From 35ad2325a849d6bfe0c50d5c875882c331a90ea3 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 16 Dec 2018 13:40:15 +0000 Subject: [PATCH] Move all core plugins over to framework/plugins. This should have no impact functionality-wise. The statistics plugin was left out a) as an example and b) because it was committed by mistake in the first place and was never meant to be a real plugin. --- volatility/{ => framework}/plugins/configwriter.py | 0 volatility/{ => framework}/plugins/linux/bash.py | 0 volatility/{ => framework}/plugins/linux/check_afinfo.py | 0 .../{ => framework}/plugins/linux/check_syscall.py | 0 volatility/{ => framework}/plugins/linux/elfs.py | 0 volatility/{ => framework}/plugins/linux/lsmod.py | 0 volatility/{ => framework}/plugins/linux/lsof.py | 0 volatility/{ => framework}/plugins/linux/malfind.py | 0 volatility/{ => framework}/plugins/linux/proc.py | 0 volatility/{ => framework}/plugins/linux/pslist.py | 0 volatility/{ => framework}/plugins/linux/pstree.py | 0 volatility/{ => framework}/plugins/mac/psaux.py | 0 volatility/{ => framework}/plugins/mac/pslist.py | 0 volatility/{ => framework}/plugins/timeliner.py | 0 volatility/{ => framework}/plugins/windows/cmdline.py | 0 volatility/{ => framework}/plugins/windows/dlldump.py | 0 volatility/{ => framework}/plugins/windows/dlllist.py | 0 volatility/{ => framework}/plugins/windows/handles.py | 0 volatility/{ => framework}/plugins/windows/info.py | 0 volatility/{ => framework}/plugins/windows/malfind.py | 0 volatility/{ => framework}/plugins/windows/moddump.py | 0 volatility/{ => framework}/plugins/windows/modules.py | 0 .../{ => framework}/plugins/windows/poolscanner.py | 0 volatility/{ => framework}/plugins/windows/procdump.py | 0 volatility/{ => framework}/plugins/windows/pslist.py | 0 volatility/{ => framework}/plugins/windows/pstree.py | 0 .../{ => framework}/plugins/windows/registry/hivelist.py | 0 .../{ => framework}/plugins/windows/registry/printkey.py | 0 .../plugins/windows/registry/userassist.json | 0 .../plugins/windows/registry/userassist.py | 0 volatility/{ => framework}/plugins/windows/ssdt.py | 0 volatility/{ => framework}/plugins/windows/strings.py | 0 volatility/{ => framework}/plugins/windows/vaddump.py | 0 volatility/{ => framework}/plugins/windows/vadinfo.py | 0 .../{ => framework}/plugins/windows/vadyarascan.py | 0 volatility/{ => framework}/plugins/windows/verinfo.py | 0 volatility/{ => framework}/plugins/yarascan.py | 0 volatility/plugins/mac/__init__.py | 9 +++++++++ 38 files changed, 9 insertions(+) rename volatility/{ => framework}/plugins/configwriter.py (100%) rename volatility/{ => framework}/plugins/linux/bash.py (100%) rename volatility/{ => framework}/plugins/linux/check_afinfo.py (100%) rename volatility/{ => framework}/plugins/linux/check_syscall.py (100%) rename volatility/{ => framework}/plugins/linux/elfs.py (100%) rename volatility/{ => framework}/plugins/linux/lsmod.py (100%) rename volatility/{ => framework}/plugins/linux/lsof.py (100%) rename volatility/{ => framework}/plugins/linux/malfind.py (100%) rename volatility/{ => framework}/plugins/linux/proc.py (100%) rename volatility/{ => framework}/plugins/linux/pslist.py (100%) rename volatility/{ => framework}/plugins/linux/pstree.py (100%) rename volatility/{ => framework}/plugins/mac/psaux.py (100%) rename volatility/{ => framework}/plugins/mac/pslist.py (100%) rename volatility/{ => framework}/plugins/timeliner.py (100%) rename volatility/{ => framework}/plugins/windows/cmdline.py (100%) rename volatility/{ => framework}/plugins/windows/dlldump.py (100%) rename volatility/{ => framework}/plugins/windows/dlllist.py (100%) rename volatility/{ => framework}/plugins/windows/handles.py (100%) rename volatility/{ => framework}/plugins/windows/info.py (100%) rename volatility/{ => framework}/plugins/windows/malfind.py (100%) rename volatility/{ => framework}/plugins/windows/moddump.py (100%) rename volatility/{ => framework}/plugins/windows/modules.py (100%) rename volatility/{ => framework}/plugins/windows/poolscanner.py (100%) rename volatility/{ => framework}/plugins/windows/procdump.py (100%) rename volatility/{ => framework}/plugins/windows/pslist.py (100%) rename volatility/{ => framework}/plugins/windows/pstree.py (100%) rename volatility/{ => framework}/plugins/windows/registry/hivelist.py (100%) rename volatility/{ => framework}/plugins/windows/registry/printkey.py (100%) rename volatility/{ => framework}/plugins/windows/registry/userassist.json (100%) rename volatility/{ => framework}/plugins/windows/registry/userassist.py (100%) rename volatility/{ => framework}/plugins/windows/ssdt.py (100%) rename volatility/{ => framework}/plugins/windows/strings.py (100%) rename volatility/{ => framework}/plugins/windows/vaddump.py (100%) rename volatility/{ => framework}/plugins/windows/vadinfo.py (100%) rename volatility/{ => framework}/plugins/windows/vadyarascan.py (100%) rename volatility/{ => framework}/plugins/windows/verinfo.py (100%) rename volatility/{ => framework}/plugins/yarascan.py (100%) create mode 100644 volatility/plugins/mac/__init__.py diff --git a/volatility/plugins/configwriter.py b/volatility/framework/plugins/configwriter.py similarity index 100% rename from volatility/plugins/configwriter.py rename to volatility/framework/plugins/configwriter.py diff --git a/volatility/plugins/linux/bash.py b/volatility/framework/plugins/linux/bash.py similarity index 100% rename from volatility/plugins/linux/bash.py rename to volatility/framework/plugins/linux/bash.py diff --git a/volatility/plugins/linux/check_afinfo.py b/volatility/framework/plugins/linux/check_afinfo.py similarity index 100% rename from volatility/plugins/linux/check_afinfo.py rename to volatility/framework/plugins/linux/check_afinfo.py diff --git a/volatility/plugins/linux/check_syscall.py b/volatility/framework/plugins/linux/check_syscall.py similarity index 100% rename from volatility/plugins/linux/check_syscall.py rename to volatility/framework/plugins/linux/check_syscall.py diff --git a/volatility/plugins/linux/elfs.py b/volatility/framework/plugins/linux/elfs.py similarity index 100% rename from volatility/plugins/linux/elfs.py rename to volatility/framework/plugins/linux/elfs.py diff --git a/volatility/plugins/linux/lsmod.py b/volatility/framework/plugins/linux/lsmod.py similarity index 100% rename from volatility/plugins/linux/lsmod.py rename to volatility/framework/plugins/linux/lsmod.py diff --git a/volatility/plugins/linux/lsof.py b/volatility/framework/plugins/linux/lsof.py similarity index 100% rename from volatility/plugins/linux/lsof.py rename to volatility/framework/plugins/linux/lsof.py diff --git a/volatility/plugins/linux/malfind.py b/volatility/framework/plugins/linux/malfind.py similarity index 100% rename from volatility/plugins/linux/malfind.py rename to volatility/framework/plugins/linux/malfind.py diff --git a/volatility/plugins/linux/proc.py b/volatility/framework/plugins/linux/proc.py similarity index 100% rename from volatility/plugins/linux/proc.py rename to volatility/framework/plugins/linux/proc.py diff --git a/volatility/plugins/linux/pslist.py b/volatility/framework/plugins/linux/pslist.py similarity index 100% rename from volatility/plugins/linux/pslist.py rename to volatility/framework/plugins/linux/pslist.py diff --git a/volatility/plugins/linux/pstree.py b/volatility/framework/plugins/linux/pstree.py similarity index 100% rename from volatility/plugins/linux/pstree.py rename to volatility/framework/plugins/linux/pstree.py diff --git a/volatility/plugins/mac/psaux.py b/volatility/framework/plugins/mac/psaux.py similarity index 100% rename from volatility/plugins/mac/psaux.py rename to volatility/framework/plugins/mac/psaux.py diff --git a/volatility/plugins/mac/pslist.py b/volatility/framework/plugins/mac/pslist.py similarity index 100% rename from volatility/plugins/mac/pslist.py rename to volatility/framework/plugins/mac/pslist.py diff --git a/volatility/plugins/timeliner.py b/volatility/framework/plugins/timeliner.py similarity index 100% rename from volatility/plugins/timeliner.py rename to volatility/framework/plugins/timeliner.py diff --git a/volatility/plugins/windows/cmdline.py b/volatility/framework/plugins/windows/cmdline.py similarity index 100% rename from volatility/plugins/windows/cmdline.py rename to volatility/framework/plugins/windows/cmdline.py diff --git a/volatility/plugins/windows/dlldump.py b/volatility/framework/plugins/windows/dlldump.py similarity index 100% rename from volatility/plugins/windows/dlldump.py rename to volatility/framework/plugins/windows/dlldump.py diff --git a/volatility/plugins/windows/dlllist.py b/volatility/framework/plugins/windows/dlllist.py similarity index 100% rename from volatility/plugins/windows/dlllist.py rename to volatility/framework/plugins/windows/dlllist.py diff --git a/volatility/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py similarity index 100% rename from volatility/plugins/windows/handles.py rename to volatility/framework/plugins/windows/handles.py diff --git a/volatility/plugins/windows/info.py b/volatility/framework/plugins/windows/info.py similarity index 100% rename from volatility/plugins/windows/info.py rename to volatility/framework/plugins/windows/info.py diff --git a/volatility/plugins/windows/malfind.py b/volatility/framework/plugins/windows/malfind.py similarity index 100% rename from volatility/plugins/windows/malfind.py rename to volatility/framework/plugins/windows/malfind.py diff --git a/volatility/plugins/windows/moddump.py b/volatility/framework/plugins/windows/moddump.py similarity index 100% rename from volatility/plugins/windows/moddump.py rename to volatility/framework/plugins/windows/moddump.py diff --git a/volatility/plugins/windows/modules.py b/volatility/framework/plugins/windows/modules.py similarity index 100% rename from volatility/plugins/windows/modules.py rename to volatility/framework/plugins/windows/modules.py diff --git a/volatility/plugins/windows/poolscanner.py b/volatility/framework/plugins/windows/poolscanner.py similarity index 100% rename from volatility/plugins/windows/poolscanner.py rename to volatility/framework/plugins/windows/poolscanner.py diff --git a/volatility/plugins/windows/procdump.py b/volatility/framework/plugins/windows/procdump.py similarity index 100% rename from volatility/plugins/windows/procdump.py rename to volatility/framework/plugins/windows/procdump.py diff --git a/volatility/plugins/windows/pslist.py b/volatility/framework/plugins/windows/pslist.py similarity index 100% rename from volatility/plugins/windows/pslist.py rename to volatility/framework/plugins/windows/pslist.py diff --git a/volatility/plugins/windows/pstree.py b/volatility/framework/plugins/windows/pstree.py similarity index 100% rename from volatility/plugins/windows/pstree.py rename to volatility/framework/plugins/windows/pstree.py diff --git a/volatility/plugins/windows/registry/hivelist.py b/volatility/framework/plugins/windows/registry/hivelist.py similarity index 100% rename from volatility/plugins/windows/registry/hivelist.py rename to volatility/framework/plugins/windows/registry/hivelist.py diff --git a/volatility/plugins/windows/registry/printkey.py b/volatility/framework/plugins/windows/registry/printkey.py similarity index 100% rename from volatility/plugins/windows/registry/printkey.py rename to volatility/framework/plugins/windows/registry/printkey.py diff --git a/volatility/plugins/windows/registry/userassist.json b/volatility/framework/plugins/windows/registry/userassist.json similarity index 100% rename from volatility/plugins/windows/registry/userassist.json rename to volatility/framework/plugins/windows/registry/userassist.json diff --git a/volatility/plugins/windows/registry/userassist.py b/volatility/framework/plugins/windows/registry/userassist.py similarity index 100% rename from volatility/plugins/windows/registry/userassist.py rename to volatility/framework/plugins/windows/registry/userassist.py diff --git a/volatility/plugins/windows/ssdt.py b/volatility/framework/plugins/windows/ssdt.py similarity index 100% rename from volatility/plugins/windows/ssdt.py rename to volatility/framework/plugins/windows/ssdt.py diff --git a/volatility/plugins/windows/strings.py b/volatility/framework/plugins/windows/strings.py similarity index 100% rename from volatility/plugins/windows/strings.py rename to volatility/framework/plugins/windows/strings.py diff --git a/volatility/plugins/windows/vaddump.py b/volatility/framework/plugins/windows/vaddump.py similarity index 100% rename from volatility/plugins/windows/vaddump.py rename to volatility/framework/plugins/windows/vaddump.py diff --git a/volatility/plugins/windows/vadinfo.py b/volatility/framework/plugins/windows/vadinfo.py similarity index 100% rename from volatility/plugins/windows/vadinfo.py rename to volatility/framework/plugins/windows/vadinfo.py diff --git a/volatility/plugins/windows/vadyarascan.py b/volatility/framework/plugins/windows/vadyarascan.py similarity index 100% rename from volatility/plugins/windows/vadyarascan.py rename to volatility/framework/plugins/windows/vadyarascan.py diff --git a/volatility/plugins/windows/verinfo.py b/volatility/framework/plugins/windows/verinfo.py similarity index 100% rename from volatility/plugins/windows/verinfo.py rename to volatility/framework/plugins/windows/verinfo.py diff --git a/volatility/plugins/yarascan.py b/volatility/framework/plugins/yarascan.py similarity index 100% rename from volatility/plugins/yarascan.py rename to volatility/framework/plugins/yarascan.py diff --git a/volatility/plugins/mac/__init__.py b/volatility/plugins/mac/__init__.py new file mode 100644 index 000000000..1fa00fd77 --- /dev/null +++ b/volatility/plugins/mac/__init__.py @@ -0,0 +1,9 @@ +"""All Mac-related plugins""" + +import os + +from volatility.framework import constants + +# This is necessary to ensure the core plugins are available, whilst still be overridable +plugin_path_components = __name__.split('.')[2:] +__path__ = [os.path.join(x, *plugin_path_components) for x in constants.PLUGINS_PATH]