +104,7 @@ class ObjectInterface(metaclass = ABCMeta): # # Normalize offsets - mask = context.memory[object_info.layer_name].address_mask + mask = context.layers[object_info.layer_name].address_mask normalized_offset = object_info.offset & mask self._vol = collections.ChainMap({}, object_info, {'type_name': type_name, 'offset': normalized_offset}, kwargs) diff --git a/volatility/framework/layers/crash.py b/volatility/framework/layers/crash.py index 59d44a469..dea543452 100644 --- a/volatility/framework/layers/crash.py +++ b/volatility/framework/layers/crash.py @@ -54,7 +54,7 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer): # Create a custom SymbolSpace self._crash_table_name = intermed.IntermediateSymbolTable.create(context, self._config_path, 'windows', 'crash') # Check Header - hdr_layer = self._context.memory[self._base_layer] + hdr_layer = self._context.layers[self._base_layer] hdr_offset = 0 self._check_header(hdr_layer, hdr_offset) @@ -118,9 +118,9 @@ class WindowsCrashDump32Stacker(interfaces.automagic.StackerLayerInterface): layer_name: str, progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]: try: - WindowsCrashDump32Layer._check_header(context.memory[layer_name]) + WindowsCrashDump32Layer._check_header(context.layers[layer_name]) except WindowsCrashDump32FormatException: return None - new_name = context.memory.free_layer_name("WindowsCrashDump32Layer") + new_name = context.layers.free_layer_name("WindowsCrashDump32Layer") context.config[interfaces.configuration.path_join(new_name, "base_layer")] = layer_name return WindowsCrashDump32Layer(context, new_name, new_name) diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py index 844c30747..63efc5df5 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility/framework/layers/intel.py @@ -179,7 +179,7 @@ class Intel(interfaces.layers.TranslationLayerInterface): @functools.lru_cache(1025) def _get_valid_table(self, base_address: int) -> Optional[bytes]: """Extracts the table, validates it and returns it if it's valid""" - table = self._context.memory.read(self._base_layer, base_address, self.page_size) + table = self._context.layers.read(self._base_layer, base_address, self.page_size) # If the table is entirely duplicates, then mark the whole table as bad if (table == table[:self._entry_size] * self._entry_number): @@ -191,7 +191,7 @@ class Intel(interfaces.layers.TranslationLayerInterface): try: # TODO: Consider reimplementing this, since calls to mapping can call is_valid return all([ - self._context.memory[layer].is_valid(mapped_offset) + self._context.layers[layer].is_valid(mapped_offset) for _, mapped_offset, _, layer in self.mapping(offset, length) ]) except exceptions.InvalidAddressException: @@ -205,7 +205,7 @@ class Intel(interfaces.layers.TranslationLayerInterface): if length == 0: try: mapped_offset, _, layer_name = self._translate(offset) - if not self._context.memory[layer_name].is_valid(mapped_offset): + if not self._context.layers[layer_name].is_valid(mapped_offset): raise exceptions.InvalidAddressException(layer_name = layer_name, invalid_address = mapped_offset) except exceptions.InvalidAddressException: if not ignore_errors: @@ -217,7 +217,7 @@ class Intel(interfaces.layers.TranslationLayerInterface): try: chunk_offset, page_size, layer_name = self._translate(offset) chunk_size = min(page_size - (chunk_offset % page_size), length) - if not self._context.memory[layer_name].is_valid(chunk_offset, chunk_size): + if not self._context.layers[layer_name].is_valid(chunk_offset, chunk_size): raise exceptions.InvalidAddressException(layer_name = layer_name, invalid_address = chunk_offset) except (exceptions.PagedInvalidAddressException, exceptions.InvalidAddressException) as excp: if not ignore_errors: diff --git a/volatility/framework/layers/lime.py b/volatility/framework/layers/lime.py index c4ed93f17..53aea4ea8 100644 --- a/volatility/framework/layers/lime.py +++ b/volatility/framework/layers/lime.py @@ -49,7 +49,7 @@ class LimeLayer(segmented.SegmentedLayer): # The base class loads the segments on initialization, but otherwise this must to get the right min/max addresses def _load_segments(self) -> None: - base_layer = self._context.memory[self._base_layer] + base_layer = self._context.layers[self._base_layer] base_maxaddr = base_layer.maximum_address maxaddr = 0 offset = 0 @@ -96,9 +96,9 @@ class LimeStacker(interfaces.automagic.StackerLayerInterface): layer_name: str, progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]: try: - LimeLayer._check_header(context.memory[layer_name]) + LimeLayer._check_header(context.layers[layer_name]) except LimeFormatException: return None - new_name = context.memory.free_layer_name("LimeLayer") + new_name = context.layers.free_layer_name("LimeLayer") context.config[interfaces.configuration.path_join(new_name, "base_layer")] = layer_name return LimeLayer(context, new_name, new_name) diff --git a/volatility/framework/layers/segmented.py b/volatility/framework/layers/segmented.py index 82aa21f5d..afad5dbb4 100644 --- a/volatility/framework/layers/segmented.py +++ b/volatility/framework/layers/segmented.py @@ -56,7 +56,7 @@ class SegmentedLayer(interfaces.layers.TranslationLayerInterface, metaclass = AB def is_valid(self, offset: int, length: int = 1) -> bool: """Returns whether the address offset can be translated to a valid address""" try: - base_layer = self._context.memory[self._base_layer] + base_layer = self._context.layers[self._base_layer] return all( [base_layer.is_valid(mapped_offset) for _i, mapped_offset, _i, _s in self.mapping(offset, length)]) except exceptions.InvalidAddressException: @@ -72,7 +72,7 @@ class SegmentedLayer(interfaces.layers.TranslationLayerInterface, metaclass = AB self._load_segments() # Find rightmost value less than or equal to x - i = bisect_right(self._segments, (offset, self.context.memory[self._base_layer].maximum_address)) + i = bisect_right(self._segments, (offset, self.context.layers[self._base_layer].maximum_address)) if i and not next: segment = self._segments[i - 1] if segment[0] <= offset < segment[0] + segment[2]: diff --git a/volatility/framework/layers/vmware.py b/volatility/framework/layers/vmware.py index dbf9e0d51..64f12114d 100644 --- a/volatility/framework/layers/vmware.py +++ b/volatility/framework/layers/vmware.py @@ -55,7 +55,7 @@ class VmwareLayer(segmented.SegmentedLayer): if "vmware" not in self._context.symbol_space: self._context.symbol_space.append(native.NativeTable("vmware", native.std_ctypes)) - meta_layer = self.context.memory.get(self._meta_layer, None) + meta_layer = self.context.layers.get(self._meta_layer, None) header_size = struct.calcsize(self.header_structure) data = meta_layer.read(0, header_size) magic, unknown, groupCount = struct.unpack(self.header_structure, data) @@ -131,21 +131,21 @@ class VmwareStacker(interfaces.automagic.StackerLayerInterface): layer_name: str, progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]: """Attempt to stack this based on the starting information""" - memlayer = context.memory[layer_name] + memlayer = context.layers[layer_name] if not isinstance(memlayer, physical.FileLayer): return None location = memlayer.location if location.endswith(".vmem"): vmss = location[:-5] + ".vmss" vmsn = location[:-5] + ".vmsn" - current_layer_name = context.memory.free_layer_name("VmwareMetaLayer") + current_layer_name = context.layers.free_layer_name("VmwareMetaLayer") current_config_path = interfaces.configuration.path_join("automagic", "layer_stacker", "stack", current_layer_name) try: _ = resources.ResourceAccessor().open(vmss).read(10) context.config[interfaces.configuration.path_join(current_config_path, "location")] = vmss - context.memory.add_layer(physical.FileLayer(context, current_config_path, current_layer_name)) + context.layers.add_layer(physical.FileLayer(context, current_config_path, current_layer_name)) vmss_success = True except IOError: vmss_success = False @@ -154,14 +154,14 @@ class VmwareStacker(interfaces.automagic.StackerLayerInterface): try: _ = resources.ResourceAccessor().open(vmsn).read(10) context.config[interfaces.configuration.path_join(current_config_path, "location")] = vmsn - context.memory.add_layer(physical.FileLayer(context, current_config_path, current_layer_name)) + context.layers.add_layer(physical.FileLayer(context, current_config_path, current_layer_name)) vmsn_success = True except IOError: vmsn_success = False if not vmss_success and not vmsn_success: return None - new_layer_name = context.memory.free_layer_name("VmwareLayer") + new_layer_name = context.layers.free_layer_name("VmwareLayer") context.config[interfaces.configuration.path_join(current_config_path, "base_layer")] = layer_name context.config[interfaces.configuration.path_join(current_config_path, "meta_layer")] = current_layer_name new_layer = VmwareLayer(context, current_config_path, new_layer_name) diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index b71a4ad02..12e445ca6 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -143,7 +143,7 @@ class PrimitiveObject(interfaces.objects.ObjectInterface): @classmethod def _unmarshall(cls, context: interfaces.context.ContextInterface, data_format: DataFormatInfo, object_info: ObjectInformation) -> TUnion[int, float, bool, bytes, str]: - data = context.memory.read(object_info.layer_name, object_info.offset, data_format.length) + data = context.layers.read(object_info.layer_name, object_info.offset, data_format.length) return convert_data_to_value(data, cls._struct_type, data_format) class VolTemplateProxy(interfaces.objects.ObjectInterface.VolTemplateProxy): @@ -156,7 +156,7 @@ class PrimitiveObject(interfaces.objects.ObjectInterface): def write(self, value: TUnion[int, float, bool, bytes, str]) -> None: """Writes the object into the layer of the context at the current offset""" data = convert_value_to_data(value, self._struct_type, self._data_format) - return self._context.memory.write(self.vol.layer_name, self.vol.offset, data) + return self._context.layers.write(self.vol.layer_name, self.vol.offset, data) class Boolean(PrimitiveObject, int): @@ -285,8 +285,8 @@ class Pointer(Integer): length, endian, signed = data_format if signed: raise TypeError("Pointers cannot have signed values") - mask = context.memory[object_info.native_layer_name].address_mask - data = context.memory.read(object_info.layer_name, object_info.offset, length) + mask = context.layers[object_info.native_layer_name].address_mask + data = context.layers.read(object_info.layer_name, object_info.offset, length) value = int.from_bytes(data, byteorder = endian, signed = signed) return value & mask @@ -297,7 +297,7 @@ class Pointer(Integer): If layer_name is None, it defaults to the same layer that the pointer is currently instantiated in. """ layer_name = layer_name or self.vol.native_layer_name - mask = self._context.memory[layer_name].address_mask + mask = self._context.layers[layer_name].address_mask offset = self & mask return self.vol.subtype( context = self._context, @@ -306,7 +306,7 @@ class Pointer(Integer): def is_readable(self, layer_name: Optional[str] = None) -> bool: """Determines whether the address of this pointer can be read from memory""" layer_name = layer_name or self.vol.layer_name - return self._context.memory[layer_name].is_valid(self) + return self._context.layers[layer_name].is_valid(self) def __getattr__(self, attr: str) -> Any: """Convenience function to access unknown attributes by getting them from the subtype object""" @@ -547,7 +547,7 @@ class Array(interfaces.objects.ObjectInterface, abc.Sequence): def __getitem__(self, i): """Returns the i-th item from the array""" result = [] # type: List[interfaces.objects.Template] - mask = self._context.memory[self.vol.layer_name].address_mask + mask = self._context.layers[self.vol.layer_name].address_mask # We use the range function to deal with slices for us series = range(self.vol.count)[i] return_list = True @@ -652,7 +652,7 @@ class Struct(interfaces.objects.ObjectInterface): if attr in self._concrete_members: return self._concrete_members[attr] elif attr in self.vol.members: - mask = self._context.memory[self.vol.layer_name].address_mask + mask = self._context.layers[self.vol.layer_name].address_mask relative_offset, member = self.vol.members[attr] member = member( context = self._context, diff --git a/volatility/framework/plugins/layerwriter.py b/volatility/framework/plugins/layerwriter.py index a137e8834..bb13acdfc 100644 --- a/volatility/framework/plugins/layerwriter.py +++ b/volatility/framework/plugins/layerwriter.py @@ -56,16 +56,16 @@ class LayerWriter(plugins.PluginInterface): def _generator(self): if self.config.get('layer_name', None) is None: - for layer_name in self.context.memory: + for layer_name in self.context.layers: yield 0, ("Layer '{}' available as '{}'".format(layer_name, - self.context.memory[layer_name].__class__.__name__), ) - elif self.config['layer_name'] not in self.context.memory: + self.context.layers[layer_name].__class__.__name__), ) + elif self.config['layer_name'] not in self.context.layers: yield 0, ('Layer Name does not exist', ) elif os.path.exists(self.config.get('output', self.default_output_name)): yield 0, ('Refusing to overwrite existing output file', ) else: chunk_size = self.config.get('block_size', self.default_block_size) - layer = self.context.memory[self.config['layer_name']] + layer = self.context.layers[self.config['layer_name']] try: filedata = plugins.FileInterface(self.config.get('output', self.default_output_name)) diff --git a/volatility/framework/plugins/linux/bash.py b/volatility/framework/plugins/linux/bash.py index 91da9d561..b09ac51ba 100644 --- a/volatility/framework/plugins/linux/bash.py +++ b/volatility/framework/plugins/linux/bash.py @@ -69,7 +69,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): if not proc_layer_name: continue - proc_layer = self.context.memory[proc_layer_name] + proc_layer = self.context.layers[proc_layer_name] bang_addrs = [] diff --git a/volatility/framework/plugins/linux/check_syscall.py b/volatility/framework/plugins/linux/check_syscall.py index 0979690ce..92ea98872 100644 --- a/volatility/framework/plugins/linux/check_syscall.py +++ b/volatility/framework/plugins/linux/check_syscall.py @@ -118,7 +118,7 @@ class Check_syscall(plugins.PluginInterface): # if we can't find the disassemble function then bail and rely on a different method return 0 - data = self.context.memory.read(self.config['primary'], func_addr, 6) + data = self.context.layers.read(self.config['primary'], func_addr, 6) for (address, size, mnemonic, op_str) in md.disasm_lite(data, func_addr): if mnemonic == 'CMP': diff --git a/volatility/framework/plugins/linux/elfs.py b/volatility/framework/plugins/linux/elfs.py index 95b106396..b366a93c3 100644 --- a/volatility/framework/plugins/linux/elfs.py +++ b/volatility/framework/plugins/linux/elfs.py @@ -48,7 +48,7 @@ class Elfs(plugins.PluginInterface): if not proc_layer_name: continue - proc_layer = self.context.memory[proc_layer_name] + proc_layer = self.context.layers[proc_layer_name] name = utility.array_to_string(task.comm) diff --git a/volatility/framework/plugins/linux/malfind.py b/volatility/framework/plugins/linux/malfind.py index 031795036..549f5131a 100644 --- a/volatility/framework/plugins/linux/malfind.py +++ b/volatility/framework/plugins/linux/malfind.py @@ -50,7 +50,7 @@ class Malfind(interfaces_plugins.PluginInterface): if not proc_layer_name: return - proc_layer = self.context.memory[proc_layer_name] + proc_layer = self.context.layers[proc_layer_name] for vma in task.mm.get_mmap_iter(): if vma.is_suspicious() and vma.get_name(self.context, task) != "[vdso]": diff --git a/volatility/framework/plugins/mac/bash.py b/volatility/framework/plugins/mac/bash.py index ae7a1640f..18594cbae 100644 --- a/volatility/framework/plugins/mac/bash.py +++ b/volatility/framework/plugins/mac/bash.py @@ -69,7 +69,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): if proc_layer_name == None: continue - proc_layer = self.context.memory[proc_layer_name] + proc_layer = self.context.layers[proc_layer_name] bang_addrs = [] diff --git a/volatility/framework/plugins/mac/malfind.py b/volatility/framework/plugins/mac/malfind.py index cafc31c91..370b3b2a7 100644 --- a/volatility/framework/plugins/mac/malfind.py +++ b/volatility/framework/plugins/mac/malfind.py @@ -48,7 +48,7 @@ class Malfind(interfaces_plugins.PluginInterface): if proc_layer_name is None: return - proc_layer = self.context.memory[proc_layer_name] + proc_layer = self.context.layers[proc_layer_name] for vma in task.get_map_iter(): if vma.is_suspicious(self.context, self.config['darwin']): diff --git a/volatility/framework/plugins/mac/psaux.py b/volatility/framework/plugins/mac/psaux.py index 07447ec0a..f4ceed952 100644 --- a/volatility/framework/plugins/mac/psaux.py +++ b/volatility/framework/plugins/mac/psaux.py @@ -44,7 +44,7 @@ class Psaux(plugins.PluginInterface): if proc_layer_name is None: continue - proc_layer = self.context.memory[proc_layer_name] + proc_layer = self.context.layers[proc_layer_name] argsstart = task.user_stack - task.p_argslen diff --git a/volatility/framework/plugins/mac/trustedbsd.py b/volatility/framework/plugins/mac/trustedbsd.py index ed3835b73..83470ea2f 100644 --- a/volatility/framework/plugins/mac/trustedbsd.py +++ b/volatility/framework/plugins/mac/trustedbsd.py @@ -58,7 +58,7 @@ class Check_syscall(plugins.PluginInterface): subtype = kernel.get_type('mac_policy_list_element'), count = policy_list.staticmax + 1) - mask = self.context.memory[self.config['primary']].address_mask + mask = self.context.layers[self.config['primary']].address_mask mods_list = [(mod.name, mod.address & mask, (mod.address & mask) + mod.size) for mod in mods] for i, ent in enumerate(entries): diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index 83544ef01..a8588dc8e 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -79,7 +79,7 @@ class Handles(interfaces_plugins.PluginInterface): try: # before windows 7 - if not self.context.memory[virtual].is_valid(handle_table_entry.Object): + if not self.context.layers[virtual].is_valid(handle_table_entry.Object): return None fast_ref = handle_table_entry.Object.cast(self.config["nt_symbols"] + constants.BANG + "_EX_FAST_REF") object_header = fast_ref.dereference().cast(self.config["nt_symbols"] + constants.BANG + "_OBJECT_HEADER") @@ -116,7 +116,7 @@ class Handles(interfaces_plugins.PluginInterface): return None virtual_layer_name = self.config['primary'] - kvo = self.context.memory[virtual_layer_name].config['kernel_virtual_offset'] + kvo = self.context.layers[virtual_layer_name].config['kernel_virtual_offset'] ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = virtual_layer_name, offset = kvo) try: @@ -124,7 +124,7 @@ class Handles(interfaces_plugins.PluginInterface): except exceptions.SymbolError: return None - data = self.context.memory.read(virtual_layer_name, kvo + func_addr, 0x200) + data = self.context.layers.read(virtual_layer_name, kvo + func_addr, 0x200) if data == None: return None @@ -153,7 +153,7 @@ class Handles(interfaces_plugins.PluginInterface): type_map = {} - kvo = context.memory[layer_name].config['kernel_virtual_offset'] + kvo = context.layers[layer_name].config['kernel_virtual_offset'] ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) try: @@ -192,7 +192,7 @@ class Handles(interfaces_plugins.PluginInterface): except exceptions.SymbolError: return None - kvo = context.memory[layer_name].config['kernel_virtual_offset'] + kvo = context.layers[layer_name].config['kernel_virtual_offset'] return context.object(symbol_table + constants.BANG + "unsigned int", layer_name, offset = kvo + offset) def _make_handle_array(self, offset, level, depth = 0): @@ -200,7 +200,7 @@ class Handles(interfaces_plugins.PluginInterface): entries, going as deep into the table "levels" as necessary.""" virtual = self.config["primary"] - kvo = self.context.memory[virtual].config['kernel_virtual_offset'] + kvo = self.context.layers[virtual].config['kernel_virtual_offset'] ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = virtual, offset = kvo) @@ -211,12 +211,12 @@ class Handles(interfaces_plugins.PluginInterface): subtype = ntkrnlmp.get_type("_HANDLE_TABLE_ENTRY") count = 0x1000 / subtype.size - if not self.context.memory[virtual].is_valid(offset): + if not self.context.layers[virtual].is_valid(offset): return table = ntkrnlmp.object(type_name = "array", offset = offset, subtype = subtype, count = int(count)) - layer_object = self.context.memory[virtual] + layer_object = self.context.layers[virtual] masked_offset = (offset & layer_object.maximum_address) for entry in table: diff --git a/volatility/framework/plugins/windows/info.py b/volatility/framework/plugins/windows/info.py index bc0235440..4411df4f6 100644 --- a/volatility/framework/plugins/windows/info.py +++ b/volatility/framework/plugins/windows/info.py @@ -48,12 +48,12 @@ class Info(plugins.PluginInterface): layer_name: the name of the starting layer index: the index/order of the layer """ - layer = self.context.memory[layer_name] + layer = self.context.layers[layer_name] yield index, layer try: for depends in layer.dependencies: for j, dep in self.get_depends(depends, index + 1): - yield j, self.context.memory[dep.name] + yield j, self.context.layers[dep.name] except AttributeError: # FileLayer won't have dependencies pass @@ -61,7 +61,7 @@ class Info(plugins.PluginInterface): def _generator(self): virtual_layer_name = self.config["primary"] - virtual_layer = self.context.memory[virtual_layer_name] + virtual_layer = self.context.layers[virtual_layer_name] if not isinstance(virtual_layer, layers.intel.Intel): raise TypeError("Virtual Layer is not an intel layer") diff --git a/volatility/framework/plugins/windows/malfind.py b/volatility/framework/plugins/windows/malfind.py index 681897a5e..4e665d4a6 100644 --- a/volatility/framework/plugins/windows/malfind.py +++ b/volatility/framework/plugins/windows/malfind.py @@ -78,7 +78,7 @@ class Malfind(interfaces.plugins.PluginInterface): """ proc_layer_name = proc.add_process_layer() - proc_layer = context.memory[proc_layer_name] + proc_layer = context.layers[proc_layer_name] for vad in proc.get_vad_root().traverse(): protection_string = vad.get_protection( diff --git a/volatility/framework/plugins/windows/moddump.py b/volatility/framework/plugins/windows/moddump.py index f25839f76..82ccdccad 100644 --- a/volatility/framework/plugins/windows/moddump.py +++ b/volatility/framework/plugins/windows/moddump.py @@ -98,7 +98,7 @@ class ModDump(interfaces.plugins.PluginInterface): """ for layer_name in session_layers: - if context.memory[layer_name].is_valid(base_address): + if context.layers[layer_name].is_valid(base_address): return layer_name return None diff --git a/volatility/framework/plugins/windows/modules.py b/volatility/framework/plugins/windows/modules.py index 4a6befe6d..106ba308f 100644 --- a/volatility/framework/plugins/windows/modules.py +++ b/volatility/framework/plugins/windows/modules.py @@ -63,7 +63,7 @@ class Modules(interfaces.plugins.PluginInterface): def list_modules(cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str): """Lists all the modules in the primary layer""" - kvo = context.memory[layer_name].config['kernel_virtual_offset'] + kvo = context.layers[layer_name].config['kernel_virtual_offset'] ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) try: diff --git a/volatility/framework/plugins/windows/poolscanner.py b/volatility/framework/plugins/windows/poolscanner.py index 50f931d6a..bbb587b53 100644 --- a/volatility/framework/plugins/windows/poolscanner.py +++ b/volatility/framework/plugins/windows/poolscanner.py @@ -260,9 +260,9 @@ class PoolScanner(plugins.PluginInterface): # registry hives PoolConstraint( b'CM10', - type_name=symbol_table + constants.BANG + "_CMHIVE", - size=(800, None), - page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), + type_name = symbol_table + constants.BANG + "_CMHIVE", + size = (800, None), + page_type = PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE), ] if not tags_filter: @@ -292,7 +292,7 @@ class PoolScanner(plugins.PluginInterface): # switch to a non-virtual layer if necessary if not is_windows_10: - scan_layer = context.memory[scan_layer].config['memory_layer'] + scan_layer = context.layers[scan_layer].config['memory_layer'] for constraint, header in cls.pool_scan(context, scan_layer, symbol_table, constraints, alignment = 8): @@ -355,7 +355,7 @@ class PoolScanner(plugins.PluginInterface): header_offset = header_type.relative_child_offset('PoolTag') # Run the scan locating the offsets of a particular tag - layer = context.memory[layer_name] + layer = context.layers[layer_name] scanner = scanners.MultiStringScanner([c for c in constraint_lookup.keys()]) for offset, pattern in layer.scan(context, scanner, progress_callback = progress_callback): for constraint in constraint_lookup[pattern]: diff --git a/volatility/framework/plugins/windows/pslist.py b/volatility/framework/plugins/windows/pslist.py index 92a439f18..f7aab6a94 100644 --- a/volatility/framework/plugins/windows/pslist.py +++ b/volatility/framework/plugins/windows/pslist.py @@ -72,7 +72,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists all the processes in the primary layer that are in the pid config option""" # We only use the object factory to demonstrate how to use one - kvo = context.memory[layer_name].config['kernel_virtual_offset'] + kvo = context.layers[layer_name].config['kernel_virtual_offset'] ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address @@ -108,7 +108,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): offset = proc.vol.offset else: layer_name = self.config['primary'] - memory = self.context.memory[layer_name] + memory = self.context.layers[layer_name] if not isinstance(memory, layers.intel.Intel): raise TypeError("Primary layer is not an intel layer") (_, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0] diff --git a/volatility/framework/plugins/windows/pstree.py b/volatility/framework/plugins/windows/pstree.py index d68efc89a..dbe6646f1 100644 --- a/volatility/framework/plugins/windows/pstree.py +++ b/volatility/framework/plugins/windows/pstree.py @@ -56,7 +56,7 @@ class PsTree(pslist.PsList): offset = proc.vol.offset else: layer_name = self.config['primary'] - memory = self.context.memory[layer_name] + memory = self.context.layers[layer_name] (_, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0] self._processes[proc.UniqueProcessId] = proc diff --git a/volatility/framework/plugins/windows/registry/hivelist.py b/volatility/framework/plugins/windows/registry/hivelist.py index 60378b519..37a2e9e0d 100644 --- a/volatility/framework/plugins/windows/registry/hivelist.py +++ b/volatility/framework/plugins/windows/registry/hivelist.py @@ -59,7 +59,7 @@ class HiveList(plugins.PluginInterface): """Lists all the hives in the primary layer""" # We only use the object factory to demonstrate how to use one - kvo = context.memory[layer_name].config['kernel_virtual_offset'] + kvo = context.layers[layer_name].config['kernel_virtual_offset'] ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) list_head = ntkrnlmp.get_symbol("CmpHiveListHead").address diff --git a/volatility/framework/plugins/windows/registry/printkey.py b/volatility/framework/plugins/windows/registry/printkey.py index ae5047856..a991ac0e1 100644 --- a/volatility/framework/plugins/windows/registry/printkey.py +++ b/volatility/framework/plugins/windows/registry/printkey.py @@ -98,7 +98,7 @@ class PrintKey(interfaces.plugins.PluginInterface): hive_offset = hive_offset, base_layer = self.config['primary'], nt_symbols = self.config['nt_symbols']) hive = RegistryHive(self.context, reg_config_path, name = 'hive' + hex(hive_offset)) try: - self.context.memory.add_layer(hive) + self.context.layers.add_layer(hive) # Walk it if 'key' in self.config: diff --git a/volatility/framework/plugins/windows/registry/userassist.py b/volatility/framework/plugins/windows/registry/userassist.py index bd20676f6..e4c287fe5 100644 --- a/volatility/framework/plugins/windows/registry/userassist.py +++ b/volatility/framework/plugins/windows/registry/userassist.py @@ -82,7 +82,7 @@ class UserAssist(interfaces.plugins.PluginInterface): if len(userassist_data) < self._userassist_size: return item - userassist_layer_name = self.context.memory.free_layer_name("userassist_buffer") + userassist_layer_name = self.context.layers.free_layer_name("userassist_buffer") buffer = BufferDataLayer(self.context, self._config_path, userassist_layer_name, userassist_data) self.context.add_layer(buffer) userassist_obj = self.context.object( @@ -247,7 +247,7 @@ class UserAssist(interfaces.plugins.PluginInterface): try: hive = RegistryHive(self.context, reg_config_path, name = 'hive' + hex(hive_offset)) hive_name = hive.hive.cast(self.config["nt_symbols"] + constants.BANG + "_CMHIVE").get_name() - self.context.memory.add_layer(hive) + self.context.layers.add_layer(hive) yield from self.list_userassist(hive) continue except exceptions.PagedInvalidAddressException as excp: diff --git a/volatility/framework/plugins/windows/ssdt.py b/volatility/framework/plugins/windows/ssdt.py index ac43db21d..35f32d7f5 100644 --- a/volatility/framework/plugins/windows/ssdt.py +++ b/volatility/framework/plugins/windows/ssdt.py @@ -77,7 +77,7 @@ class SSDT(plugins.PluginInterface): layer_name = self.config['primary'] collection = self.build_module_collection(self.context, self.config["primary"], self.config["nt_symbols"]) - kvo = self.context.memory[layer_name].config['kernel_virtual_offset'] + kvo = self.context.layers[layer_name].config['kernel_virtual_offset'] ntkrnlmp = self.context.module(self.config["nt_symbols"], layer_name = layer_name, offset = kvo) # this is just one way to enumerate the native (NT) service table. diff --git a/volatility/framework/plugins/windows/strings.py b/volatility/framework/plugins/windows/strings.py index f72e12337..d0b9111af 100644 --- a/volatility/framework/plugins/windows/strings.py +++ b/volatility/framework/plugins/windows/strings.py @@ -78,7 +78,7 @@ class Strings(interfaces.plugins.PluginInterface): def generate_mapping(self, layer_name: str) -> Dict[int, Set[Tuple[str, int]]]: """Creates a reverse mapping between virtual addresses and physical addresses""" - layer = self._context.memory[layer_name] + layer = self._context.layers[layer_name] reverse_map = dict() # type: Dict[int, Set[Tuple[str, int]]] if isinstance(layer, intel.Intel): # We don't care about errors, we just wanted chunks that map correctly @@ -95,7 +95,7 @@ class Strings(interfaces.plugins.PluginInterface): for process in pslist.PsList.list_processes(self.context, self.config['primary'], self.config['nt_symbols']): proc_layer_name = process.add_process_layer() - proc_layer = self.context.memory[proc_layer_name] + proc_layer = self.context.layers[proc_layer_name] if isinstance(proc_layer, interfaces.layers.TranslationLayerInterface): for mapval in proc_layer.mapping(0x0, proc_layer.maximum_address, ignore_errors = True): kpage, vpage, page_size, maplayer = mapval diff --git a/volatility/framework/plugins/windows/vaddump.py b/volatility/framework/plugins/windows/vaddump.py index 396758d7c..814161294 100644 --- a/volatility/framework/plugins/windows/vaddump.py +++ b/volatility/framework/plugins/windows/vaddump.py @@ -62,7 +62,7 @@ class VadDump(interfaces_plugins.PluginInterface): # TODO: what kind of exceptions could this raise and what should we do? proc_layer_name = proc.add_process_layer() - proc_layer = self.context.memory[proc_layer_name] + proc_layer = self.context.layers[proc_layer_name] for vad in vadinfo.VadInfo.list_vads(proc, filter_func = filter_func): try: diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility/framework/plugins/windows/vadinfo.py index 89e12b236..6c7c559c7 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility/framework/plugins/windows/vadinfo.py @@ -75,7 +75,7 @@ class VadInfo(interfaces.plugins.PluginInterface): These don't change often, but if they do in the future, then finding them # dynamically versus hard-coding here will ensure we parse them properly.""" - kvo = context.memory[virtual_layer].config["kernel_virtual_offset"] + kvo = context.layers[virtual_layer].config["kernel_virtual_offset"] ntkrnlmp = context.module(nt_symbols, layer_name = virtual_layer, offset = kvo) addr = ntkrnlmp.get_symbol("MmProtectToValue").address values = ntkrnlmp.object( diff --git a/volatility/framework/plugins/windows/vadyarascan.py b/volatility/framework/plugins/windows/vadyarascan.py index 2ef998ae4..c8db798a3 100644 --- a/volatility/framework/plugins/windows/vadyarascan.py +++ b/volatility/framework/plugins/windows/vadyarascan.py @@ -58,7 +58,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface): def _generator(self): - layer = self.context.memory[self.config['primary']] + layer = self.context.layers[self.config['primary']] rules = None if self.config.get('yara_rules', None) is not None: rule = self.config['yara_rules'] diff --git a/volatility/framework/plugins/yarascan.py b/volatility/framework/plugins/yarascan.py index e7aa739cb..34404c98a 100644 --- a/volatility/framework/plugins/yarascan.py +++ b/volatility/framework/plugins/yarascan.py @@ -80,7 +80,7 @@ class YaraScan(plugins.PluginInterface): def _generator(self): - layer = self.context.memory[self.config['primary']] + layer = self.context.layers[self.config['primary']] rules = None if self.config.get('yara_rules', None) is not None: rule = self.config['yara_rules'] diff --git a/volatility/framework/symbols/generic/__init__.py b/volatility/framework/symbols/generic/__init__.py index 4236d246b..6ddd585e9 100644 --- a/volatility/framework/symbols/generic/__init__.py +++ b/volatility/framework/symbols/generic/__init__.py @@ -42,13 +42,13 @@ class GenericIntelProcess(objects.Struct): # Figure out a suitable name we can use for the new layer if preferred_name is None: - preferred_name = context.memory.free_layer_name(prefix = self.vol.layer_name + "_Process_") + preferred_name = context.layers.free_layer_name(prefix = self.vol.layer_name + "_Process_") else: - if preferred_name in context.memory: - preferred_name = context.memory.free_layer_name(prefix = preferred_name) + if preferred_name in context.layers: + preferred_name = context.layers.free_layer_name(prefix = preferred_name) # Copy the parent's config and then make suitable changes - parent_layer = context.memory[self.vol.layer_name] + parent_layer = context.layers[self.vol.layer_name] parent_config = parent_layer.build_configuration() # It's an intel layer, because we hardwire the "memory_layer" config option # FIXME: this could be for other architectures if we don't hardwire this/these values @@ -61,5 +61,5 @@ class GenericIntelProcess(objects.Struct): new_layer = parent_layer.__class__(context, config_path = config_path, name = preferred_name) # Add the constructed layer and return the name - context.memory.add_layer(new_layer) + context.layers.add_layer(new_layer) return preferred_name diff --git a/volatility/framework/symbols/linux/extensions/__init__.py b/volatility/framework/symbols/linux/extensions/__init__.py index a74d25b9a..4bf029e34 100644 --- a/volatility/framework/symbols/linux/extensions/__init__.py +++ b/volatility/framework/symbols/linux/extensions/__init__.py @@ -61,7 +61,7 @@ class task_struct(generic.GenericIntelProcess): Returns the name of the Layer or None. """ - parent_layer = self._context.memory[self.vol.layer_name] + parent_layer = self._context.layers[self.vol.layer_name] try: pgd = self.mm.pgd except exceptions.PagedInvalidAddressException: diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility/framework/symbols/mac/extensions/__init__.py index d98ac6f50..a6f2ca698 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility/framework/symbols/mac/extensions/__init__.py @@ -36,7 +36,7 @@ class proc(generic.GenericIntelProcess): """Constructs a new layer based on the process's DTB. Returns the name of the Layer or None. """ - parent_layer = self._context.memory[self.vol.layer_name] + parent_layer = self._context.layers[self.vol.layer_name] if not isinstance(parent_layer, interfaces.layers.TranslationLayerInterface): raise TypeError("Parent layer is not a translation layer, unable to construct process layer") diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 7a954633b..242d55d7f 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -472,12 +472,12 @@ class _FILE_OBJECT(objects.Struct, ExecutiveObject): def is_valid(self) -> bool: """Determine if the object is valid""" - return self.FileName.Length > 0 and self._context.memory[self.vol.layer_name].is_valid(self.FileName.Buffer) + return self.FileName.Length > 0 and self._context.layers[self.vol.layer_name].is_valid(self.FileName.Buffer) def file_name_with_device(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: name = renderers.UnreadableValue() # type: Union[str, interfaces.renderers.BaseAbsentValue] - if self._context.memory[self.vol.layer_name].is_valid(self.DeviceObject): + if self._context.layers[self.vol.layer_name].is_valid(self.DeviceObject): name = "\\Device\\{}".format(self.DeviceObject.get_device_name()) try: @@ -550,7 +550,7 @@ class _OBJECT_HEADER(objects.Struct): # http://codemachine.com/article_objectheader.html (Windows 7 and later) name_info_bit = 0x2 - layer = self._context.memory[self.vol.native_layer_name] + layer = self._context.layers[self.vol.native_layer_name] kvo = layer.config.get("kernel_virtual_offset", None) if kvo == None: @@ -638,7 +638,7 @@ class _EPROCESS(generic.GenericIntelProcess, ExecutiveObject): def add_process_layer(self, config_prefix: str = None, preferred_name: str = None): """Constructs a new layer based on the process's DirectoryTableBase""" - parent_layer = self._context.memory[self.vol.layer_name] + parent_layer = self._context.layers[self.vol.layer_name] if not isinstance(parent_layer, intel.Intel): # We can't get bits_per_register unless we're an intel space (since that's not defined at the higher layer) @@ -663,7 +663,7 @@ class _EPROCESS(generic.GenericIntelProcess, ExecutiveObject): proc_layer_name = self.add_process_layer() - proc_layer = self._context.memory[proc_layer_name] + proc_layer = self._context.layers[proc_layer_name] if not proc_layer.is_valid(self.Peb): return @@ -694,7 +694,7 @@ class _EPROCESS(generic.GenericIntelProcess, ExecutiveObject): return renderers.NotApplicableValue() symbol_table_name = self.get_symbol_table().name - kvo = self._context.memory[self.vol.native_layer_name].config['kernel_virtual_offset'] + kvo = self._context.layers[self.vol.native_layer_name].config['kernel_virtual_offset'] ntkrnlmp = self._context.module( symbol_table_name, layer_name = self.vol.native_layer_name, diff --git a/volatility/framework/symbols/windows/extensions/pe.py b/volatility/framework/symbols/windows/extensions/pe.py index 55c03c5ae..58607c6dc 100644 --- a/volatility/framework/symbols/windows/extensions/pe.py +++ b/volatility/framework/symbols/windows/extensions/pe.py @@ -119,7 +119,7 @@ class _IMAGE_DOS_HEADER(objects.Struct): if size_of_image > (1024 * 1024 * 100): raise ValueError("The claimed SizeOfImage is too large: {}".format(size_of_image)) - read_layer = self._context.memory[layer_name] + read_layer = self._context.layers[layer_name] raw_data = read_layer.read(self.vol.offset, nt_header.OptionalHeader.SizeOfImage, pad = True) diff --git a/volatility/framework/symbols/windows/extensions/registry.py b/volatility/framework/symbols/windows/extensions/registry.py index e0677098a..f8247bbbc 100644 --- a/volatility/framework/symbols/windows/extensions/registry.py +++ b/volatility/framework/symbols/windows/extensions/registry.py @@ -140,13 +140,13 @@ class _CM_KEY_NODE(objects.Struct): """Extension to allow traversal of registry keys""" def get_volatile(self) -> bool: - if not isinstance(self._context.memory[self.vol.layer_name], RegistryHive): + if not isinstance(self._context.layers[self.vol.layer_name], RegistryHive): raise ValueError("Cannot determine volatility of registry key without an offset in a RegistryHive layer") return bool(self.vol.offset & 0x80000000) def get_subkeys(self) -> Iterable[interfaces.objects.ObjectInterface]: """Returns a list of the key nodes""" - hive = self._context.memory[self.vol.layer_name] + hive = self._context.layers[self.vol.layer_name] if not isinstance(hive, RegistryHive): raise TypeError("CM_KEY_NODE was not instantiated on a RegistryHive layer") for index in range(2): @@ -184,7 +184,7 @@ class _CM_KEY_NODE(objects.Struct): def get_values(self) -> Iterable[interfaces.objects.ObjectInterface]: """Returns a list of the Value nodes for a key""" - hive = self._context.memory[self.vol.layer_name] + hive = self._context.layers[self.vol.layer_name] if not isinstance(hive, RegistryHive): raise TypeError("CM_KEY_NODE was not instantiated on a RegistryHive layer") child_list = hive.get_cell(self.ValueList.List).u.KeyList @@ -200,7 +200,7 @@ class _CM_KEY_NODE(objects.Struct): return self.Name.cast("string", max_length = self.NameLength, encoding = "latin-1") def get_key_path(self) -> interfaces.objects.ObjectInterface: - reg = self._context.memory[self.vol.layer_name] + reg = self._context.layers[self.vol.layer_name] if not isinstance(reg, RegistryHive): raise TypeError("Key was not instantiated on a RegistryHive layer") # Using the offset adds a significant delay (since it cannot be cached easily) @@ -224,7 +224,7 @@ class _CM_KEY_VALUE(objects.Struct): datalen = self.DataLength & 0x7fffffff data = b"" # Check if the data is stored inline - layer = self._context.memory[self.vol.layer_name] + layer = self._context.layers[self.vol.layer_name] if not isinstance(layer, RegistryHive): raise TypeError("Key value was not instantiated on a RegistryHive layer") diff --git a/volatility/plugins/windows/statistics.py b/volatility/plugins/windows/statistics.py index 80cac6edf..a6e0561ac 100644 --- a/volatility/plugins/windows/statistics.py +++ b/volatility/plugins/windows/statistics.py @@ -37,7 +37,7 @@ class Statistics(plugins.PluginInterface): def _generator(self): # Do mass mapping and determine the number of different layers and how many pages go to each one - layer = self.context.memory[self.config['primary']] + layer = self.context.layers[self.config['primary']] page_count = swap_count = invalid_page_count = large_page_count = large_swap_count = large_invalid_count = 0