From 2dc3d2928d5a41c8f166fb2e145a8b4945cc5370 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 4 Jun 2018 23:28:26 +0100 Subject: [PATCH] Fix more typing issues. --- volatility/framework/interfaces/plugins.py | 2 +- volatility/framework/symbols/wrappers.py | 2 +- volatility/plugins/windows/printkey.py | 3 +-- volatility/plugins/windows/strings.py | 25 ++++++++++++---------- 4 files changed, 17 insertions(+), 15 deletions(-) diff --git a/volatility/framework/interfaces/plugins.py b/volatility/framework/interfaces/plugins.py index 191993fe3..c5b3195e2 100644 --- a/volatility/framework/interfaces/plugins.py +++ b/volatility/framework/interfaces/plugins.py @@ -65,7 +65,7 @@ class PluginInterface(interfaces_configuration.ConfigurableInterface, validity.V config_path: str, progress_callback: validity.ProgressCallback = None) -> None: super().__init__(context, config_path) - self._progress_callback = progress_callback + self._progress_callback = progress_callback or (lambda f, s: None) # Plugins self validate on construction, it makes it more difficult to work with them, but then # the validation doesn't need to be repeated over and over again by externals if self.unsatisfied(context, config_path): diff --git a/volatility/framework/symbols/wrappers.py b/volatility/framework/symbols/wrappers.py index bb9ff4c16..4760ce3ec 100644 --- a/volatility/framework/symbols/wrappers.py +++ b/volatility/framework/symbols/wrappers.py @@ -7,7 +7,7 @@ from volatility.framework import interfaces, validity class Flags(validity.ValidityRoutines): """Object that converts an integer into a set of flags based on their masks""" - def __init__(self, choices: typing.Mapping[str, int] = None) -> None: + def __init__(self, choices: typing.Mapping[str, int]) -> None: self._check_type(choices, collections.Mapping) for k, v in choices.items(): self._check_type(k, str) diff --git a/volatility/plugins/windows/printkey.py b/volatility/plugins/windows/printkey.py index 7dfd0b893..b07a4d18f 100644 --- a/volatility/plugins/windows/printkey.py +++ b/volatility/plugins/windows/printkey.py @@ -47,8 +47,7 @@ class PrintKey(plugins.PluginInterface): vollog.warning("Hive walker was not passed a valid node_path (or None)") raise StopIteration node = node_path[-1] - if key_path is None: - key_path = node.get_key_path() + key_path = key_path or node.get_key_path() last_write_time = utility.wintime_to_datetime(node.LastWriteTime) for key_node in node.get_subkeys(): diff --git a/volatility/plugins/windows/strings.py b/volatility/plugins/windows/strings.py index 2a692c73e..f24ce5424 100644 --- a/volatility/plugins/windows/strings.py +++ b/volatility/plugins/windows/strings.py @@ -51,13 +51,15 @@ class Strings(interfaces.plugins.PluginInterface): """Parses a single line from a strings file""" pattern = re.compile(rb"(?:\W*)([0-9]+)(?:\W*)(\w[\w\W]+)") match = pattern.search(line) + if not match: + raise ValueError("Strings file contains invalid strings line") offset, string = match.group(1, 2) return int(offset), string - def generate_mapping(self, layer_name: str) -> typing.Dict[int, typing.List]: + def generate_mapping(self, layer_name: str) -> typing.Dict[int, typing.Set[typing.Tuple[str, int]]]: """Creates a reverse mapping between virtual addresses and physical addresses""" layer = self._context.memory[layer_name] - reverse_map = dict() + reverse_map = dict() # type: typing.Dict[int, typing.Set[typing.Tuple[str, int]]] if isinstance(layer, intel.Intel): # We don't care about errors, we just wanted chunks that map correctly for mapval in layer.mapping(0x0, layer.maximum_address, ignore_errors = True): @@ -75,14 +77,15 @@ class Strings(interfaces.plugins.PluginInterface): for process in plugin.list_processes(): proc_layer_name = process.add_process_layer() proc_layer = self.context.memory[proc_layer_name] - for mapval in proc_layer.mapping(0x0, proc_layer.maximum_address, ignore_errors = True): - kpage, vpage, page_size, maplayer = mapval - for val in range(kpage, kpage + page_size, 0x1000): - cur_set = reverse_map.get(kpage >> 12, set()) - cur_set.add(("Process {}".format(process.UniqueProcessId), vpage)) - reverse_map[kpage >> 12] = cur_set - # FIXME: make the progress for all processes, rather than per-process - self._progress_callback((vpage * 100) / layer.maximum_address, - "Creating mapping for task {}".format(process.UniqueProcessId)) + if isinstance(proc_layer, interfaces.layers.TranslationLayerInterface): + for mapval in proc_layer.mapping(0x0, proc_layer.maximum_address, ignore_errors = True): + kpage, vpage, page_size, maplayer = mapval + for val in range(kpage, kpage + page_size, 0x1000): + cur_set = reverse_map.get(kpage >> 12, set()) + cur_set.add(("Process {}".format(process.UniqueProcessId), vpage)) + reverse_map[kpage >> 12] = cur_set + # FIXME: make the progress for all processes, rather than per-process + self._progress_callback((vpage * 100) / layer.maximum_address, + "Creating mapping for task {}".format(process.UniqueProcessId)) return reverse_map