WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 20:57:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix more typing issues.

Browse Source
This commit is contained in:
Mike Auty
2018-06-04 23:28:26 +01:00
parent abfcdba524
commit 2dc3d2928d
4 changed files with 17 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/plugins/windows/strings.py
+14 -11
View File
@@ -51,13 +51,15 @@ class Strings(interfaces.plugins.PluginInterface):
"""Parses a single line from a strings file"""
pattern = re.compile(rb"(?:\W*)([0-9]+)(?:\W*)(\w[\w\W]+)")
match = pattern.search(line)
if not match:
raise ValueError("Strings file contains invalid strings line")
offset, string = match.group(1, 2)
return int(offset), string
def generate_mapping(self, layer_name: str) -> typing.Dict[int, typing.List]:
def generate_mapping(self, layer_name: str) -> typing.Dict[int, typing.Set[typing.Tuple[str, int]]]:
"""Creates a reverse mapping between virtual addresses and physical addresses"""
layer = self._context.memory[layer_name]
reverse_map = dict()
reverse_map = dict() # type: typing.Dict[int, typing.Set[typing.Tuple[str, int]]]
if isinstance(layer, intel.Intel):
# We don't care about errors, we just wanted chunks that map correctly
for mapval in layer.mapping(0x0, layer.maximum_address, ignore_errors = True):
@@ -75,14 +77,15 @@ class Strings(interfaces.plugins.PluginInterface):
for process in plugin.list_processes():
proc_layer_name = process.add_process_layer()
proc_layer = self.context.memory[proc_layer_name]
for mapval in proc_layer.mapping(0x0, proc_layer.maximum_address, ignore_errors = True):
kpage, vpage, page_size, maplayer = mapval
for val in range(kpage, kpage + page_size, 0x1000):
cur_set = reverse_map.get(kpage >> 12, set())
cur_set.add(("Process {}".format(process.UniqueProcessId), vpage))
reverse_map[kpage >> 12] = cur_set
# FIXME: make the progress for all processes, rather than per-process
self._progress_callback((vpage * 100) / layer.maximum_address,
"Creating mapping for task {}".format(process.UniqueProcessId))
if isinstance(proc_layer, interfaces.layers.TranslationLayerInterface):
for mapval in proc_layer.mapping(0x0, proc_layer.maximum_address, ignore_errors = True):
kpage, vpage, page_size, maplayer = mapval
for val in range(kpage, kpage + page_size, 0x1000):
cur_set = reverse_map.get(kpage >> 12, set())
cur_set.add(("Process {}".format(process.UniqueProcessId), vpage))
reverse_map[kpage >> 12] = cur_set
# FIXME: make the progress for all processes, rather than per-process
self._progress_callback((vpage * 100) / layer.maximum_address,
"Creating mapping for task {}".format(process.UniqueProcessId))
return reverse_map