From 8f1c5ee55c040e7c748c95ce8fff6b19992c954c Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 11 Aug 2021 21:16:51 +0100 Subject: [PATCH] Core: Bump API to 2.0.0 and remove symbol_shift --- volatility3/cli/__init__.py | 2 +- volatility3/cli/volshell/__init__.py | 2 +- volatility3/cli/volshell/generic.py | 2 +- volatility3/framework/automagic/module.py | 5 --- .../framework/automagic/symbol_finder.py | 21 +-------- volatility3/framework/constants/__init__.py | 7 ++- volatility3/framework/interfaces/layers.py | 2 +- volatility3/framework/interfaces/symbols.py | 8 +--- .../framework/layers/scanners/__init__.py | 6 +-- volatility3/framework/plugins/banners.py | 2 +- volatility3/framework/plugins/configwriter.py | 2 +- .../framework/plugins/frameworkinfo.py | 2 +- volatility3/framework/plugins/isfinfo.py | 2 +- volatility3/framework/plugins/layerwriter.py | 2 +- volatility3/framework/plugins/linux/bash.py | 2 +- .../framework/plugins/linux/check_afinfo.py | 2 +- .../framework/plugins/linux/check_creds.py | 2 +- .../framework/plugins/linux/check_idt.py | 2 +- .../framework/plugins/linux/check_modules.py | 2 +- .../framework/plugins/linux/check_syscall.py | 2 +- volatility3/framework/plugins/linux/elfs.py | 2 +- .../plugins/linux/keyboard_notifiers.py | 2 +- volatility3/framework/plugins/linux/kmsg.py | 2 +- volatility3/framework/plugins/linux/lsmod.py | 2 +- volatility3/framework/plugins/linux/lsof.py | 2 +- .../framework/plugins/linux/malfind.py | 2 +- volatility3/framework/plugins/linux/proc.py | 2 +- volatility3/framework/plugins/linux/pslist.py | 2 +- .../framework/plugins/linux/tty_check.py | 2 +- volatility3/framework/plugins/mac/bash.py | 2 +- .../framework/plugins/mac/check_syscall.py | 2 +- .../framework/plugins/mac/check_sysctl.py | 2 +- .../framework/plugins/mac/check_trap_table.py | 2 +- volatility3/framework/plugins/mac/ifconfig.py | 2 +- .../framework/plugins/mac/kauth_listeners.py | 2 +- .../framework/plugins/mac/kauth_scopes.py | 2 +- volatility3/framework/plugins/mac/kevents.py | 2 +- .../framework/plugins/mac/list_files.py | 2 +- volatility3/framework/plugins/mac/lsmod.py | 2 +- volatility3/framework/plugins/mac/lsof.py | 2 +- volatility3/framework/plugins/mac/malfind.py | 2 +- volatility3/framework/plugins/mac/mount.py | 2 +- volatility3/framework/plugins/mac/netstat.py | 2 +- .../framework/plugins/mac/proc_maps.py | 2 +- volatility3/framework/plugins/mac/psaux.py | 2 +- volatility3/framework/plugins/mac/pslist.py | 2 +- volatility3/framework/plugins/mac/pstree.py | 2 +- .../framework/plugins/mac/socket_filters.py | 2 +- volatility3/framework/plugins/mac/timers.py | 2 +- .../framework/plugins/mac/trustedbsd.py | 2 +- .../framework/plugins/mac/vfsevents.py | 2 +- volatility3/framework/plugins/timeliner.py | 2 +- .../framework/plugins/windows/bigpools.py | 5 +-- .../framework/plugins/windows/cachedump.py | 7 ++- .../framework/plugins/windows/callbacks.py | 4 +- .../framework/plugins/windows/cmdline.py | 7 +-- .../framework/plugins/windows/dlllist.py | 6 +-- .../framework/plugins/windows/driverirp.py | 2 +- .../framework/plugins/windows/driverscan.py | 4 +- .../framework/plugins/windows/dumpfiles.py | 10 ++--- .../framework/plugins/windows/envars.py | 4 +- .../framework/plugins/windows/filescan.py | 4 +- .../plugins/windows/getservicesids.py | 5 ++- .../framework/plugins/windows/getsids.py | 4 +- .../framework/plugins/windows/handles.py | 5 +-- .../framework/plugins/windows/hashdump.py | 13 +++--- volatility3/framework/plugins/windows/info.py | 4 +- .../framework/plugins/windows/lsadump.py | 8 ++-- .../framework/plugins/windows/malfind.py | 8 ++-- .../framework/plugins/windows/memmap.py | 5 ++- .../framework/plugins/windows/modscan.py | 4 +- .../framework/plugins/windows/modules.py | 4 +- .../framework/plugins/windows/mutantscan.py | 4 +- .../framework/plugins/windows/netscan.py | 4 +- .../framework/plugins/windows/netstat.py | 4 +- .../framework/plugins/windows/privileges.py | 4 +- .../framework/plugins/windows/pslist.py | 2 +- .../framework/plugins/windows/psscan.py | 5 +-- .../framework/plugins/windows/pstree.py | 4 +- .../plugins/windows/registry/hivelist.py | 7 ++- .../plugins/windows/registry/hivescan.py | 7 ++- .../plugins/windows/registry/printkey.py | 12 ++--- .../plugins/windows/registry/userassist.py | 5 +-- volatility3/framework/plugins/windows/ssdt.py | 4 +- .../framework/plugins/windows/strings.py | 7 ++- .../framework/plugins/windows/svcscan.py | 4 +- .../framework/plugins/windows/symlinkscan.py | 4 +- .../framework/plugins/windows/vadinfo.py | 6 +-- .../framework/plugins/windows/vadyarascan.py | 5 +-- .../framework/plugins/windows/verinfo.py | 2 +- .../framework/plugins/windows/virtmap.py | 2 +- volatility3/framework/plugins/yarascan.py | 2 +- volatility3/framework/symbols/intermed.py | 44 ++++--------------- .../framework/symbols/linux/__init__.py | 2 +- volatility3/framework/symbols/mac/__init__.py | 2 +- .../framework/symbols/windows/pdbutil.py | 2 +- volatility3/plugins/windows/poolscanner.py | 2 +- .../plugins/windows/registry/certificates.py | 2 +- volatility3/plugins/windows/statistics.py | 2 +- 99 files changed, 164 insertions(+), 240 deletions(-) diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index 6d75db46c..19c6e4ddd 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -88,7 +88,7 @@ class CommandLine: """Executes the command line module, taking the system arguments, determining the plugin to run and then running it.""" - volatility3.framework.require_interface_version(1, 0, 0) + volatility3.framework.require_interface_version(2, 0, 0) renderers = dict([(x.name.lower(), x) for x in framework.class_subclasses(text_renderer.CLIRenderer)]) diff --git a/volatility3/cli/volshell/__init__.py b/volatility3/cli/volshell/__init__.py index bc1219e88..f2375c774 100644 --- a/volatility3/cli/volshell/__init__.py +++ b/volatility3/cli/volshell/__init__.py @@ -43,7 +43,7 @@ class VolShell(cli.CommandLine): determining the plugin to run and then running it.""" sys.stdout.write(f"Volshell (Volatility 3 Framework) {constants.PACKAGE_VERSION}\n") - framework.require_interface_version(1, 0, 0) + framework.require_interface_version(2, 0, 0) parser = argparse.ArgumentParser(prog = self.CLI_NAME, description = "A tool for interactivate forensic analysis of memory images") diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 7252c3b69..8f81a0420 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -26,7 +26,7 @@ except ImportError: class Volshell(interfaces.plugins.PluginInterface): """Shell environment to directly interact with a memory image.""" - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/automagic/module.py b/volatility3/framework/automagic/module.py index 315164ec7..ecd31495a 100644 --- a/volatility3/framework/automagic/module.py +++ b/volatility3/framework/automagic/module.py @@ -38,11 +38,6 @@ class KernelModule(interfaces.automagic.AutomagicInterface): offset_config_path = interfaces.configuration.path_join(new_config_path, 'offset') offset = context.config[layer_kvo_config_path] context.config[offset_config_path] = offset - elif isinstance(requirement.requirements[req], configuration.requirements.SymbolTableRequirement): - symbol_shift_config_path = interfaces.configuration.path_join(new_config_path, - req, - 'symbol_shift') - context.config[symbol_shift_config_path] = 0 # Now construct the module based on the sub-requirements requirement.construct(context, config_path) diff --git a/volatility3/framework/automagic/symbol_finder.py b/volatility3/framework/automagic/symbol_finder.py index 6f6332a8d..72dc071a5 100644 --- a/volatility3/framework/automagic/symbol_finder.py +++ b/volatility3/framework/automagic/symbol_finder.py @@ -5,7 +5,7 @@ import logging from typing import Any, Iterable, List, Tuple, Type, Optional, Callable -from volatility3.framework import interfaces, constants, layers, exceptions +from volatility3.framework import interfaces, constants from volatility3.framework.automagic import symbol_cache from volatility3.framework.configuration import requirements from volatility3.framework.layers import scanners @@ -112,27 +112,8 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface): context.config[path_join(config_path, requirement.name, "isf_url")] = isf_path context.config[path_join(config_path, requirement.name, "symbol_mask")] = layer.address_mask - # Set a default symbol_shift when attempt to determine it, - # so we can create the symbols which are used in finding the aslr_shift anyway - if not context.config.get(path_join(config_path, requirement.name, "symbol_shift"), None): - # Don't overwrite it if it's already been set, it will be manually refound if not present - prefound_kaslr_value = context.layers[layer_name].metadata.get('kaslr_value', 0) - context.config[path_join(config_path, requirement.name, "symbol_shift")] = prefound_kaslr_value # Construct the appropriate symbol table requirement.construct(context, config_path) - - # Apply the ASLR masking (only if we're not already shifted) - if self.find_aslr and not context.config.get(path_join(config_path, requirement.name, "symbol_shift"), - None): - unmasked_symbol_table_name = context.config.get(path_join(config_path, requirement.name), None) - if not unmasked_symbol_table_name: - raise exceptions.SymbolSpaceError("Symbol table could not be constructed") - if not isinstance(layer, layers.intel.Intel): - raise TypeError("Layer name {} is not an intel space") - aslr_shift = self.find_aslr(context, unmasked_symbol_table_name, layer.config['memory_layer']) - context.config[path_join(config_path, requirement.name, "symbol_shift")] = aslr_shift - context.symbol_space.clear_symbol_cache(unmasked_symbol_table_name) - break else: if symbol_files: diff --git a/volatility3/framework/constants/__init__.py b/volatility3/framework/constants/__init__.py index 43193852a..23598837b 100644 --- a/volatility3/framework/constants/__init__.py +++ b/volatility3/framework/constants/__init__.py @@ -38,9 +38,9 @@ BANG = "!" """Constant used to delimit table names from type names when referring to a symbol""" # We use the SemVer 2.0.0 versioning scheme -VERSION_MAJOR = 1 # Number of releases of the library with a breaking change -VERSION_MINOR = 2 # Number of changes that only add to the interface -VERSION_PATCH = 1 # Number of changes that do not change the interface +VERSION_MAJOR = 2 # Number of releases of the library with a breaking change +VERSION_MINOR = 0 # Number of changes that only add to the interface +VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" # TODO: At version 2.0.0, remove the symbol_shift feature @@ -94,7 +94,6 @@ ISF_MINIMUM_SUPPORTED = (2, 0, 0) """The minimum supported version of the Intermediate Symbol Format""" ISF_MINIMUM_DEPRECATED = (3, 9, 9) """The highest version of the ISF that's deprecated (usually higher than supported)""" - OFFLINE = False """Whether to go online to retrieve missing/necessary JSON files""" diff --git a/volatility3/framework/interfaces/layers.py b/volatility3/framework/interfaces/layers.py index 28c452f90..a42282c39 100644 --- a/volatility3/framework/interfaces/layers.py +++ b/volatility3/framework/interfaces/layers.py @@ -54,7 +54,7 @@ class ScannerInterface(interfaces.configuration.VersionableInterface, metaclass """ thread_safe = False - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) def __init__(self) -> None: super().__init__() diff --git a/volatility3/framework/interfaces/symbols.py b/volatility3/framework/interfaces/symbols.py index 37c2824eb..bf0ead3b3 100644 --- a/volatility3/framework/interfaces/symbols.py +++ b/volatility3/framework/interfaces/symbols.py @@ -8,7 +8,6 @@ from abc import abstractmethod, ABC from typing import Any, Dict, Iterable, List, Optional, Tuple, Type, Mapping from volatility3.framework import constants, exceptions, interfaces -from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import configuration, objects from volatility3.framework.interfaces.configuration import RequirementInterface @@ -302,12 +301,7 @@ class SymbolTableInterface(BaseSymbolTableInterface, configuration.ConfigurableI @classmethod def get_requirements(cls) -> List[RequirementInterface]: - return super().get_requirements() + [ - requirements.IntRequirement( - name = 'symbol_shift', description = 'Symbol Shift', optional = True, default = 0), - requirements.IntRequirement( - name = 'symbol_mask', description = 'Address mask for symbols', optional = True, default = 0), - ] + return super().get_requirements() class NativeTableInterface(BaseSymbolTableInterface): diff --git a/volatility3/framework/layers/scanners/__init__.py b/volatility3/framework/layers/scanners/__init__.py index acf7267ff..a99e80b14 100644 --- a/volatility3/framework/layers/scanners/__init__.py +++ b/volatility3/framework/layers/scanners/__init__.py @@ -11,7 +11,7 @@ from volatility3.framework.layers.scanners import multiregexp class BytesScanner(layers.ScannerInterface): thread_safe = True - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) def __init__(self, needle: bytes) -> None: super().__init__() @@ -32,7 +32,7 @@ class BytesScanner(layers.ScannerInterface): class RegExScanner(layers.ScannerInterface): thread_safe = True - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) def __init__(self, pattern: bytes, flags: int = 0) -> None: super().__init__() @@ -51,7 +51,7 @@ class RegExScanner(layers.ScannerInterface): class MultiStringScanner(layers.ScannerInterface): thread_safe = True - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) def __init__(self, patterns: List[bytes]) -> None: super().__init__() diff --git a/volatility3/framework/plugins/banners.py b/volatility3/framework/plugins/banners.py index c907497ed..ac2006207 100644 --- a/volatility3/framework/plugins/banners.py +++ b/volatility3/framework/plugins/banners.py @@ -15,7 +15,7 @@ vollog = logging.getLogger(__name__) class Banners(interfaces.plugins.PluginInterface): """Attempts to identify potential linux banners in an image""" - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/configwriter.py b/volatility3/framework/plugins/configwriter.py index 5e96abcc5..f0979eb4d 100644 --- a/volatility3/framework/plugins/configwriter.py +++ b/volatility3/framework/plugins/configwriter.py @@ -17,7 +17,7 @@ class ConfigWriter(plugins.PluginInterface): """Runs the automagics and both prints and outputs configuration in the output directory.""" - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/frameworkinfo.py b/volatility3/framework/plugins/frameworkinfo.py index 8d9f3b013..b7c887d5c 100644 --- a/volatility3/framework/plugins/frameworkinfo.py +++ b/volatility3/framework/plugins/frameworkinfo.py @@ -8,7 +8,7 @@ from volatility3.framework.interfaces import plugins class FrameworkInfo(plugins.PluginInterface): """Plugin to list the various modular components of Volatility""" - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/isfinfo.py b/volatility3/framework/plugins/isfinfo.py index e697994b7..575f25426 100644 --- a/volatility3/framework/plugins/isfinfo.py +++ b/volatility3/framework/plugins/isfinfo.py @@ -22,7 +22,7 @@ vollog = logging.getLogger(__name__) class IsfInfo(plugins.PluginInterface): """Determines information about the currently available ISF files, or a specific one""" - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/layerwriter.py b/volatility3/framework/plugins/layerwriter.py index cfa83ade2..b2a02116e 100644 --- a/volatility3/framework/plugins/layerwriter.py +++ b/volatility3/framework/plugins/layerwriter.py @@ -17,7 +17,7 @@ class LayerWriter(plugins.PluginInterface): default_block_size = 0x500000 - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) _version = (2, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/linux/bash.py b/volatility3/framework/plugins/linux/bash.py index dd2cb2c0f..7f606115c 100644 --- a/volatility3/framework/plugins/linux/bash.py +++ b/volatility3/framework/plugins/linux/bash.py @@ -21,7 +21,7 @@ from volatility3.plugins.linux import pslist class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): """Recovers bash command history from memory.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/check_afinfo.py b/volatility3/framework/plugins/linux/check_afinfo.py index f54b89ee3..4cd065c7e 100644 --- a/volatility3/framework/plugins/linux/check_afinfo.py +++ b/volatility3/framework/plugins/linux/check_afinfo.py @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class Check_afinfo(plugins.PluginInterface): """Verifies the operation function pointers of network protocols.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/check_creds.py b/volatility3/framework/plugins/linux/check_creds.py index 06ac392db..613469eed 100644 --- a/volatility3/framework/plugins/linux/check_creds.py +++ b/volatility3/framework/plugins/linux/check_creds.py @@ -14,7 +14,7 @@ vollog = logging.getLogger(__name__) class Check_creds(interfaces.plugins.PluginInterface): """Checks if any processes are sharing credential structures""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/linux/check_idt.py b/volatility3/framework/plugins/linux/check_idt.py index e61230041..1764b6364 100644 --- a/volatility3/framework/plugins/linux/check_idt.py +++ b/volatility3/framework/plugins/linux/check_idt.py @@ -17,7 +17,7 @@ vollog = logging.getLogger(__name__) class Check_idt(interfaces.plugins.PluginInterface): """ Checks if the IDT has been altered """ - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index 40b4f6e0c..6af8dec96 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class Check_modules(plugins.PluginInterface): """Compares module list to sysfs info, if available""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/check_syscall.py b/volatility3/framework/plugins/linux/check_syscall.py index e1ba41361..729a0bec6 100644 --- a/volatility3/framework/plugins/linux/check_syscall.py +++ b/volatility3/framework/plugins/linux/check_syscall.py @@ -25,7 +25,7 @@ except ImportError: class Check_syscall(plugins.PluginInterface): """Check system call table for hooks.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/elfs.py b/volatility3/framework/plugins/linux/elfs.py index 5b072ed7d..d2380817d 100644 --- a/volatility3/framework/plugins/linux/elfs.py +++ b/volatility3/framework/plugins/linux/elfs.py @@ -17,7 +17,7 @@ from volatility3.plugins.linux import pslist class Elfs(plugins.PluginInterface): """Lists all memory mapped ELF files for all processes.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/keyboard_notifiers.py b/volatility3/framework/plugins/linux/keyboard_notifiers.py index 8bb79b6ec..51e684e6f 100644 --- a/volatility3/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility3/framework/plugins/linux/keyboard_notifiers.py @@ -16,7 +16,7 @@ vollog = logging.getLogger(__name__) class Keyboard_notifiers(interfaces.plugins.PluginInterface): """Parses the keyboard notifier call chain""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/linux/kmsg.py b/volatility3/framework/plugins/linux/kmsg.py index 3ec53cdcf..0ea00d48d 100644 --- a/volatility3/framework/plugins/linux/kmsg.py +++ b/volatility3/framework/plugins/linux/kmsg.py @@ -363,7 +363,7 @@ class KmsgFiveTen(ABCKmsg): class Kmsg(plugins.PluginInterface): """Kernel log buffer reader""" - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index 7b70db4ba..ecb262d00 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (2, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/linux/lsof.py b/volatility3/framework/plugins/linux/lsof.py index 711a7d4e4..a074f5744 100644 --- a/volatility3/framework/plugins/linux/lsof.py +++ b/volatility3/framework/plugins/linux/lsof.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Lsof(plugins.PluginInterface): """Lists all memory maps for all processes.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py index 4587dca84..abc2cf7d2 100644 --- a/volatility3/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -15,7 +15,7 @@ from volatility3.plugins.linux import pslist class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/proc.py b/volatility3/framework/plugins/linux/proc.py index 2c4cd2aff..13fd87f53 100644 --- a/volatility3/framework/plugins/linux/proc.py +++ b/volatility3/framework/plugins/linux/proc.py @@ -15,7 +15,7 @@ from volatility3.plugins.linux import pslist class Maps(plugins.PluginInterface): """Lists all memory maps for all processes.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index 9b97a56d1..5672bb56e 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -11,7 +11,7 @@ from volatility3.framework.objects import utility class PsList(interfaces.plugins.PluginInterface): """Lists the processes present in a particular linux memory image.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (2, 0, 0) diff --git a/volatility3/framework/plugins/linux/tty_check.py b/volatility3/framework/plugins/linux/tty_check.py index 8c0662ca7..e1d8339e8 100644 --- a/volatility3/framework/plugins/linux/tty_check.py +++ b/volatility3/framework/plugins/linux/tty_check.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class tty_check(plugins.PluginInterface): """Checks tty devices for hooks""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/bash.py b/volatility3/framework/plugins/mac/bash.py index 1929e35f7..e16a0d79f 100644 --- a/volatility3/framework/plugins/mac/bash.py +++ b/volatility3/framework/plugins/mac/bash.py @@ -20,7 +20,7 @@ from volatility3.plugins.mac import pslist class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): """Recovers bash command history from memory.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/check_syscall.py b/volatility3/framework/plugins/mac/check_syscall.py index 1608a64a9..9072e76d1 100644 --- a/volatility3/framework/plugins/mac/check_syscall.py +++ b/volatility3/framework/plugins/mac/check_syscall.py @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class Check_syscall(plugins.PluginInterface): """Check system call table for hooks.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/check_sysctl.py b/volatility3/framework/plugins/mac/check_sysctl.py index f7a8973ff..fc6ab5c37 100644 --- a/volatility3/framework/plugins/mac/check_sysctl.py +++ b/volatility3/framework/plugins/mac/check_sysctl.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class Check_sysctl(plugins.PluginInterface): """Check sysctl handlers for hooks.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/check_trap_table.py b/volatility3/framework/plugins/mac/check_trap_table.py index 0976d6ea0..47d0ed57d 100644 --- a/volatility3/framework/plugins/mac/check_trap_table.py +++ b/volatility3/framework/plugins/mac/check_trap_table.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Check_trap_table(plugins.PluginInterface): """Check mach trap table for hooks.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/ifconfig.py b/volatility3/framework/plugins/mac/ifconfig.py index 8e72528c5..c366a19f0 100644 --- a/volatility3/framework/plugins/mac/ifconfig.py +++ b/volatility3/framework/plugins/mac/ifconfig.py @@ -11,7 +11,7 @@ from volatility3.framework.symbols import mac class Ifconfig(plugins.PluginInterface): """Lists loaded kernel modules""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/kauth_listeners.py b/volatility3/framework/plugins/mac/kauth_listeners.py index 42eaa4582..7002d88e2 100644 --- a/volatility3/framework/plugins/mac/kauth_listeners.py +++ b/volatility3/framework/plugins/mac/kauth_listeners.py @@ -13,7 +13,7 @@ from volatility3.plugins.mac import lsmod, kauth_scopes class Kauth_listeners(interfaces.plugins.PluginInterface): """ Lists kauth listeners and their status """ - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/kauth_scopes.py b/volatility3/framework/plugins/mac/kauth_scopes.py index f66c5cc0e..910de35fd 100644 --- a/volatility3/framework/plugins/mac/kauth_scopes.py +++ b/volatility3/framework/plugins/mac/kauth_scopes.py @@ -18,7 +18,7 @@ class Kauth_scopes(interfaces.plugins.PluginInterface): """ Lists kauth scopes and their status """ _version = (2, 0, 0) - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/kevents.py b/volatility3/framework/plugins/mac/kevents.py index 6fb8e99af..c433a39ee 100644 --- a/volatility3/framework/plugins/mac/kevents.py +++ b/volatility3/framework/plugins/mac/kevents.py @@ -14,7 +14,7 @@ from volatility3.plugins.mac import pslist class Kevents(interfaces.plugins.PluginInterface): """ Lists event handlers registered by processes """ - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) event_types = { diff --git a/volatility3/framework/plugins/mac/list_files.py b/volatility3/framework/plugins/mac/list_files.py index 9efe4b3af..19f28b18f 100644 --- a/volatility3/framework/plugins/mac/list_files.py +++ b/volatility3/framework/plugins/mac/list_files.py @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class List_Files(plugins.PluginInterface): """Lists all open file descriptors for all processes.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/lsmod.py b/volatility3/framework/plugins/mac/lsmod.py index 5cb242b19..095fbc663 100644 --- a/volatility3/framework/plugins/mac/lsmod.py +++ b/volatility3/framework/plugins/mac/lsmod.py @@ -15,7 +15,7 @@ from volatility3.framework.renderers import format_hints class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (2, 0, 0) diff --git a/volatility3/framework/plugins/mac/lsof.py b/volatility3/framework/plugins/mac/lsof.py index 6d96f102a..c3941ec27 100644 --- a/volatility3/framework/plugins/mac/lsof.py +++ b/volatility3/framework/plugins/mac/lsof.py @@ -16,7 +16,7 @@ vollog = logging.getLogger(__name__) class Lsof(plugins.PluginInterface): """Lists all open file descriptors for all processes.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/malfind.py b/volatility3/framework/plugins/mac/malfind.py index cf0a80866..7a42a0c5f 100644 --- a/volatility3/framework/plugins/mac/malfind.py +++ b/volatility3/framework/plugins/mac/malfind.py @@ -13,7 +13,7 @@ from volatility3.plugins.mac import pslist class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/mount.py b/volatility3/framework/plugins/mac/mount.py index bc171127e..398559446 100644 --- a/volatility3/framework/plugins/mac/mount.py +++ b/volatility3/framework/plugins/mac/mount.py @@ -14,7 +14,7 @@ class Mount(plugins.PluginInterface): """A module containing a collection of plugins that produce data typically foundin Mac's mount command""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (2, 0, 0) diff --git a/volatility3/framework/plugins/mac/netstat.py b/volatility3/framework/plugins/mac/netstat.py index 4453a8e30..e231b8082 100644 --- a/volatility3/framework/plugins/mac/netstat.py +++ b/volatility3/framework/plugins/mac/netstat.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Netstat(plugins.PluginInterface): """Lists all network connections for all processes.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/proc_maps.py b/volatility3/framework/plugins/mac/proc_maps.py index e150c6a55..70c9684cd 100644 --- a/volatility3/framework/plugins/mac/proc_maps.py +++ b/volatility3/framework/plugins/mac/proc_maps.py @@ -12,7 +12,7 @@ from volatility3.plugins.mac import pslist class Maps(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/psaux.py b/volatility3/framework/plugins/mac/psaux.py index 5206e5b2b..e3fcdc0bb 100644 --- a/volatility3/framework/plugins/mac/psaux.py +++ b/volatility3/framework/plugins/mac/psaux.py @@ -14,7 +14,7 @@ from volatility3.plugins.mac import pslist class Psaux(plugins.PluginInterface): """Recovers program command line arguments.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/pslist.py b/volatility3/framework/plugins/mac/pslist.py index c094adba8..e92609b3a 100644 --- a/volatility3/framework/plugins/mac/pslist.py +++ b/volatility3/framework/plugins/mac/pslist.py @@ -16,7 +16,7 @@ vollog = logging.getLogger(__name__) class PsList(interfaces.plugins.PluginInterface): """Lists the processes present in a particular mac memory image.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (3, 0, 0) pslist_methods = ['tasks', 'allproc', 'process_group', 'sessions', 'pid_hash_table'] diff --git a/volatility3/framework/plugins/mac/pstree.py b/volatility3/framework/plugins/mac/pstree.py index 76219c457..d7fb0eab4 100644 --- a/volatility3/framework/plugins/mac/pstree.py +++ b/volatility3/framework/plugins/mac/pstree.py @@ -13,7 +13,7 @@ class PsTree(plugins.PluginInterface): """Plugin for listing processes in a tree based on their parent process ID.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/mac/socket_filters.py b/volatility3/framework/plugins/mac/socket_filters.py index ee1b83ed7..a6e9d11fd 100644 --- a/volatility3/framework/plugins/mac/socket_filters.py +++ b/volatility3/framework/plugins/mac/socket_filters.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Socket_filters(plugins.PluginInterface): """Enumerates kernel socket filters.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/timers.py b/volatility3/framework/plugins/mac/timers.py index 42b71134a..7bc5fd5d0 100644 --- a/volatility3/framework/plugins/mac/timers.py +++ b/volatility3/framework/plugins/mac/timers.py @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class Timers(plugins.PluginInterface): """Check for malicious kernel timers.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/trustedbsd.py b/volatility3/framework/plugins/mac/trustedbsd.py index 5d0eba669..9efb1b9d6 100644 --- a/volatility3/framework/plugins/mac/trustedbsd.py +++ b/volatility3/framework/plugins/mac/trustedbsd.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class Trustedbsd(plugins.PluginInterface): """Checks for malicious trustedbsd modules""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/vfsevents.py b/volatility3/framework/plugins/mac/vfsevents.py index 9259956e9..38f4172ce 100644 --- a/volatility3/framework/plugins/mac/vfsevents.py +++ b/volatility3/framework/plugins/mac/vfsevents.py @@ -10,7 +10,7 @@ from volatility3.framework.objects import utility class VFSevents(interfaces.plugins.PluginInterface): """ Lists processes that are filtering file system events """ - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) event_types = [ "CREATE_FILE", "DELETE", "STAT_CHANGED", "RENAME", "CONTENT_MODIFIED", "EXCHANGE", "FINDER_INFO_CHANGED", diff --git a/volatility3/framework/plugins/timeliner.py b/volatility3/framework/plugins/timeliner.py index c3fe424b9..6bf592504 100644 --- a/volatility3/framework/plugins/timeliner.py +++ b/volatility3/framework/plugins/timeliner.py @@ -42,7 +42,7 @@ class Timeliner(interfaces.plugins.PluginInterface): """Runs all relevant plugins that provide time related information and orders the results by time.""" - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/bigpools.py b/volatility3/framework/plugins/windows/bigpools.py index 1b013e81d..c81125f07 100644 --- a/volatility3/framework/plugins/windows/bigpools.py +++ b/volatility3/framework/plugins/windows/bigpools.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class BigPools(interfaces.plugins.PluginInterface): """List big page pools.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod @@ -28,7 +28,7 @@ class BigPools(interfaces.plugins.PluginInterface): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.StringRequirement(name = 'tags', description = "Comma separated list of pool tags to filter pools returned", optional = True, @@ -105,7 +105,6 @@ class BigPools(interfaces.plugins.PluginInterface): tags = [tag for tag in self.config["tags"].split(',')] else: tags = None - kernel = self.context.modules[self.config['kernel']] for big_pool in self.list_big_pools(context = self.context, diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 7a8c9933d..ddfa856b9 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -21,14 +21,14 @@ vollog = logging.getLogger(__name__) class Cachedump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)), requirements.PluginRequirement(name = 'lsadump', plugin = lsadump.Lsadump, version = (1, 0, 0)), requirements.PluginRequirement(name = 'hashdump', plugin = hashdump.Hashdump, version = (1, 1, 0)) @@ -44,7 +44,7 @@ class Cachedump(interfaces.plugins.PluginInterface): hmac_md5 = HMAC.new(nlkm, ch) rc4key = hmac_md5.digest() rc4 = ARC4.new(rc4key) - data = rc4.encrypt(edata) # lgtm [py/weak-cryptographic-algorithm] + data = rc4.encrypt(edata) # lgtm [py/weak-cryptographic-algorithm] else: # based on Based on code from http://lab.mediaservice.net/code/cachedump.rb aes = AES.new(nlkm[16:32], AES.MODE_CBC, ch) @@ -129,7 +129,6 @@ class Cachedump(interfaces.plugins.PluginInterface): offset = self.config.get('offset', None) syshive = sechive = None - kernel = self.context.modules[self.config['kernel']] for hive in hivelist.HiveList.list_hives(self.context, diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py index 46711d152..352dba448 100644 --- a/volatility3/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -19,14 +19,14 @@ vollog = logging.getLogger(__name__) class Callbacks(interfaces.plugins.PluginInterface): """Lists kernel callbacks and notification routines.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'ssdt', plugin = ssdt.SSDT, version = (1, 0, 0)), requirements.PluginRequirement(name = 'svcscan', plugin = svcscan.SvcScan, version = (1, 0, 0)) ] diff --git a/volatility3/framework/plugins/windows/cmdline.py b/volatility3/framework/plugins/windows/cmdline.py index a3f418be0..af6035abb 100644 --- a/volatility3/framework/plugins/windows/cmdline.py +++ b/volatility3/framework/plugins/windows/cmdline.py @@ -15,7 +15,7 @@ vollog = logging.getLogger(__name__) class CmdLine(interfaces.plugins.PluginInterface): """Lists process command line arguments.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod @@ -23,7 +23,7 @@ class CmdLine(interfaces.plugins.PluginInterface): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.ListRequirement(name = 'pid', element_type = int, @@ -54,7 +54,6 @@ class CmdLine(interfaces.plugins.PluginInterface): return result_text def _generator(self, procs): - kernel = self.context.modules[self.config['kernel']] for proc in procs: @@ -78,9 +77,7 @@ class CmdLine(interfaces.plugins.PluginInterface): yield (0, (proc.UniqueProcessId, process_name, result_text)) def run(self): - kernel = self.context.modules[self.config['kernel']] - filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("Process", str), ("Args", str)], diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index 812586276..b24f2c0ca 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the loaded modules in a particular windows memory image.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (2, 0, 0) @classmethod @@ -28,7 +28,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.VersionRequirement(name = 'pslist', component = pslist.PsList, version = (2, 0, 0)), requirements.VersionRequirement(name = 'info', component = info.Info, version = (1, 0, 0)), requirements.ListRequirement(name = 'pid', @@ -136,7 +136,6 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): if file_handle: file_handle.close() file_output = file_handle.preferred_filename - try: dllbase = format_hints.Hex(entry.DllBase) except exceptions.InvalidAddressException: @@ -155,7 +154,6 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): def generate_timeline(self): kernel = self.context.modules[self.config['kernel']] - for row in self._generator( pslist.PsList.list_processes(context = self.context, layer_name = kernel.layer_name, diff --git a/volatility3/framework/plugins/windows/driverirp.py b/volatility3/framework/plugins/windows/driverirp.py index 3ed086c4a..7f9bc6b08 100644 --- a/volatility3/framework/plugins/windows/driverirp.py +++ b/volatility3/framework/plugins/windows/driverirp.py @@ -22,7 +22,7 @@ MAJOR_FUNCTIONS = [ class DriverIrp(interfaces.plugins.PluginInterface): """List IRPs for drivers in a particular windows memory image.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/windows/driverscan.py b/volatility3/framework/plugins/windows/driverscan.py index 498ae3338..2cf309014 100644 --- a/volatility3/framework/plugins/windows/driverscan.py +++ b/volatility3/framework/plugins/windows/driverscan.py @@ -13,14 +13,14 @@ from volatility3.plugins.windows import poolscanner class DriverScan(interfaces.plugins.PluginInterface): """Scans for drivers present in a particular windows memory image.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'poolscanner', plugin = poolscanner.PoolScanner, version = (1, 0, 0)), ] diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py index ca78696f8..58166ee7f 100755 --- a/volatility3/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -5,7 +5,6 @@ import logging import ntpath from typing import List, Tuple, Type, Optional, Generator - from volatility3.framework import interfaces, renderers, exceptions, constants from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints @@ -26,7 +25,7 @@ EXTENSION_CACHE_MAP = { class DumpFiles(interfaces.plugins.PluginInterface): """Dumps cached file contents from Windows memory samples.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod @@ -34,7 +33,7 @@ class DumpFiles(interfaces.plugins.PluginInterface): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.IntRequirement(name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True), @@ -237,9 +236,9 @@ class DumpFiles(interfaces.plugins.PluginInterface): file_obj = self.context.object( kernel.symbol_table_name + constants.BANG + "_FILE_OBJECT", - layer_name = layer_name, + layer_name = layer_name, native_layer_name = kernel.layer_name, - offset = offset) + offset = offset) for result in self.process_file_object(self.context, kernel.layer_name, self.open, file_obj): yield (0, result) except exceptions.InvalidAddressException: @@ -250,7 +249,6 @@ class DumpFiles(interfaces.plugins.PluginInterface): offsets = [] # a list of processes matching the pid filter. all files for these process(es) will be dumped. procs = [] - kernel = self.context.modules[self.config['kernel']] if self.config.get("virtaddr", None) is not None: diff --git a/volatility3/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py index 6caf6d2fa..9791fa580 100644 --- a/volatility3/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -15,15 +15,15 @@ vollog = logging.getLogger(__name__) class Envars(interfaces.plugins.PluginInterface): "Display process environment variables" - _required_framework_version = (1, 2, 0) _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, diff --git a/volatility3/framework/plugins/windows/filescan.py b/volatility3/framework/plugins/windows/filescan.py index 5ceb57ac4..79d85eb8d 100644 --- a/volatility3/framework/plugins/windows/filescan.py +++ b/volatility3/framework/plugins/windows/filescan.py @@ -13,13 +13,13 @@ from volatility3.plugins.windows import poolscanner class FileScan(interfaces.plugins.PluginInterface): """Scans for file objects present in a particular windows memory image.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls): return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'poolscanner', plugin = poolscanner.PoolScanner, version = (1, 0, 0)), ] diff --git a/volatility3/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py index 9395aadb4..a47b1178a 100644 --- a/volatility3/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -30,8 +30,8 @@ def createservicesid(svc) -> str: class GetServiceSIDs(interfaces.plugins.PluginInterface): """Lists process token sids.""" - _required_framework_version = (1, 2, 0) _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -54,11 +54,12 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)) ] def _generator(self): + kernel = self.context.modules[self.config['kernel']] # Get the system hive for hive in hivelist.HiveList.list_hives(context = self.context, diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index 0b082f3ea..da6fa71c9 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -28,8 +28,8 @@ def find_sid_re(sid_string, sid_re_list) -> Union[str, interfaces.renderers.Base class GetSIDs(interfaces.plugins.PluginInterface): """Print the SIDs owning each process""" - _required_framework_version = (1, 2, 0) _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -54,7 +54,7 @@ class GetSIDs(interfaces.plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 2f02ec621..66fd94f08 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -24,7 +24,7 @@ except ImportError: class Handles(interfaces.plugins.PluginInterface): """Lists process open handles.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) def __init__(self, *args, **kwargs): @@ -39,7 +39,7 @@ class Handles(interfaces.plugins.PluginInterface): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.ListRequirement(name = 'pid', element_type = int, description = "Process IDs to include (all other processes are excluded)", @@ -293,7 +293,6 @@ class Handles(interfaces.plugins.PluginInterface): yield handle_table_entry def _generator(self, procs): - kernel = self.context.modules[self.config['kernel']] type_map = self.get_type_map(context = self.context, diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index 05d0281d9..4d0b25b5c 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -21,14 +21,14 @@ vollog = logging.getLogger(__name__) class Hashdump(interfaces.plugins.PluginInterface): """Dumps user hashes from memory""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 1, 0) @classmethod def get_requirements(cls): return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)) ] @@ -132,7 +132,7 @@ class Hashdump(interfaces.plugins.PluginInterface): rc4_key = md5.digest() rc4 = ARC4.new(rc4_key) - hbootkey = rc4.encrypt(sam_data[0x80:0xA0]) # lgtm [py/weak-cryptographic-algorithm] + hbootkey = rc4.encrypt(sam_data[0x80:0xA0]) # lgtm [py/weak-cryptographic-algorithm] return hbootkey elif revision == 3: # AES encrypted @@ -151,7 +151,7 @@ class Hashdump(interfaces.plugins.PluginInterface): des2 = DES.new(des_k2, DES.MODE_ECB) cipher = AES.new(hbootkey[:16], AES.MODE_CBC, salt) obfkey = cipher.decrypt(enc_hash) - return des1.decrypt(obfkey[:8]) + des2.decrypt(obfkey[8:16]) # lgtm [py/weak-cryptographic-algorithm] + return des1.decrypt(obfkey[:8]) + des2.decrypt(obfkey[8:16]) # lgtm [py/weak-cryptographic-algorithm] @classmethod def get_user_hashes(cls, user: registry.CM_KEY_NODE, samhive: registry.RegistryHive, @@ -229,9 +229,9 @@ class Hashdump(interfaces.plugins.PluginInterface): md5.update(hbootkey[:0x10] + pack(" Optional[bytes]: @@ -288,7 +288,6 @@ class Hashdump(interfaces.plugins.PluginInterface): syshive = None samhive = None kernel = self.context.modules[self.config['kernel']] - for hive in hivelist.HiveList.list_hives(self.context, self.config_path, kernel.layer_name, diff --git a/volatility3/framework/plugins/windows/info.py b/volatility3/framework/plugins/windows/info.py index c06c69c3a..172664aef 100644 --- a/volatility3/framework/plugins/windows/info.py +++ b/volatility3/framework/plugins/windows/info.py @@ -16,14 +16,14 @@ from volatility3.framework.symbols.windows import extensions class Info(plugins.PluginInterface): """Show OS & kernel details of the memory sample being analyzed.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), ] @classmethod diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index c0db0b5b1..edf16416c 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -21,14 +21,14 @@ vollog = logging.getLogger(__name__) class Lsadump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.VersionRequirement(name = 'hashdump', component = hashdump.Hashdump, version = (1, 1, 0)), requirements.VersionRequirement(name = 'hivelist', component = hivelist.HiveList, version = (1, 0, 0)) ] @@ -84,7 +84,7 @@ class Lsadump(interfaces.plugins.PluginInterface): rc4key = md5.digest() rc4 = ARC4.new(rc4key) - lsa_key = rc4.decrypt(obf_lsa_key[12:60]) # lgtm [py/weak-cryptographic-algorithm] + lsa_key = rc4.decrypt(obf_lsa_key[12:60]) # lgtm [py/weak-cryptographic-algorithm] lsa_key = lsa_key[0x10:0x20] else: lsa_key = cls.decrypt_aes(obf_lsa_key, bootkey) @@ -125,7 +125,7 @@ class Lsadump(interfaces.plugins.PluginInterface): des_key = hashdump.Hashdump.sidbytes_to_key(block_key) des = DES.new(des_key, DES.MODE_ECB) enc_block = enc_block + b"\x00" * int(abs(8 - len(enc_block)) % 8) - decrypted_data += des.decrypt(enc_block) # lgtm [py/weak-cryptographic-algorithm] + decrypted_data += des.decrypt(enc_block) # lgtm [py/weak-cryptographic-algorithm] j += 7 if len(key[j:j + 7]) < 7: j = len(key[j:j + 7]) diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py index 864722fbe..bfd29a254 100644 --- a/volatility3/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -17,14 +17,14 @@ vollog = logging.getLogger(__name__) class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.ListRequirement(name = 'pid', element_type = int, description = "Process IDs to include (all other processes are excluded)", @@ -103,8 +103,8 @@ class Malfind(interfaces.plugins.PluginInterface): continue if (vad.get_private_memory() == 1 - and vad.get_tag() == "VadS") or (vad.get_private_memory() == 0 - and protection_string != "PAGE_EXECUTE_WRITECOPY"): + and vad.get_tag() == "VadS") or (vad.get_private_memory() == 0 + and protection_string != "PAGE_EXECUTE_WRITECOPY"): if cls.is_vad_empty(proc_layer, vad): continue diff --git a/volatility3/framework/plugins/windows/memmap.py b/volatility3/framework/plugins/windows/memmap.py index 6253ccb9b..74e5885da 100644 --- a/volatility3/framework/plugins/windows/memmap.py +++ b/volatility3/framework/plugins/windows/memmap.py @@ -16,14 +16,14 @@ vollog = logging.getLogger(__name__) class Memmap(interfaces.plugins.PluginInterface): """Prints the memory map""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.IntRequirement(name = 'pid', description = "Process ID to include (all other processes are excluded)", @@ -34,6 +34,7 @@ class Memmap(interfaces.plugins.PluginInterface): optional = True) ] + def _generator(self, procs): for proc in procs: pid = "Unknown" diff --git a/volatility3/framework/plugins/windows/modscan.py b/volatility3/framework/plugins/windows/modscan.py index 5179d2963..b661d71d7 100644 --- a/volatility3/framework/plugins/windows/modscan.py +++ b/volatility3/framework/plugins/windows/modscan.py @@ -17,14 +17,14 @@ vollog = logging.getLogger(__name__) class ModScan(interfaces.plugins.PluginInterface): """Scans for modules present in a particular windows memory image.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.VersionRequirement(name = 'poolerscanner', component = poolscanner.PoolScanner, version = (1, 0, 0)), diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index a3fb87694..7b488a8eb 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -19,14 +19,14 @@ vollog = logging.getLogger(__name__) class Modules(interfaces.plugins.PluginInterface): """Lists the loaded kernel modules.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 1, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.VersionRequirement(name = 'pslist', component = pslist.PsList, version = (2, 0, 0)), requirements.VersionRequirement(name = 'dlllist', component = dlllist.DllList, version = (2, 0, 0)), requirements.BooleanRequirement(name = 'dump', diff --git a/volatility3/framework/plugins/windows/mutantscan.py b/volatility3/framework/plugins/windows/mutantscan.py index 55a131b4a..29e27c9b1 100644 --- a/volatility3/framework/plugins/windows/mutantscan.py +++ b/volatility3/framework/plugins/windows/mutantscan.py @@ -13,13 +13,13 @@ from volatility3.plugins.windows import poolscanner class MutantScan(interfaces.plugins.PluginInterface): """Scans for mutexes present in a particular windows memory image.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls): return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'poolscanner', plugin = poolscanner.PoolScanner, version = (1, 0, 0)), ] diff --git a/volatility3/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py index 9e72713f7..33b5a7fbc 100644 --- a/volatility3/framework/plugins/windows/netscan.py +++ b/volatility3/framework/plugins/windows/netscan.py @@ -22,14 +22,14 @@ vollog = logging.getLogger(__name__) class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for network objects present in a particular windows memory image.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.VersionRequirement(name = 'poolscanner', component = poolscanner.PoolScanner, version = (1, 0, 0)), diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index faae80503..76480399f 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -20,14 +20,14 @@ vollog = logging.getLogger(__name__) class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Traverses network tracking structures present in a particular windows memory image.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.VersionRequirement(name = 'netscan', component = netscan.NetScan, version = (1, 0, 0)), requirements.VersionRequirement(name = 'modules', component = modules.Modules, version = (1, 0, 0)), requirements.VersionRequirement(name = 'pdbutil', component = pdbutil.PDBUtility, version = (1, 0, 0)), diff --git a/volatility3/framework/plugins/windows/privileges.py b/volatility3/framework/plugins/windows/privileges.py index 2b6381145..eaafbeae6 100644 --- a/volatility3/framework/plugins/windows/privileges.py +++ b/volatility3/framework/plugins/windows/privileges.py @@ -17,7 +17,7 @@ class Privs(interfaces.plugins.PluginInterface): """Lists process token privileges""" _version = (1, 2, 0) - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -41,7 +41,7 @@ class Privs(interfaces.plugins.PluginInterface): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index 5121b1b59..cadccc5f1 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the processes present in a particular windows memory image.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (2, 0, 0) PHYSICAL_DEFAULT = False diff --git a/volatility3/framework/plugins/windows/psscan.py b/volatility3/framework/plugins/windows/psscan.py index 8bbebdc7b..184ef5103 100644 --- a/volatility3/framework/plugins/windows/psscan.py +++ b/volatility3/framework/plugins/windows/psscan.py @@ -22,14 +22,14 @@ vollog = logging.getLogger(__name__) class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for processes present in a particular windows memory image.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 1, 0) @classmethod def get_requirements(cls): return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.VersionRequirement(name = 'info', component = info.Info, version = (1, 0, 0)), requirements.ListRequirement(name = 'pid', @@ -143,7 +143,6 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): def _generator(self): kernel = self.context.modules[self.config['kernel']] - pe_table_name = intermed.IntermediateSymbolTable.create(self.context, self.config_path, "windows", diff --git a/volatility3/framework/plugins/windows/pstree.py b/volatility3/framework/plugins/windows/pstree.py index b88e4bba3..fbb883839 100644 --- a/volatility3/framework/plugins/windows/pstree.py +++ b/volatility3/framework/plugins/windows/pstree.py @@ -16,7 +16,7 @@ class PsTree(interfaces.plugins.PluginInterface): """Plugin for listing processes in a tree based on their parent process ID.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) def __init__(self, *args, **kwargs) -> None: super().__init__(*args, **kwargs) @@ -28,7 +28,7 @@ class PsTree(interfaces.plugins.PluginInterface): def get_requirements(cls): return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.BooleanRequirement(name = 'physical', description = 'Display physical offsets instead of virtual', default = pslist.PsList.PHYSICAL_DEFAULT, diff --git a/volatility3/framework/plugins/windows/registry/hivelist.py b/volatility3/framework/plugins/windows/registry/hivelist.py index 029645618..ac30560c6 100644 --- a/volatility3/framework/plugins/windows/registry/hivelist.py +++ b/volatility3/framework/plugins/windows/registry/hivelist.py @@ -17,7 +17,7 @@ class HiveGenerator: """Walks the registry HiveList linked list in a given direction and stores an invalid offset if it's unable to fully walk the list""" - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) def __init__(self, cmhive, forward = True): self._cmhive = cmhive @@ -39,14 +39,14 @@ class HiveGenerator: class HiveList(interfaces.plugins.PluginInterface): """Lists the registry hives present in a particular memory image.""" - _required_framework_version = (1, 2, 0) _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.StringRequirement(name = 'filter', description = "String to filter hive names returned", optional = True, @@ -63,7 +63,6 @@ class HiveList(interfaces.plugins.PluginInterface): def _generator(self) -> Iterator[Tuple[int, Tuple[int, str]]]: chunk_size = 0x500000 - kernel = self.context.modules[self.config['kernel']] for hive_object in self.list_hive_objects(context = self.context, diff --git a/volatility3/framework/plugins/windows/registry/hivescan.py b/volatility3/framework/plugins/windows/registry/hivescan.py index 0a0257d47..ab15e56ac 100644 --- a/volatility3/framework/plugins/windows/registry/hivescan.py +++ b/volatility3/framework/plugins/windows/registry/hivescan.py @@ -15,14 +15,14 @@ class HiveScan(interfaces.plugins.PluginInterface): """Scans for registry hives present in a particular windows memory image.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls): return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'poolscanner', plugin = poolscanner.PoolScanner, version = (1, 0, 0)), requirements.PluginRequirement(name = 'bigpools', plugin = bigpools.BigPools, version = (1, 0, 0)), ] @@ -66,12 +66,11 @@ class HiveScan(interfaces.plugins.PluginInterface): yield mem_object def _generator(self): - kernel = self.context.modules[self.config['kernel']] for hive in self.scan_hives(self.context, kernel.layer_name, kernel.symbol_table_name): - yield (0, (format_hints.Hex(hive.vol.offset),)) + yield (0, (format_hints.Hex(hive.vol.offset), )) def run(self): return renderers.TreeGrid([("Offset", format_hints.Hex)], self._generator()) diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index 10409e3ea..2082c339e 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -19,14 +19,14 @@ vollog = logging.getLogger(__name__) class PrintKey(interfaces.plugins.PluginInterface): """Lists the registry keys under a hive or specific key value.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)), requirements.IntRequirement(name = 'offset', description = "Hive Offset", default = None, optional = True), requirements.StringRequirement(name = 'key', @@ -41,10 +41,10 @@ class PrintKey(interfaces.plugins.PluginInterface): @classmethod def key_iterator( - cls, - hive: RegistryHive, - node_path: Sequence[objects.StructType] = None, - recurse: bool = False + cls, + hive: RegistryHive, + node_path: Sequence[objects.StructType] = None, + recurse: bool = False ) -> Iterable[Tuple[int, bool, datetime.datetime, str, bool, interfaces.objects.ObjectInterface]]: """Walks through a set of nodes from a given node (last one in node_path). Avoids loops by not traversing into nodes already present diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index 2dd0ae023..a788f058f 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -23,7 +23,7 @@ vollog = logging.getLogger(__name__) class UserAssist(interfaces.plugins.PluginInterface): """Print userassist registry keys and information.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -38,7 +38,7 @@ class UserAssist(interfaces.plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.IntRequirement(name = 'offset', description = "Hive Offset", default = None, optional = True), requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0)) ] @@ -217,7 +217,6 @@ class UserAssist(interfaces.plugins.PluginInterface): hive_offsets = None if self.config.get('offset', None) is not None: hive_offsets = [self.config.get('offset', None)] - kernel = self.context.modules[self.config['kernel']] # get all the user hive offsets or use the one specified diff --git a/volatility3/framework/plugins/windows/ssdt.py b/volatility3/framework/plugins/windows/ssdt.py index b5b3e40c0..f596dfe0a 100644 --- a/volatility3/framework/plugins/windows/ssdt.py +++ b/volatility3/framework/plugins/windows/ssdt.py @@ -18,14 +18,14 @@ from volatility3.plugins.windows import modules class SSDT(plugins.PluginInterface): """Lists the system call table.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'modules', plugin = modules.Modules, version = (1, 0, 0)), ] diff --git a/volatility3/framework/plugins/windows/strings.py b/volatility3/framework/plugins/windows/strings.py index 67055e18d..e79f64741 100644 --- a/volatility3/framework/plugins/windows/strings.py +++ b/volatility3/framework/plugins/windows/strings.py @@ -19,7 +19,7 @@ class Strings(interfaces.plugins.PluginInterface): """Reads output from the strings command and indicates which process(es) each string belongs to.""" _version = (1, 2, 0) - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) strings_pattern = re.compile(rb"^(?:\W*)([0-9]+)(?:\W*)(\w[\w\W]+)\n?") @classmethod @@ -42,7 +42,7 @@ class Strings(interfaces.plugins.PluginInterface): def _generator(self) -> Generator[Tuple, None, None]: """Generates results from a strings file.""" - string_list: List[Tuple[int, bytes]] = [] + string_list: List[Tuple[int,bytes]] = [] # Test strings file format is accurate accessor = resources.ResourceAccessor() @@ -57,7 +57,6 @@ class Strings(interfaces.plugins.PluginInterface): except ValueError: vollog.error(f"Line in unrecognized format: line {count}") line = strings_fp.readline() - kernel = self.context.modules[self.config['kernel']] revmap = self.generate_mapping(self.context, @@ -67,7 +66,7 @@ class Strings(interfaces.plugins.PluginInterface): pid_list = self.config['pid']) last_prog: float = 0 - line_count: float = 0 + line_count: float = 0 num_strings = len(string_list) for offset, string in string_list: line_count += 1 diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py index 140a2cccd..b6adbb0b0 100644 --- a/volatility3/framework/plugins/windows/svcscan.py +++ b/volatility3/framework/plugins/windows/svcscan.py @@ -21,7 +21,7 @@ vollog = logging.getLogger(__name__) class SvcScan(interfaces.plugins.PluginInterface): """Scans for windows services.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod @@ -29,7 +29,7 @@ class SvcScan(interfaces.plugins.PluginInterface): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.PluginRequirement(name = 'poolscanner', plugin = poolscanner.PoolScanner, version = (1, 0, 0)), requirements.PluginRequirement(name = 'vadyarascan', plugin = vadyarascan.VadYaraScan, version = (1, 0, 0)) diff --git a/volatility3/framework/plugins/windows/symlinkscan.py b/volatility3/framework/plugins/windows/symlinkscan.py index 3d7cbf89b..ef970b296 100644 --- a/volatility3/framework/plugins/windows/symlinkscan.py +++ b/volatility3/framework/plugins/windows/symlinkscan.py @@ -15,13 +15,13 @@ from volatility3.plugins.windows import poolscanner class SymlinkScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for links present in a particular windows memory image.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls): return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), ] @classmethod diff --git a/volatility3/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py index ee8bc0431..51002d0ed 100644 --- a/volatility3/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -33,7 +33,7 @@ winnt_protections = { class VadInfo(interfaces.plugins.PluginInterface): """Lists process memory ranges.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (2, 0, 0) MAXSIZE_DEFAULT = 0 @@ -45,7 +45,7 @@ class VadInfo(interfaces.plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), # TODO: Convert this to a ListRequirement so that people can filter on sets of ranges requirements.IntRequirement(name = 'address', description = "Process virtual memory address to include " \ @@ -166,7 +166,6 @@ class VadInfo(interfaces.plugins.PluginInterface): return file_handle def _generator(self, procs): - kernel = self.context.modules[self.config['kernel']] def passthrough(_: interfaces.objects.ObjectInterface) -> bool: @@ -201,7 +200,6 @@ class VadInfo(interfaces.plugins.PluginInterface): format_hints.Hex(vad.get_parent()), vad.get_file_name(), file_output)) def run(self): - kernel = self.context.modules[self.config['kernel']] filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index 756e18be5..06a87d003 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -17,14 +17,14 @@ vollog = logging.getLogger(__name__) class VadYaraScan(interfaces.plugins.PluginInterface): """Scans all the Virtual Address Descriptor memory maps using yara.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.BooleanRequirement(name = "wide", description = "Match wide (unicode) strings", default = False, @@ -52,7 +52,6 @@ class VadYaraScan(interfaces.plugins.PluginInterface): ] def _generator(self): - kernel = self.context.modules[self.config['kernel']] rules = yarascan.YaraScan.process_yara_options(dict(self.config)) diff --git a/volatility3/framework/plugins/windows/verinfo.py b/volatility3/framework/plugins/windows/verinfo.py index 82571b477..762832e39 100644 --- a/volatility3/framework/plugins/windows/verinfo.py +++ b/volatility3/framework/plugins/windows/verinfo.py @@ -27,8 +27,8 @@ except ImportError: class VerInfo(interfaces.plugins.PluginInterface): """Lists version information from PE files.""" - _required_framework_version = (1, 2, 0) _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/windows/virtmap.py b/volatility3/framework/plugins/windows/virtmap.py index 9a43cb1f6..9a241d3d8 100644 --- a/volatility3/framework/plugins/windows/virtmap.py +++ b/volatility3/framework/plugins/windows/virtmap.py @@ -16,7 +16,7 @@ vollog = logging.getLogger(__name__) class VirtMap(interfaces.plugins.PluginInterface): """Lists virtual mapped sections.""" - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py index 86a7426a5..94b3cba45 100644 --- a/volatility3/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -39,7 +39,7 @@ class YaraScanner(interfaces.layers.ScannerInterface): class YaraScan(plugins.PluginInterface): """Scans kernel memory using yara rules (string or file).""" - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/symbols/intermed.py b/volatility3/framework/symbols/intermed.py index a3b5a582a..6e55c4b35 100644 --- a/volatility3/framework/symbols/intermed.py +++ b/volatility3/framework/symbols/intermed.py @@ -13,14 +13,15 @@ import zipfile from abc import ABCMeta from typing import Any, Dict, Generator, Iterable, List, Optional, Type, Tuple, Mapping -from volatility3.framework.layers import resources from volatility3 import schemas, symbols from volatility3.framework import class_subclasses, constants, exceptions, interfaces, objects from volatility3.framework.configuration import requirements +from volatility3.framework.layers import resources from volatility3.framework.symbols import native, metadata vollog = logging.getLogger(__name__) + # ## TODO # # All symbol tables should take a label to an object template @@ -47,7 +48,6 @@ vollog = logging.getLogger(__name__) def _construct_delegate_function(name: str, is_property: bool = False) -> Any: - def _delegate_function(self, *args, **kwargs): if is_property: return getattr(self._delegate, name) @@ -82,9 +82,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): native_types: interfaces.symbols.NativeTableInterface = None, table_mapping: Optional[Dict[str, str]] = None, validate: bool = True, - class_types: Optional[Mapping[str, Type[interfaces.objects.ObjectInterface]]] = None, - symbol_shift: int = 0, - symbol_mask: int = 0) -> None: + class_types: Optional[Mapping[str, Type[interfaces.objects.ObjectInterface]]] = None) -> None: """Instantiates a SymbolTable based on an IntermediateSymbolFormat JSON file. This is validated against the appropriate schema. The validation can be disabled by passing validate = False, but this should almost never be done. @@ -98,8 +96,6 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): table_mapping: A dictionary linking names referenced in the file with symbol tables in the context validate: Determines whether the ISF file will be validated against the appropriate schema class_types: A dictionary of type names and classes that override StructType when they are instantiated - symbol_shift: An offset by which to alter all returned symbols for this table - symbol_mask: An address mask used for all returned symbol offsets from this table (a mask of 0 disables masking) """ # Check there are no obvious errors # Open the file and test the version @@ -136,13 +132,6 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): # Since we've been created with parameters, ensure our config is populated likewise self.config['isf_url'] = isf_url - if symbol_shift: - vollog.warning( - "Symbol_shift support has been deprecated and will be removed in the next major release of Volatility 3" - ) - self.config['symbol_shift'] = symbol_shift - self.config['symbol_mask'] = symbol_mask - @staticmethod def _closest_version(version: str, versions: Dict[Tuple[int, int, int], Type['ISFormatTable']]) \ -> Type['ISFormatTable']: @@ -225,9 +214,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): filename: str, native_types: Optional[interfaces.symbols.NativeTableInterface] = None, table_mapping: Optional[Dict[str, str]] = None, - class_types: Optional[Mapping[str, Type[interfaces.objects.ObjectInterface]]] = None, - symbol_shift: int = 0, - symbol_mask: int = 0) -> str: + class_types: Optional[Mapping[str, Type[interfaces.objects.ObjectInterface]]] = None) -> str: """Takes a context and loads an intermediate symbol table based on a filename. @@ -238,8 +225,6 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): filename: Basename of the file to find under the sub_path native_types: Set of native types, defaults to native types read from the intermediate symbol format file table_mapping: a dictionary of table names mentioned within the ISF file, and the tables within the context which they map to - symbol_shift: An offset by which to alter all returned symbols for this table - symbol_mask: An address mask used for all returned symbol offsets from this table (a mask of 0 disables masking) Returns: the name of the added symbol table @@ -254,9 +239,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): isf_url = urls[0], native_types = native_types, table_mapping = table_mapping, - class_types = class_types, - symbol_shift = symbol_shift, - symbol_mask = symbol_mask) + class_types = class_types) context.symbol_space.append(table) return table_name @@ -341,10 +324,7 @@ class Version1Format(ISFormatTable): symbol = self._json_object['symbols'].get(name, None) if not symbol: raise exceptions.SymbolError(name, self.name, f"Unknown symbol: {name}") - address = symbol['address'] + self.config.get('symbol_shift', 0) - if self.config.get('symbol_mask', 0): - address = address & self.config['symbol_mask'] - self._symbol_cache[name] = interfaces.symbols.SymbolInterface(name = name, address = address) + self._symbol_cache[name] = interfaces.symbols.SymbolInterface(name = name, address = symbol['address']) return self._symbol_cache[name] @property @@ -546,12 +526,8 @@ class Version3Format(Version2Format): if 'type' in symbol: symbol_type = self._interdict_to_template(symbol['type']) - # Mask the addresses if necessary - address = symbol['address'] + self.config.get('symbol_shift', 0) - if self.config.get('symbol_mask', 0): - address = address & self.config['symbol_mask'] self._symbol_cache[name] = interfaces.symbols.SymbolInterface(name = name, - address = address, + address = symbol['address'], type = symbol_type) return self._symbol_cache[name] @@ -606,12 +582,8 @@ class Version5Format(Version4Format): if 'constant_data' in symbol: symbol_constant_data = base64.b64decode(symbol.get('constant_data')) - # Mask the addresses if necessary - address = symbol['address'] + self.config.get('symbol_shift', 0) - if self.config.get('symbol_mask', 0): - address = address & self.config['symbol_mask'] self._symbol_cache[name] = interfaces.symbols.SymbolInterface(name = name, - address = address, + address = symbol['address'], type = symbol_type, constant_data = symbol_constant_data) return self._symbol_cache[name] diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 465730411..36e23a35d 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -41,7 +41,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): """Class with multiple useful linux functions.""" _version = (2, 0, 0) - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) framework.require_interface_version(*_required_framework_version) diff --git a/volatility3/framework/symbols/mac/__init__.py b/volatility3/framework/symbols/mac/__init__.py index e84712828..7d094ea4f 100644 --- a/volatility3/framework/symbols/mac/__init__.py +++ b/volatility3/framework/symbols/mac/__init__.py @@ -38,7 +38,7 @@ class MacUtilities(interfaces.configuration.VersionableInterface): 1.3.0 -> add parameter to lookup_module_address to pass kernel module name """ _version = (1, 3, 0) - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def mask_mods_list(cls, context: interfaces.context.ContextInterface, layer_name: str, diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index 9d8b2431b..e73c25d48 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -25,7 +25,7 @@ class PDBUtility(interfaces.configuration.VersionableInterface): """Class to handle and manage all getting symbols based on MZ header""" _version = (1, 0, 0) - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) @classmethod def symbol_table_from_offset( diff --git a/volatility3/plugins/windows/poolscanner.py b/volatility3/plugins/windows/poolscanner.py index 4885c88d7..0c6e989ec 100644 --- a/volatility3/plugins/windows/poolscanner.py +++ b/volatility3/plugins/windows/poolscanner.py @@ -114,8 +114,8 @@ class PoolHeaderScanner(interfaces.layers.ScannerInterface): class PoolScanner(plugins.PluginInterface): """A generic pool scanner plugin.""" - _required_framework_version = (1, 2, 0) _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index 3ba426651..96a7e3977 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -10,7 +10,7 @@ from volatility3.plugins.windows.registry import hivelist, printkey class Certificates(interfaces.plugins.PluginInterface): """Lists the certificates in the registry's Certificate Store.""" - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/plugins/windows/statistics.py b/volatility3/plugins/windows/statistics.py index b3bc8044f..e6f2016ed 100644 --- a/volatility3/plugins/windows/statistics.py +++ b/volatility3/plugins/windows/statistics.py @@ -13,7 +13,7 @@ vollog = logging.getLogger(__name__) class Statistics(plugins.PluginInterface): - _required_framework_version = (1, 0, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: