From 3911098d2711ef299f6f53d994fa93fc428fafcc Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 20 Jan 2021 21:21:16 +0000 Subject: [PATCH] Core: Rename the top level namespace --- .gitignore | 8 ++-- development/schema_validate.py | 2 +- doc/source/conf.py | 24 +++++----- setup.py | 8 ++-- vol.py | 4 +- vol.spec | 38 +++++++-------- {volatility => volatility3}/__init__.py | 18 ++++---- {volatility => volatility3}/cli/__init__.py | 46 +++++++++---------- .../cli/text_renderer.py | 4 +- .../cli/volargparse.py | 0 .../cli/volshell/__init__.py | 24 +++++----- .../cli/volshell/generic.py | 8 ++-- .../cli/volshell/linux.py | 8 ++-- .../cli/volshell/mac.py | 8 ++-- .../cli/volshell/windows.py | 8 ++-- .../framework/__init__.py | 6 +-- .../framework/automagic/__init__.py | 12 ++--- .../framework/automagic/construct_layers.py | 14 +++--- .../framework/automagic/linux.py | 10 ++-- .../framework/automagic/mac.py | 10 ++-- .../framework/automagic/pdbscan.py | 18 ++++---- .../framework/automagic/stacker.py | 20 ++++---- .../framework/automagic/symbol_cache.py | 4 +- .../framework/automagic/symbol_finder.py | 8 ++-- .../framework/automagic/windows.py | 10 ++-- .../framework/configuration/__init__.py | 2 +- .../framework/configuration/requirements.py | 2 +- .../framework/constants/__init__.py | 10 ++-- .../framework/constants/linux/__init__.py | 0 .../framework/constants/windows/__init__.py | 0 .../framework/contexts/__init__.py | 8 ++-- .../framework/exceptions.py | 2 +- .../framework/interfaces/__init__.py | 2 +- .../framework/interfaces/automagic.py | 4 +- .../framework/interfaces/configuration.py | 12 ++--- .../framework/interfaces/context.py | 4 +- .../framework/interfaces/layers.py | 2 +- .../framework/interfaces/objects.py | 4 +- .../framework/interfaces/plugins.py | 4 +- .../framework/interfaces/renderers.py | 0 .../framework/interfaces/symbols.py | 8 ++-- .../framework/layers/__init__.py | 0 .../framework/layers/codecs/__init__.py | 0 .../framework/layers/crash.py | 6 +-- .../framework/layers/elf.py | 6 +-- .../framework/layers/intel.py | 8 ++-- .../framework/layers/lime.py | 4 +- .../framework/layers/linear.py | 2 +- .../framework/layers/msf.py | 10 ++-- .../framework/layers/physical.py | 6 +-- .../framework/layers/qemu.py | 6 +-- .../framework/layers/registry.py | 14 +++--- .../framework/layers/resources.py | 4 +- .../framework/layers/scanners/__init__.py | 4 +- .../framework/layers/scanners/multiregexp.py | 0 .../framework/layers/segmented.py | 6 +-- .../framework/layers/vmware.py | 8 ++-- .../framework/objects/__init__.py | 4 +- .../framework/objects/templates.py | 10 ++-- .../framework/objects/utility.py | 2 +- .../framework/plugins/__init__.py | 6 +-- .../framework/plugins/banners.py | 8 ++-- .../framework/plugins/configwriter.py | 6 +-- .../framework/plugins/frameworkinfo.py | 6 +-- .../framework/plugins/isfinfo.py | 12 ++--- .../framework/plugins/layerwriter.py | 6 +-- .../framework/plugins/linux/__init__.py | 4 +- .../framework/plugins/linux/bash.py | 16 +++---- .../framework/plugins/linux/check_afinfo.py | 10 ++-- .../framework/plugins/linux/check_creds.py | 6 +-- .../framework/plugins/linux/check_idt.py | 10 ++-- .../framework/plugins/linux/check_modules.py | 12 ++--- .../framework/plugins/linux/check_syscall.py | 10 ++-- .../framework/plugins/linux/elfs.py | 12 ++--- .../plugins/linux/keyboard_notifiers.py | 10 ++-- .../framework/plugins/linux/lsmod.py | 12 ++--- .../framework/plugins/linux/lsof.py | 12 ++--- .../framework/plugins/linux/malfind.py | 12 ++--- .../framework/plugins/linux/proc.py | 12 ++--- .../framework/plugins/linux/pslist.py | 6 +-- .../framework/plugins/linux/pstree.py | 4 +- .../framework/plugins/linux/tty_check.py | 14 +++--- .../framework/plugins/mac/__init__.py | 0 .../framework/plugins/mac/bash.py | 16 +++---- .../framework/plugins/mac/check_syscall.py | 14 +++--- .../framework/plugins/mac/check_sysctl.py | 20 ++++---- .../framework/plugins/mac/check_trap_table.py | 14 +++--- .../framework/plugins/mac/ifconfig.py | 10 ++-- .../framework/plugins/mac/kauth_listeners.py | 12 ++--- .../framework/plugins/mac/kauth_scopes.py | 12 ++--- .../framework/plugins/mac/kevents.py | 10 ++-- .../framework/plugins/mac/list_files.py | 14 +++--- .../framework/plugins/mac/lsmod.py | 10 ++-- .../framework/plugins/mac/lsof.py | 10 ++-- .../framework/plugins/mac/malfind.py | 14 +++--- .../framework/plugins/mac/mount.py | 10 ++-- .../framework/plugins/mac/netstat.py | 14 +++--- .../framework/plugins/mac/proc_maps.py | 10 ++-- .../framework/plugins/mac/psaux.py | 10 ++-- .../framework/plugins/mac/pslist.py | 8 ++-- .../framework/plugins/mac/pstree.py | 10 ++-- .../framework/plugins/mac/socket_filters.py | 16 +++---- .../framework/plugins/mac/timers.py | 14 +++--- .../framework/plugins/mac/trustedbsd.py | 16 +++---- .../framework/plugins/mac/vfsevents.py | 6 +-- .../framework/plugins/timeliner.py | 6 +-- .../framework/plugins/windows/__init__.py | 4 +- .../framework/plugins/windows/bigpools.py | 14 +++--- .../framework/plugins/windows/cachedump.py | 10 ++-- .../framework/plugins/windows/callbacks.py | 14 +++--- .../framework/plugins/windows/cmdline.py | 8 ++-- .../framework/plugins/windows/dlllist.py | 14 +++--- .../framework/plugins/windows/driverirp.py | 10 ++-- .../framework/plugins/windows/driverscan.py | 8 ++-- .../framework/plugins/windows/dumpfiles.py | 12 ++--- .../framework/plugins/windows/envars.py | 10 ++-- .../framework/plugins/windows/filescan.py | 8 ++-- .../plugins/windows/getservicesids.py | 6 +-- .../framework/plugins/windows/getsids.py | 12 ++--- .../framework/plugins/windows/handles.py | 10 ++-- .../framework/plugins/windows/hashdump.py | 8 ++-- .../framework/plugins/windows/info.py | 12 ++--- .../framework/plugins/windows/lsadump.py | 10 ++-- .../framework/plugins/windows/malfind.py | 12 ++--- .../framework/plugins/windows/memmap.py | 8 ++-- .../framework/plugins/windows/modscan.py | 12 ++--- .../framework/plugins/windows/modules.py | 16 +++---- .../framework/plugins/windows/mutantscan.py | 8 ++-- .../framework/plugins/windows/netscan.py | 16 +++---- .../framework/plugins/windows/poolscanner.py | 16 +++---- .../framework/plugins/windows/privileges.py | 6 +-- .../framework/plugins/windows/pslist.py | 14 +++--- .../framework/plugins/windows/psscan.py | 18 ++++---- .../framework/plugins/windows/pstree.py | 8 ++-- .../plugins/windows/registry/__init__.py | 4 +- .../plugins/windows/registry/hivelist.py | 10 ++-- .../plugins/windows/registry/hivescan.py | 10 ++-- .../plugins/windows/registry/printkey.py | 12 ++--- .../plugins/windows/registry/userassist.json | 0 .../plugins/windows/registry/userassist.py | 14 +++--- .../plugins/windows/sids_and_privileges.json | 0 .../framework/plugins/windows/ssdt.py | 16 +++---- .../framework/plugins/windows/strings.py | 10 ++-- .../framework/plugins/windows/svcscan.py | 16 +++---- .../framework/plugins/windows/symlinkscan.py | 10 ++-- .../framework/plugins/windows/vadinfo.py | 10 ++-- .../framework/plugins/windows/vadyarascan.py | 10 ++-- .../framework/plugins/windows/verinfo.py | 12 ++--- .../framework/plugins/windows/virtmap.py | 8 ++-- .../framework/plugins/yarascan.py | 10 ++-- .../framework/renderers/__init__.py | 4 +- .../framework/renderers/conversion.py | 2 +- .../framework/renderers/format_hints.py | 0 .../framework/symbols/__init__.py | 2 +- .../framework/symbols/generic/__init__.py | 2 +- .../framework/symbols/generic/qemu.json | 0 .../framework/symbols/intermed.py | 14 +++--- .../framework/symbols/linux/__init__.py | 10 ++-- .../framework/symbols/linux/bash.py | 4 +- .../framework/symbols/linux/bash32.json | 0 .../framework/symbols/linux/bash64.json | 0 .../framework/symbols/linux/elf.json | 0 .../symbols/linux/extensions/__init__.py | 14 +++--- .../symbols/linux/extensions/bash.py | 8 ++-- .../framework/symbols/linux/extensions/elf.py | 4 +- .../framework/symbols/mac/__init__.py | 6 +-- .../symbols/mac/extensions/__init__.py | 12 ++--- .../framework/symbols/metadata.py | 2 +- .../framework/symbols/native.py | 2 +- .../framework/symbols/windows/__init__.py | 8 ++-- .../symbols/windows/bigpools-vista-x64.json | 0 .../symbols/windows/bigpools-vista-x86.json | 0 .../symbols/windows/bigpools-win10-x64.json | 0 .../symbols/windows/bigpools-win10-x86.json | 0 .../symbols/windows/bigpools-x64.json | 0 .../symbols/windows/bigpools-x86.json | 0 .../symbols/windows/callbacks-x64.json | 0 .../symbols/windows/callbacks-x86.json | 0 .../framework/symbols/windows/crash.json | 0 .../framework/symbols/windows/crash64.json | 0 .../symbols/windows/extensions/__init__.py | 10 ++-- .../symbols/windows/extensions/kdbg.py | 4 +- .../symbols/windows/extensions/network.py | 8 ++-- .../symbols/windows/extensions/pe.py | 6 +-- .../symbols/windows/extensions/pool.py | 4 +- .../symbols/windows/extensions/registry.py | 4 +- .../symbols/windows/extensions/services.py | 8 ++-- .../framework/symbols/windows/kdbg.json | 0 .../windows/netscan-vista-sp12-x64.json | 0 .../symbols/windows/netscan-vista-x64.json | 0 .../symbols/windows/netscan-vista-x86.json | 0 .../windows/netscan-win10-14393-x86.json | 0 .../windows/netscan-win10-15063-x64.json | 0 .../windows/netscan-win10-15063-x86.json | 0 .../windows/netscan-win10-16299-x64.json | 0 .../windows/netscan-win10-17134-x64.json | 0 .../windows/netscan-win10-17134-x86.json | 0 .../windows/netscan-win10-17763-x64.json | 0 .../windows/netscan-win10-18363-x64.json | 0 .../windows/netscan-win10-19041-x64.json | 0 .../windows/netscan-win10-19041-x86.json | 0 .../symbols/windows/netscan-win10-x64.json | 0 .../symbols/windows/netscan-win10-x86.json | 0 .../symbols/windows/netscan-win7-x64.json | 0 .../symbols/windows/netscan-win7-x86.json | 0 .../symbols/windows/netscan-win8-x64.json | 0 .../symbols/windows/netscan-win8-x86.json | 0 .../symbols/windows/netscan-win81-x64.json | 0 .../symbols/windows/netscan-win81-x86.json | 0 .../framework/symbols/windows/pdb.json | 0 .../framework/symbols/windows/pdbconv.py | 4 +- .../framework/symbols/windows/pdbutil.py | 14 +++--- .../framework/symbols/windows/pe.json | 0 .../symbols/windows/poolheader-x64-win7.json | 0 .../symbols/windows/poolheader-x64.json | 0 .../symbols/windows/poolheader-x86.json | 0 .../framework/symbols/windows/registry.json | 0 .../symbols/windows/services-vista-x64.json | 0 .../symbols/windows/services-vista-x86.json | 0 .../windows/services-win10-15063-x64.json | 0 .../windows/services-win10-15063-x86.json | 0 .../windows/services-win10-16299-x64.json | 0 .../windows/services-win10-16299-x86.json | 0 .../symbols/windows/services-win8-x64.json | 0 .../symbols/windows/services-win8-x86.json | 0 .../symbols/windows/services-xp-2003-x64.json | 0 .../symbols/windows/services-xp-x86.json | 0 .../framework/symbols/windows/versions.py | 2 +- .../framework/symbols/wrappers.py | 2 +- .../plugins/__init__.py | 2 +- .../plugins/linux/__init__.py | 0 .../plugins/mac/__init__.py | 0 .../plugins/windows/__init__.py | 0 .../plugins/windows/registry/__init__.py | 0 .../plugins/windows/registry/certificates.py | 8 ++-- .../plugins/windows/statistics.py | 8 ++-- .../schemas/__init__.py | 2 +- .../schemas/schema-0.1.0.json | 0 .../schemas/schema-2.0.0.json | 0 .../schemas/schema-2.1.0.json | 0 .../schemas/schema-4.0.0.json | 0 .../schemas/schema-4.1.0.json | 0 .../schemas/schema-6.0.0.json | 0 .../schemas/schema-6.1.0.json | 0 .../schemas/schema-6.2.0.json | 0 .../symbols/__init__.py | 2 +- volshell.py | 2 +- volshell.spec | 20 ++++---- 248 files changed, 813 insertions(+), 813 deletions(-) rename {volatility => volatility3}/__init__.py (73%) rename {volatility => volatility3}/cli/__init__.py (94%) rename {volatility => volatility3}/cli/text_renderer.py (99%) rename {volatility => volatility3}/cli/volargparse.py (100%) rename {volatility => volatility3}/cli/volshell/__init__.py (93%) rename {volatility => volatility3}/cli/volshell/generic.py (98%) rename {volatility => volatility3}/cli/volshell/linux.py (93%) rename {volatility => volatility3}/cli/volshell/mac.py (93%) rename {volatility => volatility3}/cli/volshell/windows.py (92%) rename {volatility => volatility3}/framework/__init__.py (96%) rename {volatility => volatility3}/framework/automagic/__init__.py (92%) rename {volatility => volatility3}/framework/automagic/construct_layers.py (88%) rename {volatility => volatility3}/framework/automagic/linux.py (95%) rename {volatility => volatility3}/framework/automagic/mac.py (96%) rename {volatility => volatility3}/framework/automagic/pdbscan.py (96%) rename {volatility => volatility3}/framework/automagic/stacker.py (93%) rename {volatility => volatility3}/framework/automagic/symbol_cache.py (97%) rename {volatility => volatility3}/framework/automagic/symbol_finder.py (96%) rename {volatility => volatility3}/framework/automagic/windows.py (98%) rename {volatility => volatility3}/framework/configuration/__init__.py (75%) rename {volatility => volatility3}/framework/configuration/requirements.py (99%) rename {volatility => volatility3}/framework/constants/__init__.py (90%) rename {volatility => volatility3}/framework/constants/linux/__init__.py (100%) rename {volatility => volatility3}/framework/constants/windows/__init__.py (100%) rename {volatility => volatility3}/framework/contexts/__init__.py (97%) rename {volatility => volatility3}/framework/exceptions.py (98%) rename {volatility => volatility3}/framework/interfaces/__init__.py (85%) rename {volatility => volatility3}/framework/interfaces/automagic.py (98%) rename {volatility => volatility3}/framework/interfaces/configuration.py (98%) rename {volatility => volatility3}/framework/interfaces/context.py (98%) rename {volatility => volatility3}/framework/interfaces/layers.py (99%) rename {volatility => volatility3}/framework/interfaces/objects.py (99%) rename {volatility => volatility3}/framework/interfaces/plugins.py (98%) rename {volatility => volatility3}/framework/interfaces/renderers.py (100%) rename {volatility => volatility3}/framework/interfaces/symbols.py (98%) rename {volatility => volatility3}/framework/layers/__init__.py (100%) rename {volatility => volatility3}/framework/layers/codecs/__init__.py (100%) rename {volatility => volatility3}/framework/layers/crash.py (98%) rename {volatility => volatility3}/framework/layers/elf.py (95%) rename {volatility => volatility3}/framework/layers/intel.py (98%) rename {volatility => volatility3}/framework/layers/lime.py (96%) rename {volatility => volatility3}/framework/layers/linear.py (98%) rename {volatility => volatility3}/framework/layers/msf.py (97%) rename {volatility => volatility3}/framework/layers/physical.py (97%) rename {volatility => volatility3}/framework/layers/qemu.py (98%) rename {volatility => volatility3}/framework/layers/registry.py (96%) rename {volatility => volatility3}/framework/layers/resources.py (99%) rename {volatility => volatility3}/framework/layers/scanners/__init__.py (94%) rename {volatility => volatility3}/framework/layers/scanners/multiregexp.py (100%) rename {volatility => volatility3}/framework/layers/segmented.py (97%) rename {volatility => volatility3}/framework/layers/vmware.py (96%) rename {volatility => volatility3}/framework/objects/__init__.py (99%) rename {volatility => volatility3}/framework/objects/templates.py (91%) rename {volatility => volatility3}/framework/objects/utility.py (97%) rename {volatility => volatility3}/framework/plugins/__init__.py (93%) rename {volatility => volatility3}/framework/plugins/banners.py (89%) rename {volatility => volatility3}/framework/plugins/configwriter.py (92%) rename {volatility => volatility3}/framework/plugins/frameworkinfo.py (88%) rename {volatility => volatility3}/framework/plugins/isfinfo.py (94%) rename {volatility => volatility3}/framework/plugins/layerwriter.py (96%) rename {volatility => volatility3}/framework/plugins/linux/__init__.py (69%) rename {volatility => volatility3}/framework/plugins/linux/bash.py (91%) rename {volatility => volatility3}/framework/plugins/linux/check_afinfo.py (92%) rename {volatility => volatility3}/framework/plugins/linux/check_creds.py (92%) rename {volatility => volatility3}/framework/plugins/linux/check_idt.py (92%) rename {volatility => volatility3}/framework/plugins/linux/check_modules.py (88%) rename {volatility => volatility3}/framework/plugins/linux/check_syscall.py (95%) rename {volatility => volatility3}/framework/plugins/linux/elfs.py (89%) rename {volatility => volatility3}/framework/plugins/linux/keyboard_notifiers.py (90%) rename {volatility => volatility3}/framework/plugins/linux/lsmod.py (89%) rename {volatility => volatility3}/framework/plugins/linux/lsof.py (89%) rename {volatility => volatility3}/framework/plugins/linux/malfind.py (91%) rename {volatility => volatility3}/framework/plugins/linux/proc.py (91%) rename {volatility => volatility3}/framework/plugins/linux/pslist.py (95%) rename {volatility => volatility3}/framework/plugins/linux/pstree.py (95%) rename {volatility => volatility3}/framework/plugins/linux/tty_check.py (88%) rename {volatility => volatility3}/framework/plugins/mac/__init__.py (100%) rename {volatility => volatility3}/framework/plugins/mac/bash.py (92%) rename {volatility => volatility3}/framework/plugins/mac/check_syscall.py (87%) rename {volatility => volatility3}/framework/plugins/mac/check_sysctl.py (90%) rename {volatility => volatility3}/framework/plugins/mac/check_trap_table.py (86%) rename {volatility => volatility3}/framework/plugins/mac/ifconfig.py (88%) rename {volatility => volatility3}/framework/plugins/mac/kauth_listeners.py (88%) rename {volatility => volatility3}/framework/plugins/mac/kauth_scopes.py (90%) rename {volatility => volatility3}/framework/plugins/mac/kevents.py (95%) rename {volatility => volatility3}/framework/plugins/mac/list_files.py (93%) rename {volatility => volatility3}/framework/plugins/mac/lsmod.py (88%) rename {volatility => volatility3}/framework/plugins/mac/lsof.py (90%) rename {volatility => volatility3}/framework/plugins/mac/malfind.py (90%) rename {volatility => volatility3}/framework/plugins/mac/mount.py (89%) rename {volatility => volatility3}/framework/plugins/mac/netstat.py (92%) rename {volatility => volatility3}/framework/plugins/mac/proc_maps.py (90%) rename {volatility => volatility3}/framework/plugins/mac/psaux.py (93%) rename {volatility => volatility3}/framework/plugins/mac/pslist.py (98%) rename {volatility => volatility3}/framework/plugins/mac/pstree.py (91%) rename {volatility => volatility3}/framework/plugins/mac/socket_filters.py (88%) rename {volatility => volatility3}/framework/plugins/mac/timers.py (90%) rename {volatility => volatility3}/framework/plugins/mac/trustedbsd.py (88%) rename {volatility => volatility3}/framework/plugins/mac/vfsevents.py (92%) rename {volatility => volatility3}/framework/plugins/timeliner.py (98%) rename {volatility => volatility3}/framework/plugins/windows/__init__.py (69%) rename {volatility => volatility3}/framework/plugins/windows/bigpools.py (92%) rename {volatility => volatility3}/framework/plugins/windows/cachedump.py (95%) rename {volatility => volatility3}/framework/plugins/windows/callbacks.py (97%) rename {volatility => volatility3}/framework/plugins/windows/cmdline.py (94%) rename {volatility => volatility3}/framework/plugins/windows/dlllist.py (95%) rename {volatility => volatility3}/framework/plugins/windows/driverirp.py (92%) rename {volatility => volatility3}/framework/plugins/windows/driverscan.py (93%) rename {volatility => volatility3}/framework/plugins/windows/dumpfiles.py (97%) rename {volatility => volatility3}/framework/plugins/windows/envars.py (94%) rename {volatility => volatility3}/framework/plugins/windows/filescan.py (91%) rename {volatility => volatility3}/framework/plugins/windows/getservicesids.py (92%) rename {volatility => volatility3}/framework/plugins/windows/getsids.py (93%) rename {volatility => volatility3}/framework/plugins/windows/handles.py (97%) rename {volatility => volatility3}/framework/plugins/windows/hashdump.py (98%) rename {volatility => volatility3}/framework/plugins/windows/info.py (96%) rename {volatility => volatility3}/framework/plugins/windows/lsadump.py (95%) rename {volatility => volatility3}/framework/plugins/windows/malfind.py (95%) rename {volatility => volatility3}/framework/plugins/windows/memmap.py (94%) rename {volatility => volatility3}/framework/plugins/windows/modscan.py (95%) rename {volatility => volatility3}/framework/plugins/windows/modules.py (94%) rename {volatility => volatility3}/framework/plugins/windows/mutantscan.py (91%) rename {volatility => volatility3}/framework/plugins/windows/netscan.py (97%) rename {volatility => volatility3}/framework/plugins/windows/poolscanner.py (97%) rename {volatility => volatility3}/framework/plugins/windows/privileges.py (93%) rename {volatility => volatility3}/framework/plugins/windows/pslist.py (96%) rename {volatility => volatility3}/framework/plugins/windows/psscan.py (95%) rename {volatility => volatility3}/framework/plugins/windows/pstree.py (95%) rename {volatility => volatility3}/framework/plugins/windows/registry/__init__.py (70%) rename {volatility => volatility3}/framework/plugins/windows/registry/hivelist.py (97%) rename {volatility => volatility3}/framework/plugins/windows/registry/hivescan.py (91%) rename {volatility => volatility3}/framework/plugins/windows/registry/printkey.py (95%) rename {volatility => volatility3}/framework/plugins/windows/registry/userassist.json (100%) rename {volatility => volatility3}/framework/plugins/windows/registry/userassist.py (96%) rename {volatility => volatility3}/framework/plugins/windows/sids_and_privileges.json (100%) rename {volatility => volatility3}/framework/plugins/windows/ssdt.py (93%) rename {volatility => volatility3}/framework/plugins/windows/strings.py (95%) rename {volatility => volatility3}/framework/plugins/windows/svcscan.py (94%) rename {volatility => volatility3}/framework/plugins/windows/symlinkscan.py (91%) rename {volatility => volatility3}/framework/plugins/windows/vadinfo.py (97%) rename {volatility => volatility3}/framework/plugins/windows/vadyarascan.py (94%) rename {volatility => volatility3}/framework/plugins/windows/verinfo.py (95%) rename {volatility => volatility3}/framework/plugins/windows/virtmap.py (96%) rename {volatility => volatility3}/framework/plugins/yarascan.py (93%) rename {volatility => volatility3}/framework/renderers/__init__.py (99%) rename {volatility => volatility3}/framework/renderers/conversion.py (98%) rename {volatility => volatility3}/framework/renderers/format_hints.py (100%) rename {volatility => volatility3}/framework/symbols/__init__.py (99%) rename {volatility => volatility3}/framework/symbols/generic/__init__.py (97%) rename {volatility => volatility3}/framework/symbols/generic/qemu.json (100%) rename {volatility => volatility3}/framework/symbols/intermed.py (98%) rename {volatility => volatility3}/framework/symbols/linux/__init__.py (96%) rename {volatility => volatility3}/framework/symbols/linux/bash.py (77%) rename {volatility => volatility3}/framework/symbols/linux/bash32.json (100%) rename {volatility => volatility3}/framework/symbols/linux/bash64.json (100%) rename {volatility => volatility3}/framework/symbols/linux/elf.json (100%) rename {volatility => volatility3}/framework/symbols/linux/extensions/__init__.py (97%) rename {volatility => volatility3}/framework/symbols/linux/extensions/bash.py (89%) rename {volatility => volatility3}/framework/symbols/linux/extensions/elf.py (98%) rename {volatility => volatility3}/framework/symbols/mac/__init__.py (97%) rename {volatility => volatility3}/framework/symbols/mac/extensions/__init__.py (98%) rename {volatility => volatility3}/framework/symbols/metadata.py (96%) rename {volatility => volatility3}/framework/symbols/native.py (98%) rename {volatility => volatility3}/framework/symbols/windows/__init__.py (92%) rename {volatility => volatility3}/framework/symbols/windows/bigpools-vista-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/bigpools-vista-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/bigpools-win10-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/bigpools-win10-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/bigpools-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/bigpools-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/callbacks-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/callbacks-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/crash.json (100%) rename {volatility => volatility3}/framework/symbols/windows/crash64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/extensions/__init__.py (99%) rename {volatility => volatility3}/framework/symbols/windows/extensions/kdbg.py (93%) rename {volatility => volatility3}/framework/symbols/windows/extensions/network.py (97%) rename {volatility => volatility3}/framework/symbols/windows/extensions/pe.py (98%) rename {volatility => volatility3}/framework/symbols/windows/extensions/pool.py (99%) rename {volatility => volatility3}/framework/symbols/windows/extensions/registry.py (98%) rename {volatility => volatility3}/framework/symbols/windows/extensions/services.py (96%) rename {volatility => volatility3}/framework/symbols/windows/kdbg.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-vista-sp12-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-vista-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-vista-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-14393-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-15063-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-15063-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-16299-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-17134-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-17134-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-17763-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-18363-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-19041-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-19041-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win10-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win7-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win7-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win8-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win8-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win81-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/netscan-win81-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/pdb.json (100%) rename {volatility => volatility3}/framework/symbols/windows/pdbconv.py (99%) rename {volatility => volatility3}/framework/symbols/windows/pdbutil.py (96%) rename {volatility => volatility3}/framework/symbols/windows/pe.json (100%) rename {volatility => volatility3}/framework/symbols/windows/poolheader-x64-win7.json (100%) rename {volatility => volatility3}/framework/symbols/windows/poolheader-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/poolheader-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/registry.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-vista-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-vista-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-win10-15063-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-win10-15063-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-win10-16299-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-win10-16299-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-win8-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-win8-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-xp-2003-x64.json (100%) rename {volatility => volatility3}/framework/symbols/windows/services-xp-x86.json (100%) rename {volatility => volatility3}/framework/symbols/windows/versions.py (98%) rename {volatility => volatility3}/framework/symbols/wrappers.py (94%) rename {volatility => volatility3}/plugins/__init__.py (94%) rename {volatility => volatility3}/plugins/linux/__init__.py (100%) rename {volatility => volatility3}/plugins/mac/__init__.py (100%) rename {volatility => volatility3}/plugins/windows/__init__.py (100%) rename {volatility => volatility3}/plugins/windows/registry/__init__.py (100%) rename {volatility => volatility3}/plugins/windows/registry/certificates.py (93%) rename {volatility => volatility3}/plugins/windows/statistics.py (93%) rename {volatility => volatility3}/schemas/__init__.py (98%) rename {volatility => volatility3}/schemas/schema-0.1.0.json (100%) rename {volatility => volatility3}/schemas/schema-2.0.0.json (100%) rename {volatility => volatility3}/schemas/schema-2.1.0.json (100%) rename {volatility => volatility3}/schemas/schema-4.0.0.json (100%) rename {volatility => volatility3}/schemas/schema-4.1.0.json (100%) rename {volatility => volatility3}/schemas/schema-6.0.0.json (100%) rename {volatility => volatility3}/schemas/schema-6.1.0.json (100%) rename {volatility => volatility3}/schemas/schema-6.2.0.json (100%) rename {volatility => volatility3}/symbols/__init__.py (89%) diff --git a/.gitignore b/.gitignore index 448d08dbd..eba1ee1a5 100644 --- a/.gitignore +++ b/.gitignore @@ -14,14 +14,14 @@ workspace.xml # Manually generated files .mypy_cache stubs -volatility/symbols/linux* -volatility/symbols/windows* -volatility/symbols/mac* +volatility3/symbols/linux* +volatility3/symbols/windows* +volatility3/symbols/mac* # Mac metadata files .DS_Store -# Volatility's config +# Volatility's config config*.json # Pyinstaller files diff --git a/development/schema_validate.py b/development/schema_validate.py index 00a74868a..ece56cdec 100644 --- a/development/schema_validate.py +++ b/development/schema_validate.py @@ -17,7 +17,7 @@ logger = logging.getLogger("") logger.addHandler(console) logger.setLevel(logging.DEBUG) -from volatility import schemas +from volatility3 import schemas if __name__ == '__main__': parser = argparse.ArgumentParser("Validates ") diff --git a/doc/source/conf.py b/doc/source/conf.py index bef818295..6a382be3b 100644 --- a/doc/source/conf.py +++ b/doc/source/conf.py @@ -21,18 +21,18 @@ import sphinx.ext.apidoc def setup(app): - volatility_directory = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..', 'volatility')) + volatility_directory = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..', 'volatility3')) source_dir = os.path.abspath(os.path.dirname(__file__)) sphinx.ext.apidoc.main(argv = ['-e', '-M', '-f', '-T', '-o', source_dir, volatility_directory]) - # Go through the volatility.framework.plugins files and change them to volatility.plugins + # Go through the volatility3.framework.plugins files and change them to volatility3.plugins for dir, _, files in os.walk(os.path.dirname(__file__)): for filename in files: - if filename.startswith('volatility.framework.plugins') and filename != 'volatility.framework.plugins.rst': - # Change all volatility.framework.plugins to volatility.plugins in the file + if filename.startswith('volatility3.framework.plugins') and filename != 'volatility3.framework.plugins.rst': + # Change all volatility3.framework.plugins to volatility3.plugins in the file # Rename the file - new_filename = filename.replace('volatility.framework.plugins', 'volatility.plugins') + new_filename = filename.replace('volatility3.framework.plugins', 'volatility3.plugins') replace_string = b"Submodules\n----------\n\n.. toctree::\n\n" submodules = replace_string @@ -48,22 +48,22 @@ def setup(app): with open(os.path.join(dir, new_filename), 'wb') as newfile: with open(os.path.join(dir, filename), "rb") as oldfile: line = oldfile.read() - correct_plugins = line.replace(b'volatility.framework.plugins', b'volatility.plugins') + correct_plugins = line.replace(b'volatility3.framework.plugins', b'volatility3.plugins') correct_submodules = correct_plugins.replace(replace_string, submodules) newfile.write(correct_submodules) os.remove(os.path.join(dir, filename)) - elif filename == 'volatility.framework.rst': + elif filename == 'volatility3.framework.rst': with open(os.path.join(dir, filename), "rb") as contents: lines = contents.readlines() plugins_seen = False with open(os.path.join(dir, filename), "wb") as contents: for line in lines: - if b'volatility.framework.plugins' in line: + if b'volatility3.framework.plugins' in line: plugins_seen = True if plugins_seen and line == b'': - contents.write(b' volatility.plugins') + contents.write(b' volatility3.plugins') contents.write(line) - elif filename == 'volatility.plugins.rst': + elif filename == 'volatility3.plugins.rst': with open(os.path.join(dir, filename), "rb") as contents: lines = contents.readlines() with open(os.path.join(dir, 'volatility.framework.plugins.rst'), "rb") as contents: @@ -82,7 +82,7 @@ def setup(app): for line in lines: contents.write(line) for line in submodule_lines: - contents.write(line.replace(b'volatility.framework.plugins', b'volatility.plugins')) + contents.write(line.replace(b'volatility3.framework.plugins', b'volatility3.plugins')) # If extensions (or modules to document with autodoc) are in another directory, @@ -90,7 +90,7 @@ def setup(app): # documentation root, use os.path.abspath to make it absolute, like shown here. sys.path.insert(0, os.path.abspath('../..')) -from volatility.framework import constants +from volatility3.framework import constants # -- General configuration ------------------------------------------------ diff --git a/setup.py b/setup.py index 737deb4a9..168c7a4cf 100644 --- a/setup.py +++ b/setup.py @@ -4,9 +4,9 @@ import setuptools -from volatility.framework import constants +from volatility3.framework import constants -setuptools.setup(name = "volatility", +setuptools.setup(name = "volatility3", description = "Memory forensics framework", version = constants.PACKAGE_VERSION, license = "VSL", @@ -27,8 +27,8 @@ setuptools.setup(name = "volatility", packages = setuptools.find_packages(exclude = ["development", "development.*"]), entry_points = { 'console_scripts': [ - 'vol = volatility.cli:main', - 'volshell = volatility.cli.volshell:main', + 'vol = volatility3.cli:main', + 'volshell = volatility3.cli.volshell:main', ], }, install_requires = ["pefile"], diff --git a/vol.py b/vol.py index 802915386..080413545 100755 --- a/vol.py +++ b/vol.py @@ -4,7 +4,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import volatility.cli +import volatility3.cli if __name__ == '__main__': - volatility.cli.main() + volatility3.cli.main() diff --git a/vol.spec b/vol.spec index 6d7b67662..42b69af3f 100644 --- a/vol.spec +++ b/vol.spec @@ -31,15 +31,15 @@ sys.path.append(os.getcwd()) vol_analysis = Analysis(['vol.py'], pathex = [], binaries = binaries, - datas = collect_data_files('volatility.framework') + \ - collect_data_files('volatility.framework.automagic', include_py_files = True) + \ - collect_data_files('volatility.framework.plugins', include_py_files = True) + \ - collect_data_files('volatility.framework.layers', include_py_files = True) + \ - collect_data_files('volatility.schemas') + \ - collect_data_files('volatility.plugins', include_py_files = True), - hiddenimports = collect_submodules('volatility.framework.automagic') + \ - collect_submodules('volatility.framework.plugins') + \ - collect_submodules('volatility.framework.symbols'), + datas = collect_data_files('volatility3.framework') + \ + collect_data_files('volatility3.framework.automagic', include_py_files = True) + \ + collect_data_files('volatility3.framework.plugins', include_py_files = True) + \ + collect_data_files('volatility3.framework.layers', include_py_files = True) + \ + collect_data_files('volatility3.schemas') + \ + collect_data_files('volatility3.plugins', include_py_files = True), + hiddenimports = collect_submodules('volatility3.framework.automagic') + \ + collect_submodules('volatility3.framework.plugins') + \ + collect_submodules('volatility3.framework.symbols'), hookspath = [], runtime_hooks = [], excludes = [], @@ -55,16 +55,16 @@ vol_analysis = Analysis(['vol.py'], # volshell_analysis = Analysis(['volshell.py'], # pathex = [], # binaries = [], -# datas = collect_data_files('volatility.framework') + \ -# collect_data_files('volatility.framework.automagic', include_py_files = True) + \ -# collect_data_files('volatility.framework.plugins', include_py_files = True) + \ -# collect_data_files('volatility.framework.layers', include_py_files = True) + \ -# collect_data_files('volatility.cli', include_py_files = True) + \ -# collect_data_files('volatility.schemas') + \ -# collect_data_files('volatility.plugins', include_py_files = True), -# hiddenimports = collect_submodules('volatility.framework.automagic') + \ -# collect_submodules('volatility.framework.plugins') + \ -# collect_submodules('volatility.framework.symbols'), +# datas = collect_data_files('volatility3.framework') + \ +# collect_data_files('volatility3.framework.automagic', include_py_files = True) + \ +# collect_data_files('volatility3.framework.plugins', include_py_files = True) + \ +# collect_data_files('volatility3.framework.layers', include_py_files = True) + \ +# collect_data_files('volatility3.cli', include_py_files = True) + \ +# collect_data_files('volatility3.schemas') + \ +# collect_data_files('volatility3.plugins', include_py_files = True), +# hiddenimports = collect_submodules('volatility3.framework.automagic') + \ +# collect_submodules('volatility3.framework.plugins') + \ +# collect_submodules('volatility3.framework.symbols'), # hookspath = [], # runtime_hooks = [], # excludes = [], diff --git a/volatility/__init__.py b/volatility3/__init__.py similarity index 73% rename from volatility/__init__.py rename to volatility3/__init__.py index f766a4ba2..5d3c34e43 100644 --- a/volatility/__init__.py +++ b/volatility3/__init__.py @@ -35,8 +35,8 @@ class WarningFindSpec(abc.MetaPathFinder): def find_spec(fullname: str, path: Optional[List[str]], target: None = None, **kwargs) -> None: """Mock find_spec method that just checks the name, this must go first.""" - if fullname.startswith("volatility.framework.plugins."): - warning = "Please do not use the volatility.framework.plugins namespace directly, only use volatility.plugins" + if fullname.startswith("volatility3.framework.plugins."): + warning = "Please do not use the volatility3.framework.plugins namespace directly, only use volatility3.plugins" # Pyinstaller uses walk_packages to import, but needs to read the modules to figure out dependencies # As such, we only print the warning when directly imported rather than from within walk_packages if inspect.stack()[-2].function != 'walk_packages': @@ -46,17 +46,17 @@ class WarningFindSpec(abc.MetaPathFinder): warning_find_spec = [WarningFindSpec()] # type: List[abc.MetaPathFinder] sys.meta_path = warning_find_spec + sys.meta_path -# We point the volatility.plugins __path__ variable at BOTH -# volatility/plugins -# volatility/framework/plugins +# We point the volatility3.plugins __path__ variable at BOTH +# volatility3/plugins +# volatility3/framework/plugins # in that order. # # This will allow our users to override any component of any plugin without monkey patching, # but it also allows us to clear out the plugins directory to get back to proper functionality. # This offered the greatest flexibility for users whilst allowing us to keep the core separate and clean. # -# This means that all plugins should be imported as volatility.plugins (otherwise they'll be imported twice, -# once as volatility.plugins.NAME and once as volatility.framework.plugins.NAME). We therefore throw an error -# if anyone tries to import anything under the volatility.framework.plugins.* namespace +# This means that all plugins should be imported as volatility3.plugins (otherwise they'll be imported twice, +# once as volatility3.plugins.NAME and once as volatility3.framework.plugins.NAME). We therefore throw an error +# if anyone tries to import anything under the volatility3.framework.plugins.* namespace # -# The remediation is to only ever import form volatility.plugins instead. +# The remediation is to only ever import form volatility3.plugins instead. diff --git a/volatility/cli/__init__.py b/volatility3/cli/__init__.py similarity index 94% rename from volatility/cli/__init__.py rename to volatility3/cli/__init__.py index 0c038a322..a90404d0a 100644 --- a/volatility/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -22,13 +22,13 @@ import traceback from typing import Dict, Type, Union, Any from urllib import parse, request -import volatility.plugins -import volatility.symbols -from volatility import framework -from volatility.cli import text_renderer, volargparse -from volatility.framework import automagic, constants, contexts, exceptions, interfaces, plugins, configuration -from volatility.framework.automagic import stacker -from volatility.framework.configuration import requirements +import volatility3.plugins +import volatility3.symbols +from volatility3 import framework +from volatility3.cli import text_renderer, volargparse +from volatility3.framework import automagic, constants, contexts, exceptions, interfaces, plugins, configuration +from volatility3.framework.automagic import stacker +from volatility3.framework.configuration import requirements # Make sure we log everything @@ -71,7 +71,7 @@ class MuteProgress(PrintedProgress): class CommandLine: """Constructs a command-line interface object for users to run plugins.""" - CLI_NAME = 'volatility' + CLI_NAME = 'volatility3' def __init__(self): self.setup_logging() @@ -79,7 +79,7 @@ class CommandLine: @classmethod def setup_logging(cls): - # Delay the setting of vollog for those that want to import volatility.cli (issue #241) + # Delay the setting of vollog for those that want to import volatility3.cli (issue #241) vollog.setLevel(1) vollog.addHandler(console) @@ -87,7 +87,7 @@ class CommandLine: """Executes the command line module, taking the system arguments, determining the plugin to run and then running it.""" - volatility.framework.require_interface_version(2, 0, 0) + volatility3.framework.require_interface_version(2, 0, 0) renderers = dict([(x.name.lower(), x) for x in framework.class_subclasses(text_renderer.CLIRenderer)]) @@ -172,12 +172,12 @@ class CommandLine: banner_output.write("Volatility 3 Framework {}\n".format(constants.PACKAGE_VERSION)) if partial_args.plugin_dirs: - volatility.plugins.__path__ = [os.path.abspath(p) - for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH + volatility3.plugins.__path__ = [os.path.abspath(p) + for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH if partial_args.symbol_dirs: - volatility.symbols.__path__ = [os.path.abspath(p) - for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS + volatility3.symbols.__path__ = [os.path.abspath(p) + for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS if partial_args.log: file_logger = logging.FileHandler(partial_args.log) @@ -192,8 +192,8 @@ class CommandLine: else: console.setLevel(10 - (partial_args.verbosity - 2)) - vollog.info("Volatility plugins path: {}".format(volatility.plugins.__path__)) - vollog.info("Volatility symbols path: {}".format(volatility.symbols.__path__)) + vollog.info("Volatility plugins path: {}".format(volatility3.plugins.__path__)) + vollog.info("Volatility symbols path: {}".format(volatility3.symbols.__path__)) # Set the PARALLELISM if partial_args.parallelism == 'processes': @@ -208,7 +208,7 @@ class CommandLine: # Do the initialization ctx = contexts.Context() # Construct a blank context - failures = framework.import_files(volatility.plugins, + failures = framework.import_files(volatility3.plugins, True) # Will not log as console's default level is WARNING if failures: parser.epilog = "The following plugins could not be loaded (use -vv to see why): " + \ @@ -342,7 +342,7 @@ class CommandLine: caused_by = [ "Memory smear during acquisition (try re-acquiring if possible)", "An intentionally invalid page lookup (operating system protection)", - "A bug in the plugin/volatility (re-run with -vvv and file a bug)" + "A bug in the plugin/volatility3 (re-run with -vvv and file a bug)" ] else: detail = "{} in layer {} ({})".format(hex(excp.invalid_address), excp.layer_name, excp) @@ -350,7 +350,7 @@ class CommandLine: "The base memory file being incomplete (try re-acquiring if possible)", "Memory smear during acquisition (try re-acquiring if possible)", "An intentionally invalid page lookup (operating system protection)", - "A bug in the plugin/volatility (re-run with -vvv and file a bug)" + "A bug in the plugin/volatility3 (re-run with -vvv and file a bug)" ] elif isinstance(excp, exceptions.SymbolError): general = "Volatility experienced a symbol-related issue:" @@ -414,7 +414,7 @@ class CommandLine: print("\nA translation layer requirement was not fulfilled. Please verify that:\n" "\tA file was provided to create this layer (by -f, --single-location or by config)\n" "\tThe file exists and is readable\n" - "\tThe necessary symbols are present and identified by volatility") + "\tThe necessary symbols are present and identified by volatility3") def populate_config(self, context: interfaces.context.ContextInterface, configurables_list: Dict[str, Type[interfaces.configuration.ConfigurableInterface]], @@ -424,7 +424,7 @@ class CommandLine: We have already determined these elements must be descended from ConfigurableInterface Args: - context: The volatility context to operate on + context: The volatility3 context to operate on configurables_list: A dictionary of configurable items that can be configured on the plugin args: An object containing the arguments necessary plugin_config_path: The path within the context's config containing the plugin's configuration @@ -564,11 +564,11 @@ class CommandLine: additional["action"] = "store_true" if "type" in additional: del additional["type"] - elif isinstance(requirement, volatility.framework.configuration.requirements.ListRequirement): + elif isinstance(requirement, volatility3.framework.configuration.requirements.ListRequirement): additional["type"] = requirement.element_type nargs = '*' if requirement.optional else '+' additional["nargs"] = nargs - elif isinstance(requirement, volatility.framework.configuration.requirements.ChoiceRequirement): + elif isinstance(requirement, volatility3.framework.configuration.requirements.ChoiceRequirement): additional["type"] = str additional["choices"] = requirement.choices else: diff --git a/volatility/cli/text_renderer.py b/volatility3/cli/text_renderer.py similarity index 99% rename from volatility/cli/text_renderer.py rename to volatility3/cli/text_renderer.py index d1d2663fe..f40a5d323 100644 --- a/volatility/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -10,8 +10,8 @@ import sys from functools import wraps from typing import Callable, Any, List, Tuple, Dict -from volatility.framework import interfaces, renderers -from volatility.framework.renderers import format_hints +from volatility3.framework import interfaces, renderers +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) diff --git a/volatility/cli/volargparse.py b/volatility3/cli/volargparse.py similarity index 100% rename from volatility/cli/volargparse.py rename to volatility3/cli/volargparse.py diff --git a/volatility/cli/volshell/__init__.py b/volatility3/cli/volshell/__init__.py similarity index 93% rename from volatility/cli/volshell/__init__.py rename to volatility3/cli/volshell/__init__.py index 4441d4b7b..122107d0f 100644 --- a/volatility/cli/volshell/__init__.py +++ b/volatility3/cli/volshell/__init__.py @@ -9,11 +9,11 @@ import os import sys from urllib import request -import volatility.plugins -import volatility.symbols -from volatility import cli, framework -from volatility.cli.volshell import generic, windows, linux, mac -from volatility.framework import automagic, constants, contexts, exceptions, interfaces, plugins +import volatility3.plugins +import volatility3.symbols +from volatility3 import cli, framework +from volatility3.cli.volshell import generic, windows, linux, mac +from volatility3.framework import automagic, constants, contexts, exceptions, interfaces, plugins # Make sure we log everything vollog = logging.getLogger() @@ -104,15 +104,15 @@ class VolShell(cli.CommandLine): known_args = [arg for arg in sys.argv if arg != '--help' and arg != '-h'] partial_args, _ = parser.parse_known_args(known_args) if partial_args.plugin_dirs: - volatility.plugins.__path__ = [os.path.abspath(p) - for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH + volatility3.plugins.__path__ = [os.path.abspath(p) + for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH if partial_args.symbol_dirs: - volatility.symbols.__path__ = [os.path.abspath(p) - for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS + volatility3.symbols.__path__ = [os.path.abspath(p) + for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS - vollog.info("Volatility plugins path: {}".format(volatility.plugins.__path__)) - vollog.info("Volatility symbols path: {}".format(volatility.symbols.__path__)) + vollog.info("Volatility plugins path: {}".format(volatility3.plugins.__path__)) + vollog.info("Volatility symbols path: {}".format(volatility3.symbols.__path__)) if partial_args.log: file_logger = logging.FileHandler(partial_args.log) @@ -134,7 +134,7 @@ class VolShell(cli.CommandLine): # Do the initialization ctx = contexts.Context() # Construct a blank context - failures = framework.import_files(volatility.plugins, + failures = framework.import_files(volatility3.plugins, True) # Will not log as console's default level is WARNING if failures: parser.epilog = "The following plugins could not be loaded (use -vv to see why): " + \ diff --git a/volatility/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py similarity index 98% rename from volatility/cli/volshell/generic.py rename to volatility3/cli/volshell/generic.py index 18d76ae04..a2a156ac4 100644 --- a/volatility/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -11,10 +11,10 @@ import sys from typing import Any, Dict, List, Optional, Tuple, Union, Type from urllib import request -from volatility.cli import text_renderer -from volatility.framework import renderers, interfaces, objects, plugins, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import intel, physical +from volatility3.cli import text_renderer +from volatility3.framework import renderers, interfaces, objects, plugins, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import intel, physical try: import capstone diff --git a/volatility/cli/volshell/linux.py b/volatility3/cli/volshell/linux.py similarity index 93% rename from volatility/cli/volshell/linux.py rename to volatility3/cli/volshell/linux.py index 03c54bda9..73d5481aa 100644 --- a/volatility/cli/volshell/linux.py +++ b/volatility3/cli/volshell/linux.py @@ -4,10 +4,10 @@ from typing import Any, List, Tuple, Union -from volatility.cli.volshell import generic -from volatility.framework import interfaces, constants -from volatility.framework.configuration import requirements -from volatility.plugins.linux import pslist +from volatility3.cli.volshell import generic +from volatility3.framework import interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.plugins.linux import pslist class Volshell(generic.Volshell): diff --git a/volatility/cli/volshell/mac.py b/volatility3/cli/volshell/mac.py similarity index 93% rename from volatility/cli/volshell/mac.py rename to volatility3/cli/volshell/mac.py index d0ae4cb13..662f8dcb4 100644 --- a/volatility/cli/volshell/mac.py +++ b/volatility3/cli/volshell/mac.py @@ -4,10 +4,10 @@ from typing import Any, List, Tuple, Union -from volatility.cli.volshell import generic -from volatility.framework import constants, interfaces -from volatility.framework.configuration import requirements -from volatility.plugins.mac import pslist +from volatility3.cli.volshell import generic +from volatility3.framework import constants, interfaces +from volatility3.framework.configuration import requirements +from volatility3.plugins.mac import pslist class Volshell(generic.Volshell): diff --git a/volatility/cli/volshell/windows.py b/volatility3/cli/volshell/windows.py similarity index 92% rename from volatility/cli/volshell/windows.py rename to volatility3/cli/volshell/windows.py index 7f4c4fcc1..d9de5a92f 100644 --- a/volatility/cli/volshell/windows.py +++ b/volatility3/cli/volshell/windows.py @@ -4,10 +4,10 @@ from typing import Any, List, Tuple, Union -from volatility.cli.volshell import generic -from volatility.framework import interfaces, constants -from volatility.framework.configuration import requirements -from volatility.plugins.windows import pslist +from volatility3.cli.volshell import generic +from volatility3.framework import interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.plugins.windows import pslist class Volshell(generic.Volshell): diff --git a/volatility/framework/__init__.py b/volatility3/framework/__init__.py similarity index 96% rename from volatility/framework/__init__.py rename to volatility3/framework/__init__.py index b0a9feeae..e8c67588c 100644 --- a/volatility/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -19,7 +19,7 @@ import logging import os from typing import Any, Dict, Generator, List, Tuple, Type, TypeVar -from volatility.framework import constants, interfaces +from volatility3.framework import constants, interfaces # ## # @@ -120,8 +120,8 @@ def list_plugins() -> Dict[str, Type[interfaces.plugins.PluginInterface]]: plugin_list = {} for plugin in class_subclasses(interfaces.plugins.PluginInterface): plugin_name = plugin.__module__ + "." + plugin.__name__ - if plugin_name.startswith("volatility.plugins."): - plugin_name = plugin_name[len("volatility.plugins."):] + if plugin_name.startswith("volatility3.plugins."): + plugin_name = plugin_name[len("volatility3.plugins."):] plugin_list[plugin_name] = plugin return plugin_list diff --git a/volatility/framework/automagic/__init__.py b/volatility3/framework/automagic/__init__.py similarity index 92% rename from volatility/framework/automagic/__init__.py rename to volatility3/framework/automagic/__init__.py index 2541214a0..be1badb6b 100644 --- a/volatility/framework/automagic/__init__.py +++ b/volatility3/framework/automagic/__init__.py @@ -16,8 +16,8 @@ import sys import traceback from typing import List, Type, Union -from volatility.framework import class_subclasses, import_files, interfaces, constants -from volatility.framework.configuration import requirements +from volatility3.framework import class_subclasses, import_files, interfaces, constants +from volatility3.framework.configuration import requirements vollog = logging.getLogger(__name__) @@ -30,7 +30,7 @@ mac_automagic = ['ConstructionMagic', 'LayerStacker', 'MacBannerCache', 'MacSymb def available(context: interfaces.context.ContextInterface) -> List[interfaces.automagic.AutomagicInterface]: """Returns an ordered list of all subclasses of - :class:`~volatility.framework.interfaces.automagic.AutomagicInterface`. + :class:`~volatility3.framework.interfaces.automagic.AutomagicInterface`. The order is based on the priority attributes of the subclasses, in order to ensure the automagics are listed in an appropriate order. @@ -90,9 +90,9 @@ def run(automagics: List[interfaces.automagic.AutomagicInterface], changes to the context. Args: - automagics: A list of :class:`~volatility.framework.interfaces.automagic.AutomagicInterface` objects - context: The context (that inherits from :class:`~volatility.framework.interfaces.context.ContextInterface`) for modification - configurable: An object that inherits from :class:`~volatility.framework.interfaces.configuration.ConfigurableInterface` + automagics: A list of :class:`~volatility3.framework.interfaces.automagic.AutomagicInterface` objects + context: The context (that inherits from :class:`~volatility3.framework.interfaces.context.ContextInterface`) for modification + configurable: An object that inherits from :class:`~volatility3.framework.interfaces.configuration.ConfigurableInterface` config_path: The path within the `context.config` for options required by the `configurable` progress_callback: A function that takes a percentage (and an optional description) that will be called periodically diff --git a/volatility/framework/automagic/construct_layers.py b/volatility3/framework/automagic/construct_layers.py similarity index 88% rename from volatility/framework/automagic/construct_layers.py rename to volatility3/framework/automagic/construct_layers.py index 66288db69..15e6af4bd 100644 --- a/volatility/framework/automagic/construct_layers.py +++ b/volatility3/framework/automagic/construct_layers.py @@ -2,16 +2,16 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """An automagic module to use configuration data to configure and then -construct classes that fulfill the descendants of a :class:`~volatility.framewo +construct classes that fulfill the descendants of a :class:`~volatility3.framewo rk.interfaces.configuration.ConfigurableInterface`.""" import logging import sys from typing import List -from volatility import framework -from volatility.framework import constants -from volatility.framework import interfaces +from volatility3 import framework +from volatility3.framework import constants +from volatility3.framework import interfaces vollog = logging.getLogger(__name__) @@ -19,9 +19,9 @@ vollog = logging.getLogger(__name__) class ConstructionMagic(interfaces.automagic.AutomagicInterface): """Constructs underlying layers. - Class to run through the requirement tree of the :class:`~volatility.framework.interfaces.configuration.ConfigurableInterface` + Class to run through the requirement tree of the :class:`~volatility3.framework.interfaces.configuration.ConfigurableInterface` and from the bottom of the tree upwards, attempt to construct all - :class:`~volatility.framework.interfaces.configuration.ConstructableRequirementInterface` based classes. + :class:`~volatility3.framework.interfaces.configuration.ConstructableRequirementInterface` based classes. :warning: This `automagic` should run first to allow existing configurations to have been constructed for use by later automagic """ @@ -35,7 +35,7 @@ class ConstructionMagic(interfaces.automagic.AutomagicInterface): optional = False) -> List[str]: # Make sure we import the layers, so they can reconstructed - framework.import_files(sys.modules['volatility.framework.layers']) + framework.import_files(sys.modules['volatility3.framework.layers']) result = [] # type: List[str] if requirement.unsatisfied(context, config_path): diff --git a/volatility/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py similarity index 95% rename from volatility/framework/automagic/linux.py rename to volatility3/framework/automagic/linux.py index 3590f18b5..34d6e7936 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -5,10 +5,10 @@ import logging from typing import Optional, Tuple, Type -from volatility.framework import interfaces, constants -from volatility.framework.automagic import symbol_cache, symbol_finder -from volatility.framework.layers import intel, scanners -from volatility.framework.symbols import linux +from volatility3.framework import interfaces, constants +from volatility3.framework.automagic import symbol_cache, symbol_finder +from volatility3.framework.layers import intel, scanners +from volatility3.framework.symbols import linux vollog = logging.getLogger(__name__) @@ -153,5 +153,5 @@ class LinuxSymbolFinder(symbol_finder.SymbolFinder): banner_config_key = "kernel_banner" banner_cache = LinuxBannerCache - symbol_class = "volatility.framework.symbols.linux.LinuxKernelIntermedSymbols" + symbol_class = "volatility3.framework.symbols.linux.LinuxKernelIntermedSymbols" find_aslr = lambda cls, *args: LinuxIntelStacker.find_aslr(*args)[1] diff --git a/volatility/framework/automagic/mac.py b/volatility3/framework/automagic/mac.py similarity index 96% rename from volatility/framework/automagic/mac.py rename to volatility3/framework/automagic/mac.py index e88de792f..3ba179068 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility3/framework/automagic/mac.py @@ -6,10 +6,10 @@ import logging import struct from typing import Optional -from volatility.framework import interfaces, constants, layers -from volatility.framework.automagic import symbol_cache, symbol_finder -from volatility.framework.layers import intel, scanners -from volatility.framework.symbols import mac +from volatility3.framework import interfaces, constants, layers +from volatility3.framework.automagic import symbol_cache, symbol_finder +from volatility3.framework.layers import intel, scanners +from volatility3.framework.symbols import mac vollog = logging.getLogger(__name__) @@ -204,4 +204,4 @@ class MacSymbolFinder(symbol_finder.SymbolFinder): banner_config_key = 'kernel_banner' banner_cache = MacBannerCache find_aslr = MacIntelStacker.find_aslr - symbol_class = "volatility.framework.symbols.mac.MacKernelIntermedSymbols" + symbol_class = "volatility3.framework.symbols.mac.MacKernelIntermedSymbols" diff --git a/volatility/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py similarity index 96% rename from volatility/framework/automagic/pdbscan.py rename to volatility3/framework/automagic/pdbscan.py index 8ad750737..59b78c3ca 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -4,19 +4,19 @@ """A module for scanning translation layers looking for Windows PDB records from loaded PE files. -This module contains a standalone scanner, and also a :class:`~volatility.framework.interfaces.layers.ScannerInterface` -based scanner for use within the framework by calling :func:`~volatility.framework.interfaces.layers.DataLayerInterface.scan`. +This module contains a standalone scanner, and also a :class:`~volatility3.framework.interfaces.layers.ScannerInterface` +based scanner for use within the framework by calling :func:`~volatility3.framework.interfaces.layers.DataLayerInterface.scan`. """ import logging import math import os from typing import Any, Dict, Iterable, List, Optional, Set, Tuple, Union -from volatility.framework import constants, exceptions, interfaces, layers -from volatility.framework.configuration import requirements -from volatility.framework.layers import intel, scanners -from volatility.framework.symbols import native -from volatility.framework.symbols.windows.pdbutil import PDBUtility +from volatility3.framework import constants, exceptions, interfaces, layers +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import intel, scanners +from volatility3.framework.symbols import native +from volatility3.framework.symbols.windows.pdbutil import PDBUtility if __name__ == "__main__": import sys @@ -55,7 +55,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): Args: context: The context in which the `requirement` lives config_path: The path within the `context` for the `requirement`'s configuration variables - requirement: The root of the requirement tree to search for :class:~`volatility.framework.interfaces.layers.TranslationLayerRequirement` objects to scan + requirement: The root of the requirement tree to search for :class:~`volatility3.framework.interfaces.layers.TranslationLayerRequirement` objects to scan progress_callback: Means of providing the user with feedback during long processes Returns: @@ -105,7 +105,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): guid = kernel['GUID'], age = kernel['age'], pdb_name = kernel['pdb_name'], - symbol_table_class = "volatility.framework.symbols.windows.WindowsKernelIntermedSymbols", + symbol_table_class = "volatility3.framework.symbols.windows.WindowsKernelIntermedSymbols", config_path = sub_config_path, progress_callback = progress_callback) else: diff --git a/volatility/framework/automagic/stacker.py b/volatility3/framework/automagic/stacker.py similarity index 93% rename from volatility/framework/automagic/stacker.py rename to volatility3/framework/automagic/stacker.py index 1c24384ad..78fbab76c 100644 --- a/volatility/framework/automagic/stacker.py +++ b/volatility3/framework/automagic/stacker.py @@ -3,7 +3,7 @@ # """This module attempts to automatically stack layers. -This automagic module fulfills :class:`~volatility.framework.interfaces.configuration.TranslationLayerRequirement` that are not already fulfilled, by attempting to +This automagic module fulfills :class:`~volatility3.framework.interfaces.configuration.TranslationLayerRequirement` that are not already fulfilled, by attempting to stack as many layers on top of each other as possible. The base/lowest layer is derived from the "automagic.general.single_location" configuration path. Layers are then attempting in likely height order, and once a layer successfully stacks on top of the existing layers, it is removed from the possible choices list @@ -15,11 +15,11 @@ import sys import traceback from typing import Any, List, Optional, Tuple, Type -from volatility import framework -from volatility.framework import interfaces, constants -from volatility.framework.automagic import construct_layers -from volatility.framework.configuration import requirements -from volatility.framework.layers import physical +from volatility3 import framework +from volatility3.framework import interfaces, constants +from volatility3.framework.automagic import construct_layers +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import physical vollog = logging.getLogger(__name__) @@ -28,11 +28,11 @@ class LayerStacker(interfaces.automagic.AutomagicInterface): """Builds up layers in a single stack. This class mimics the volatility 2 style of stacking address spaces. It builds up various layers based on - separate :class:`~volatility.framework.interfaces.automagic.StackerLayerInterface` classes. These classes are + separate :class:`~volatility3.framework.interfaces.automagic.StackerLayerInterface` classes. These classes are built up based on a `stack_order` class variable each has. This has a high priority to provide other automagic modules as complete a context/configuration tree as possible. - Upon completion it will re-call the :class:`~volatility.framework.automagic.construct_layers.ConstructionMagic`, + Upon completion it will re-call the :class:`~volatility3.framework.automagic.construct_layers.ConstructionMagic`, so that any stacked layers are actually constructed and added to the context. """ # Most important automagic, must happen first! @@ -49,7 +49,7 @@ class LayerStacker(interfaces.automagic.AutomagicInterface): progress_callback: constants.ProgressCallback = None) -> Optional[List[str]]: """Runs the automagic over the configurable.""" - framework.import_files(sys.modules['volatility.framework.layers']) + framework.import_files(sys.modules['volatility3.framework.layers']) # Quick exit if we're not needed if not requirement.unsatisfied(context, config_path): @@ -250,7 +250,7 @@ def choose_os_stackers(plugin: Type[interfaces.plugins.PluginInterface]) -> List plugin_first_level = plugin.__module__.split('.')[2] # Ensure all stackers are loaded - framework.import_files(sys.modules['volatility.framework.layers']) + framework.import_files(sys.modules['volatility3.framework.layers']) result = [] for stacker in sorted(framework.class_subclasses(interfaces.automagic.StackerLayerInterface), diff --git a/volatility/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py similarity index 97% rename from volatility/framework/automagic/symbol_cache.py rename to volatility3/framework/automagic/symbol_cache.py index 89d72718f..b2407f8e9 100644 --- a/volatility/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -11,8 +11,8 @@ import urllib.parse import urllib.request from typing import Dict, List, Optional -from volatility.framework import constants, exceptions, interfaces -from volatility.framework.symbols import intermed +from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework.symbols import intermed vollog = logging.getLogger(__name__) diff --git a/volatility/framework/automagic/symbol_finder.py b/volatility3/framework/automagic/symbol_finder.py similarity index 96% rename from volatility/framework/automagic/symbol_finder.py rename to volatility3/framework/automagic/symbol_finder.py index 50844d0fa..f29976769 100644 --- a/volatility/framework/automagic/symbol_finder.py +++ b/volatility3/framework/automagic/symbol_finder.py @@ -5,10 +5,10 @@ import logging from typing import Any, Iterable, List, Tuple, Type, Optional, Callable -from volatility.framework import interfaces, constants, layers, exceptions -from volatility.framework.automagic import symbol_cache -from volatility.framework.configuration import requirements -from volatility.framework.layers import scanners +from volatility3.framework import interfaces, constants, layers, exceptions +from volatility3.framework.automagic import symbol_cache +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import scanners vollog = logging.getLogger(__name__) diff --git a/volatility/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py similarity index 98% rename from volatility/framework/automagic/windows.py rename to volatility3/framework/automagic/windows.py index d55ff8c23..198e64e99 100644 --- a/volatility/framework/automagic/windows.py +++ b/volatility3/framework/automagic/windows.py @@ -30,9 +30,9 @@ import logging import struct from typing import Any, Generator, List, Optional, Tuple, Type -from volatility.framework import interfaces, layers, constants -from volatility.framework.configuration import requirements -from volatility.framework.layers import intel +from volatility3.framework import interfaces, layers, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import intel vollog = logging.getLogger(__name__) @@ -231,7 +231,7 @@ class PageMapScanner(interfaces.layers.ScannerInterface): class WintelHelper(interfaces.automagic.AutomagicInterface): """Windows DTB finder based on self-referential pointers. - This class adheres to the :class:`~volatility.framework.interfaces.automagic.AutomagicInterface` interface + This class adheres to the :class:`~volatility3.framework.interfaces.automagic.AutomagicInterface` interface and both determines the directory table base of an intel layer if one hasn't been specified, and constructs the intel layer if necessary (for example when reconstructing a pre-existing configuration). @@ -414,7 +414,7 @@ class WinSwapLayers(interfaces.automagic.AutomagicInterface): if swap_location: context.config[current_layer_path] = current_layer_name context.config[layer_loc_path] = swap_location - context.config[layer_class_path] = 'volatility.framework.layers.physical.FileLayer' + context.config[layer_class_path] = 'volatility3.framework.layers.physical.FileLayer' # Add the requirement new_req = requirements.TranslationLayerRequirement(name = current_layer_name, diff --git a/volatility/framework/configuration/__init__.py b/volatility3/framework/configuration/__init__.py similarity index 75% rename from volatility/framework/configuration/__init__.py rename to volatility3/framework/configuration/__init__.py index 175dcf295..7a84ee455 100644 --- a/volatility/framework/configuration/__init__.py +++ b/volatility3/framework/configuration/__init__.py @@ -2,4 +2,4 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework.configuration import requirements +from volatility3.framework.configuration import requirements diff --git a/volatility/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py similarity index 99% rename from volatility/framework/configuration/requirements.py rename to volatility3/framework/configuration/requirements.py index 2b5042d43..2a8881ace 100644 --- a/volatility/framework/configuration/requirements.py +++ b/volatility3/framework/configuration/requirements.py @@ -12,7 +12,7 @@ import abc import logging from typing import Any, ClassVar, List, Optional, Type, Dict, Tuple -from volatility.framework import constants, interfaces +from volatility3.framework import constants, interfaces vollog = logging.getLogger(__name__) diff --git a/volatility/framework/constants/__init__.py b/volatility3/framework/constants/__init__.py similarity index 90% rename from volatility/framework/constants/__init__.py rename to volatility3/framework/constants/__init__.py index cc1cf3eec..9e014122b 100644 --- a/volatility/framework/constants/__init__.py +++ b/volatility3/framework/constants/__init__.py @@ -11,20 +11,20 @@ import os.path import sys from typing import Optional, Callable -import volatility.framework.constants.linux -import volatility.framework.constants.windows +import volatility3.framework.constants.linux +import volatility3.framework.constants.windows PLUGINS_PATH = [ os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "plugins")), os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "plugins")) ] -"""Default list of paths to load plugins from (volatility/plugins and volatility/framework/plugins)""" +"""Default list of paths to load plugins from (volatility3/plugins and volatility3/framework/plugins)""" SYMBOL_BASEPATHS = [ os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "symbols")), os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "symbols")) ] -"""Default list of paths to load symbols from (volatility/symbols and volatility/framework/symbols)""" +"""Default list of paths to load symbols from (volatility3/symbols and volatility3/framework/symbols)""" ISF_EXTENSIONS = ['.json', '.json.xz', '.json.gz', '.json.bz2'] """List of accepted extensions for ISF files""" @@ -44,7 +44,7 @@ VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ".".join([str(x) for x in [VERSION_MAJOR, VERSION_MINOR, VERSION_PATCH]]) + VERSION_SUFFIX -"""The canonical version of the volatility package""" +"""The canonical version of the volatility3 package""" AUTOMAGIC_CONFIG_PATH = 'automagic' """The root section within the context configuration for automagic values""" diff --git a/volatility/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py similarity index 100% rename from volatility/framework/constants/linux/__init__.py rename to volatility3/framework/constants/linux/__init__.py diff --git a/volatility/framework/constants/windows/__init__.py b/volatility3/framework/constants/windows/__init__.py similarity index 100% rename from volatility/framework/constants/windows/__init__.py rename to volatility3/framework/constants/windows/__init__.py diff --git a/volatility/framework/contexts/__init__.py b/volatility3/framework/contexts/__init__.py similarity index 97% rename from volatility/framework/contexts/__init__.py rename to volatility3/framework/contexts/__init__.py index ba23847ba..c082a29dd 100644 --- a/volatility/framework/contexts/__init__.py +++ b/volatility3/framework/contexts/__init__.py @@ -12,8 +12,8 @@ import functools import hashlib from typing import Callable, Dict, Iterable, List, Optional, Set, Tuple, Union -from volatility.framework import constants, interfaces, symbols, exceptions -from volatility.framework.objects import templates +from volatility3.framework import constants, interfaces, symbols, exceptions +from volatility3.framework.objects import templates class Context(interfaces.context.ContextInterface): @@ -25,7 +25,7 @@ class Context(interfaces.context.ContextInterface): for creating new objects. Other context objects can be constructed as long as they support the - :class:`~volatility.framework.interfaces.context.ContextInterface`. This is the primary context object to be used + :class:`~volatility3.framework.interfaces.context.ContextInterface`. This is the primary context object to be used in the volatility framework. It maintains the """ @@ -71,7 +71,7 @@ class Context(interfaces.context.ContextInterface): layer: The layer to be added to the memory Raises: - volatility.framework.exceptions.LayerException: if the layer is already present, or has + volatility3.framework.exceptions.LayerException: if the layer is already present, or has unmet dependencies """ self._memory.add_layer(layer) diff --git a/volatility/framework/exceptions.py b/volatility3/framework/exceptions.py similarity index 98% rename from volatility/framework/exceptions.py rename to volatility3/framework/exceptions.py index c92b65af5..117933bbd 100644 --- a/volatility/framework/exceptions.py +++ b/volatility3/framework/exceptions.py @@ -10,7 +10,7 @@ size of the invalid page. """ from typing import Dict, Optional -from volatility.framework import interfaces +from volatility3.framework import interfaces class VolatilityException(Exception): diff --git a/volatility/framework/interfaces/__init__.py b/volatility3/framework/interfaces/__init__.py similarity index 85% rename from volatility/framework/interfaces/__init__.py rename to volatility3/framework/interfaces/__init__.py index 17fd6f011..05cf7d837 100644 --- a/volatility/framework/interfaces/__init__.py +++ b/volatility3/framework/interfaces/__init__.py @@ -12,5 +12,5 @@ components of volatility to write plugins. # Import the submodules we want people to be able to use without importing them themselves # This will also avoid namespace issues, because people can use interfaces.layers to # avoid clashing with the layers package -from volatility.framework.interfaces import renderers, configuration, context, layers, objects, plugins, symbols, \ +from volatility3.framework.interfaces import renderers, configuration, context, layers, objects, plugins, symbols, \ automagic diff --git a/volatility/framework/interfaces/automagic.py b/volatility3/framework/interfaces/automagic.py similarity index 98% rename from volatility/framework/interfaces/automagic.py rename to volatility3/framework/interfaces/automagic.py index ee4dad053..c6eb2e5ce 100644 --- a/volatility/framework/interfaces/automagic.py +++ b/volatility3/framework/interfaces/automagic.py @@ -11,8 +11,8 @@ import logging from abc import ABCMeta from typing import Any, List, Optional, Tuple, Union, Type -from volatility.framework import interfaces, constants -from volatility.framework.configuration import requirements +from volatility3.framework import interfaces, constants +from volatility3.framework.configuration import requirements vollog = logging.getLogger(__name__) diff --git a/volatility/framework/interfaces/configuration.py b/volatility3/framework/interfaces/configuration.py similarity index 98% rename from volatility/framework/interfaces/configuration.py rename to volatility3/framework/interfaces/configuration.py index a52b9984f..418763d6d 100644 --- a/volatility/framework/interfaces/configuration.py +++ b/volatility3/framework/interfaces/configuration.py @@ -25,8 +25,8 @@ import sys from abc import ABCMeta, abstractmethod from typing import Any, ClassVar, Dict, Generator, Iterator, List, Optional, Type, Union, Tuple -from volatility import classproperty -from volatility.framework import constants, interfaces +from volatility3 import classproperty +from volatility3.framework import constants, interfaces CONFIG_SEPARATOR = "." """Use to specify the separator between configuration hierarchies""" @@ -292,10 +292,10 @@ class RequirementInterface(metaclass = ABCMeta): A requirement is a means for plugins and other framework components to request specific configuration data. Requirements can either be simple types (such as - :class:`~volatility.framework.configuration.requirements.SimpleTypeRequirement`, - :class:`~volatility.framework.configuration.requirements.IntRequirement`, - :class:`~volatility.framework.configuration.requirements.BytesRequirement` and - :class:`~volatility.framework.configuration.requirements.StringRequirement`) or complex types (such + :class:`~volatility3.framework.configuration.requirements.SimpleTypeRequirement`, + :class:`~volatility3.framework.configuration.requirements.IntRequirement`, + :class:`~volatility3.framework.configuration.requirements.BytesRequirement` and + :class:`~volatility3.framework.configuration.requirements.StringRequirement`) or complex types (such as :class:`TranslationLayerRequirement`, :class:`SymbolTableRequirement` and :class:`ClassRequirement` """ diff --git a/volatility/framework/interfaces/context.py b/volatility3/framework/interfaces/context.py similarity index 98% rename from volatility/framework/interfaces/context.py rename to volatility3/framework/interfaces/context.py index 0dff023c1..6fede426a 100644 --- a/volatility/framework/interfaces/context.py +++ b/volatility3/framework/interfaces/context.py @@ -15,7 +15,7 @@ import copy from abc import ABCMeta, abstractmethod from typing import Optional, Union -from volatility.framework import interfaces +from volatility3.framework import interfaces class ContextInterface(metaclass = ABCMeta): @@ -39,7 +39,7 @@ class ContextInterface(metaclass = ABCMeta): def symbol_space(self) -> 'interfaces.symbols.SymbolSpaceInterface': """Returns the symbol_space for the context. - This object must support the :class:`~volatility.framework.interfaces.symbols.SymbolSpaceInterface` + This object must support the :class:`~volatility3.framework.interfaces.symbols.SymbolSpaceInterface` """ # ## Memory Functions diff --git a/volatility/framework/interfaces/layers.py b/volatility3/framework/interfaces/layers.py similarity index 99% rename from volatility/framework/interfaces/layers.py rename to volatility3/framework/interfaces/layers.py index 49d6920aa..56426331e 100644 --- a/volatility/framework/interfaces/layers.py +++ b/volatility3/framework/interfaces/layers.py @@ -18,7 +18,7 @@ import types from abc import ABCMeta, abstractmethod from typing import Any, Callable, Dict, Iterable, List, Mapping, Optional, Tuple, Union -from volatility.framework import constants, exceptions, interfaces +from volatility3.framework import constants, exceptions, interfaces vollog = logging.getLogger(__name__) diff --git a/volatility/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py similarity index 99% rename from volatility/framework/interfaces/objects.py rename to volatility3/framework/interfaces/objects.py index 88e6c061f..2f794b565 100644 --- a/volatility/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -9,7 +9,7 @@ import collections.abc import logging from typing import Any, Dict, List, Mapping, Optional -from volatility.framework import constants, interfaces +from volatility3.framework import constants, interfaces vollog = logging.getLogger(__name__) @@ -281,7 +281,7 @@ class Template: @property def vol(self) -> ReadOnlyMapping: """Returns a volatility information object, much like the - :class:`~volatility.framework.interfaces.objects.ObjectInformation` + :class:`~volatility3.framework.interfaces.objects.ObjectInformation` provides.""" return ReadOnlyMapping(self._vol) diff --git a/volatility/framework/interfaces/plugins.py b/volatility3/framework/interfaces/plugins.py similarity index 98% rename from volatility/framework/interfaces/plugins.py rename to volatility3/framework/interfaces/plugins.py index c3fbbf65a..3ab602903 100644 --- a/volatility/framework/interfaces/plugins.py +++ b/volatility3/framework/interfaces/plugins.py @@ -14,8 +14,8 @@ import os from abc import ABCMeta, abstractmethod from typing import List, Tuple, Type -from volatility import framework -from volatility.framework import exceptions, constants, interfaces +from volatility3 import framework +from volatility3.framework import exceptions, constants, interfaces vollog = logging.getLogger(__name__) diff --git a/volatility/framework/interfaces/renderers.py b/volatility3/framework/interfaces/renderers.py similarity index 100% rename from volatility/framework/interfaces/renderers.py rename to volatility3/framework/interfaces/renderers.py diff --git a/volatility/framework/interfaces/symbols.py b/volatility3/framework/interfaces/symbols.py similarity index 98% rename from volatility/framework/interfaces/symbols.py rename to volatility3/framework/interfaces/symbols.py index 77d00337d..8f427d233 100644 --- a/volatility/framework/interfaces/symbols.py +++ b/volatility3/framework/interfaces/symbols.py @@ -7,10 +7,10 @@ import collections.abc from abc import abstractmethod, ABC from typing import Any, Dict, Iterable, List, Optional, Tuple, Type, Mapping -from volatility.framework import constants, exceptions, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import configuration, objects -from volatility.framework.interfaces.configuration import RequirementInterface +from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import configuration, objects +from volatility3.framework.interfaces.configuration import RequirementInterface class SymbolInterface: diff --git a/volatility/framework/layers/__init__.py b/volatility3/framework/layers/__init__.py similarity index 100% rename from volatility/framework/layers/__init__.py rename to volatility3/framework/layers/__init__.py diff --git a/volatility/framework/layers/codecs/__init__.py b/volatility3/framework/layers/codecs/__init__.py similarity index 100% rename from volatility/framework/layers/codecs/__init__.py rename to volatility3/framework/layers/codecs/__init__.py diff --git a/volatility/framework/layers/crash.py b/volatility3/framework/layers/crash.py similarity index 98% rename from volatility/framework/layers/crash.py rename to volatility3/framework/layers/crash.py index 9f239fd13..8909eceb8 100644 --- a/volatility/framework/layers/crash.py +++ b/volatility3/framework/layers/crash.py @@ -6,9 +6,9 @@ import logging import struct from typing import Tuple, Optional -from volatility.framework import constants, exceptions, interfaces -from volatility.framework.layers import segmented -from volatility.framework.symbols import intermed +from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework.layers import segmented +from volatility3.framework.symbols import intermed vollog = logging.getLogger(__name__) diff --git a/volatility/framework/layers/elf.py b/volatility3/framework/layers/elf.py similarity index 95% rename from volatility/framework/layers/elf.py rename to volatility3/framework/layers/elf.py index 022fc4968..48876c286 100644 --- a/volatility/framework/layers/elf.py +++ b/volatility3/framework/layers/elf.py @@ -5,9 +5,9 @@ import logging import struct from typing import Optional -from volatility.framework import exceptions, interfaces, constants -from volatility.framework.layers import segmented -from volatility.framework.symbols import intermed +from volatility3.framework import exceptions, interfaces, constants +from volatility3.framework.layers import segmented +from volatility3.framework.symbols import intermed vollog = logging.getLogger(__name__) diff --git a/volatility/framework/layers/intel.py b/volatility3/framework/layers/intel.py similarity index 98% rename from volatility/framework/layers/intel.py rename to volatility3/framework/layers/intel.py index cdff9ce7e..cf78bbcd1 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -9,10 +9,10 @@ import math import struct from typing import Any, Dict, Iterable, List, Optional, Tuple -from volatility import classproperty -from volatility.framework import exceptions, interfaces, constants -from volatility.framework.configuration import requirements -from volatility.framework.layers import linear +from volatility3 import classproperty +from volatility3.framework import exceptions, interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import linear vollog = logging.getLogger(__name__) diff --git a/volatility/framework/layers/lime.py b/volatility3/framework/layers/lime.py similarity index 96% rename from volatility/framework/layers/lime.py rename to volatility3/framework/layers/lime.py index 45e2ac9dc..ae93f7b7a 100644 --- a/volatility/framework/layers/lime.py +++ b/volatility3/framework/layers/lime.py @@ -5,8 +5,8 @@ import struct from typing import Optional, Tuple -from volatility.framework import exceptions, interfaces, constants -from volatility.framework.layers import segmented +from volatility3.framework import exceptions, interfaces, constants +from volatility3.framework.layers import segmented class LimeFormatException(exceptions.LayerException): diff --git a/volatility/framework/layers/linear.py b/volatility3/framework/layers/linear.py similarity index 98% rename from volatility/framework/layers/linear.py rename to volatility3/framework/layers/linear.py index 84ec081ea..80f71ec35 100644 --- a/volatility/framework/layers/linear.py +++ b/volatility3/framework/layers/linear.py @@ -1,7 +1,7 @@ import functools from typing import List, Optional, Tuple, Iterable -from volatility.framework import exceptions, interfaces +from volatility3.framework import exceptions, interfaces class LinearlyMappedLayer(interfaces.layers.TranslationLayerInterface): diff --git a/volatility/framework/layers/msf.py b/volatility3/framework/layers/msf.py similarity index 97% rename from volatility/framework/layers/msf.py rename to volatility3/framework/layers/msf.py index c030b5354..442ba8728 100644 --- a/volatility/framework/layers/msf.py +++ b/volatility3/framework/layers/msf.py @@ -4,11 +4,11 @@ import math from typing import Optional, Dict, Any, List, Iterable, Tuple -from volatility.framework import interfaces, constants, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import linear -from volatility.framework.objects import utility -from volatility.framework.symbols import intermed +from volatility3.framework import interfaces, constants, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import linear +from volatility3.framework.objects import utility +from volatility3.framework.symbols import intermed class PDBFormatException(exceptions.LayerException): diff --git a/volatility/framework/layers/physical.py b/volatility3/framework/layers/physical.py similarity index 97% rename from volatility/framework/layers/physical.py rename to volatility3/framework/layers/physical.py index a75e08065..7e4e76a6e 100644 --- a/volatility/framework/layers/physical.py +++ b/volatility3/framework/layers/physical.py @@ -4,9 +4,9 @@ import threading from typing import Any, Dict, IO, List, Optional, Union -from volatility.framework import exceptions, interfaces, constants -from volatility.framework.configuration import requirements -from volatility.framework.layers import resources +from volatility3.framework import exceptions, interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import resources class BufferDataLayer(interfaces.layers.DataLayerInterface): diff --git a/volatility/framework/layers/qemu.py b/volatility3/framework/layers/qemu.py similarity index 98% rename from volatility/framework/layers/qemu.py rename to volatility3/framework/layers/qemu.py index d5f926639..8a2621fa8 100644 --- a/volatility/framework/layers/qemu.py +++ b/volatility3/framework/layers/qemu.py @@ -6,9 +6,9 @@ import json import math from typing import Optional, Dict, Any, Tuple, List, Set -from volatility.framework import interfaces, exceptions, constants -from volatility.framework.layers import segmented -from volatility.framework.symbols import intermed +from volatility3.framework import interfaces, exceptions, constants +from volatility3.framework.layers import segmented +from volatility3.framework.symbols import intermed class QemuSuspendLayer(segmented.NonLinearlySegmentedLayer): diff --git a/volatility/framework/layers/registry.py b/volatility3/framework/layers/registry.py similarity index 96% rename from volatility/framework/layers/registry.py rename to volatility3/framework/layers/registry.py index 82128b4f4..32acbc4a9 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -5,13 +5,13 @@ import logging from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple, Union -from volatility.framework import constants, exceptions, interfaces, objects -from volatility.framework.configuration import requirements -from volatility.framework.configuration.requirements import IntRequirement, TranslationLayerRequirement -from volatility.framework.exceptions import InvalidAddressException -from volatility.framework.layers import linear -from volatility.framework.symbols import intermed -from volatility.plugins.windows import pslist +from volatility3.framework import constants, exceptions, interfaces, objects +from volatility3.framework.configuration import requirements +from volatility3.framework.configuration.requirements import IntRequirement, TranslationLayerRequirement +from volatility3.framework.exceptions import InvalidAddressException +from volatility3.framework.layers import linear +from volatility3.framework.symbols import intermed +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/layers/resources.py b/volatility3/framework/layers/resources.py similarity index 99% rename from volatility/framework/layers/resources.py rename to volatility3/framework/layers/resources.py index 1a2402008..d99f7135c 100644 --- a/volatility/framework/layers/resources.py +++ b/volatility3/framework/layers/resources.py @@ -16,8 +16,8 @@ import zipfile from typing import Optional, Any, IO from urllib import error -from volatility import framework -from volatility.framework import constants +from volatility3 import framework +from volatility3.framework import constants try: import magic diff --git a/volatility/framework/layers/scanners/__init__.py b/volatility3/framework/layers/scanners/__init__.py similarity index 94% rename from volatility/framework/layers/scanners/__init__.py rename to volatility3/framework/layers/scanners/__init__.py index 45208161d..3b57d32e4 100644 --- a/volatility/framework/layers/scanners/__init__.py +++ b/volatility3/framework/layers/scanners/__init__.py @@ -5,8 +5,8 @@ import re from typing import Generator, List, Tuple -from volatility.framework.interfaces import layers -from volatility.framework.layers.scanners import multiregexp +from volatility3.framework.interfaces import layers +from volatility3.framework.layers.scanners import multiregexp class BytesScanner(layers.ScannerInterface): diff --git a/volatility/framework/layers/scanners/multiregexp.py b/volatility3/framework/layers/scanners/multiregexp.py similarity index 100% rename from volatility/framework/layers/scanners/multiregexp.py rename to volatility3/framework/layers/scanners/multiregexp.py diff --git a/volatility/framework/layers/segmented.py b/volatility3/framework/layers/segmented.py similarity index 97% rename from volatility/framework/layers/segmented.py rename to volatility3/framework/layers/segmented.py index d2f80ec32..8334c722d 100644 --- a/volatility/framework/layers/segmented.py +++ b/volatility3/framework/layers/segmented.py @@ -5,9 +5,9 @@ from abc import ABCMeta, abstractmethod from bisect import bisect_right from typing import Any, Dict, Iterable, List, Optional, Tuple -from volatility.framework import exceptions, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.layers import linear +from volatility3.framework import exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import linear class NonLinearlySegmentedLayer(interfaces.layers.TranslationLayerInterface, metaclass = ABCMeta): diff --git a/volatility/framework/layers/vmware.py b/volatility3/framework/layers/vmware.py similarity index 96% rename from volatility/framework/layers/vmware.py rename to volatility3/framework/layers/vmware.py index fc412fb2e..e0d6b172d 100644 --- a/volatility/framework/layers/vmware.py +++ b/volatility3/framework/layers/vmware.py @@ -5,10 +5,10 @@ import struct from typing import Any, Dict, List, Optional -from volatility.framework import interfaces, constants, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import physical, segmented, resources -from volatility.framework.symbols import native +from volatility3.framework import interfaces, constants, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import physical, segmented, resources +from volatility3.framework.symbols import native class VmwareFormatException(exceptions.LayerException): diff --git a/volatility/framework/objects/__init__.py b/volatility3/framework/objects/__init__.py similarity index 99% rename from volatility/framework/objects/__init__.py rename to volatility3/framework/objects/__init__.py index 30bbcbe74..6504b1259 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility3/framework/objects/__init__.py @@ -7,8 +7,8 @@ import logging import struct from typing import Any, ClassVar, Dict, List, Iterable, Optional, Tuple, Type, Union as TUnion, overload -from volatility.framework import interfaces, constants -from volatility.framework.objects import templates, utility +from volatility3.framework import interfaces, constants +from volatility3.framework.objects import templates, utility vollog = logging.getLogger(__name__) diff --git a/volatility/framework/objects/templates.py b/volatility3/framework/objects/templates.py similarity index 91% rename from volatility/framework/objects/templates.py rename to volatility3/framework/objects/templates.py index c19bc07e7..05938ff9c 100644 --- a/volatility/framework/objects/templates.py +++ b/volatility3/framework/objects/templates.py @@ -5,7 +5,7 @@ import functools import logging from typing import Any, ClassVar, Dict, List, Type -from volatility.framework import interfaces, exceptions, constants +from volatility3.framework import interfaces, exceptions, constants vollog = logging.getLogger(__name__) @@ -44,13 +44,13 @@ class ObjectTemplate(interfaces.objects.Template): def relative_child_offset(self, child: str) -> int: """Returns the relative offset of a child of the templated object (see - :class:`~volatility.framework.interfaces.objects.ObjectInterface.VolTem + :class:`~volatility3.framework.interfaces.objects.ObjectInterface.VolTem plateProxy`)""" return self.vol.object_class.VolTemplateProxy.relative_child_offset(self, child) def replace_child(self, old_child: interfaces.objects.Template, new_child: interfaces.objects.Template) -> None: """Replaces `old_child` for `new_child` in the templated object's child - list (see :class:`~volatility.framework.interfaces.objects.ObjectInterf + list (see :class:`~volatility3.framework.interfaces.objects.ObjectInterf ace.VolTemplateProxy`)""" return self.vol.object_class.VolTemplateProxy.replace_child(self, old_child, new_child) @@ -63,7 +63,7 @@ class ObjectTemplate(interfaces.objects.Template): object_info: interfaces.objects.ObjectInformation) -> interfaces.objects.ObjectInterface: """Constructs the object. - Returns: an object adhereing to the :class:`~volatility.framework.interfaces.objects.ObjectInterface` + Returns: an object adhereing to the :class:`~volatility3.framework.interfaces.objects.ObjectInterface` """ arguments = {} # type: Dict[str, Any] for arg in self.vol: @@ -76,7 +76,7 @@ class ReferenceTemplate(interfaces.objects.Template): """Factory class that produces objects based on a delayed reference type. Attempts to access any standard attributes of a resolved template will result in a - :class:`~volatility.framework.exceptions.SymbolError`. + :class:`~volatility3.framework.exceptions.SymbolError`. """ @property diff --git a/volatility/framework/objects/utility.py b/volatility3/framework/objects/utility.py similarity index 97% rename from volatility/framework/objects/utility.py rename to volatility3/framework/objects/utility.py index e3795aa78..9c4b59575 100644 --- a/volatility/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -4,7 +4,7 @@ from typing import Optional, Union -from volatility.framework import interfaces, objects, constants +from volatility3.framework import interfaces, objects, constants def array_to_string(array: 'objects.Array', diff --git a/volatility/framework/plugins/__init__.py b/volatility3/framework/plugins/__init__.py similarity index 93% rename from volatility/framework/plugins/__init__.py rename to volatility3/framework/plugins/__init__.py index b00b4ea47..aa9701a4c 100644 --- a/volatility/framework/plugins/__init__.py +++ b/volatility3/framework/plugins/__init__.py @@ -3,14 +3,14 @@ # """All core generic plugins. -These modules should only be imported from volatility.plugins NOT -volatility.framework.plugins +These modules should only be imported from volatility3.plugins NOT +volatility3.framework.plugins """ import logging from typing import List, Type -from volatility.framework import interfaces, automagic, exceptions, constants +from volatility3.framework import interfaces, automagic, exceptions, constants vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/banners.py b/volatility3/framework/plugins/banners.py similarity index 89% rename from volatility/framework/plugins/banners.py rename to volatility3/framework/plugins/banners.py index b7b439aa8..ac2006207 100644 --- a/volatility/framework/plugins/banners.py +++ b/volatility3/framework/plugins/banners.py @@ -4,10 +4,10 @@ import logging from typing import List -from volatility.framework import interfaces, renderers, layers -from volatility.framework.configuration import requirements -from volatility.framework.layers import scanners -from volatility.framework.renderers import format_hints +from volatility3.framework import interfaces, renderers, layers +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import scanners +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/configwriter.py b/volatility3/framework/plugins/configwriter.py similarity index 92% rename from volatility/framework/plugins/configwriter.py rename to volatility3/framework/plugins/configwriter.py index 3d44edfe5..3c2da6ce3 100644 --- a/volatility/framework/plugins/configwriter.py +++ b/volatility3/framework/plugins/configwriter.py @@ -6,9 +6,9 @@ import json import logging from typing import List -from volatility.framework import renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins +from volatility3.framework import renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/frameworkinfo.py b/volatility3/framework/plugins/frameworkinfo.py similarity index 88% rename from volatility/framework/plugins/frameworkinfo.py rename to volatility3/framework/plugins/frameworkinfo.py index 52e85d0a2..b7c887d5c 100644 --- a/volatility/framework/plugins/frameworkinfo.py +++ b/volatility3/framework/plugins/frameworkinfo.py @@ -1,8 +1,8 @@ from typing import List -from volatility import framework -from volatility.framework import interfaces, renderers -from volatility.framework.interfaces import plugins +from volatility3 import framework +from volatility3.framework import interfaces, renderers +from volatility3.framework.interfaces import plugins class FrameworkInfo(plugins.PluginInterface): diff --git a/volatility/framework/plugins/isfinfo.py b/volatility3/framework/plugins/isfinfo.py similarity index 94% rename from volatility/framework/plugins/isfinfo.py rename to volatility3/framework/plugins/isfinfo.py index 41cecc1e9..929c95cdf 100644 --- a/volatility/framework/plugins/isfinfo.py +++ b/volatility3/framework/plugins/isfinfo.py @@ -9,12 +9,12 @@ import pathlib import zipfile from typing import List, Type, Any, Generator -from volatility import schemas, symbols -from volatility.framework import interfaces, renderers, constants -from volatility.framework.automagic import mac, linux, symbol_cache -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.layers import resources +from volatility3 import schemas, symbols +from volatility3.framework import interfaces, renderers, constants +from volatility3.framework.automagic import mac, linux, symbol_cache +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.layers import resources vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/layerwriter.py b/volatility3/framework/plugins/layerwriter.py similarity index 96% rename from volatility/framework/plugins/layerwriter.py rename to volatility3/framework/plugins/layerwriter.py index 5b4492c6c..53f07701f 100644 --- a/volatility/framework/plugins/layerwriter.py +++ b/volatility3/framework/plugins/layerwriter.py @@ -5,9 +5,9 @@ import logging from typing import List, Optional, Type -from volatility.framework import renderers, interfaces, constants, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins +from volatility3.framework import renderers, interfaces, constants, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/linux/__init__.py b/volatility3/framework/plugins/linux/__init__.py similarity index 69% rename from volatility/framework/plugins/linux/__init__.py rename to volatility3/framework/plugins/linux/__init__.py index 24e0d3c1e..3932a6f51 100644 --- a/volatility/framework/plugins/linux/__init__.py +++ b/volatility3/framework/plugins/linux/__init__.py @@ -3,6 +3,6 @@ # """All core linux plugins. -These modules should only be imported from volatility.plugins NOT -volatility.framework.plugins +These modules should only be imported from volatility3.plugins NOT +volatility3.framework.plugins """ diff --git a/volatility/framework/plugins/linux/bash.py b/volatility3/framework/plugins/linux/bash.py similarity index 91% rename from volatility/framework/plugins/linux/bash.py rename to volatility3/framework/plugins/linux/bash.py index 82fdd90dc..9d43a59d3 100644 --- a/volatility/framework/plugins/linux/bash.py +++ b/volatility3/framework/plugins/linux/bash.py @@ -8,14 +8,14 @@ import datetime import struct from typing import List -from volatility.framework import constants, renderers, symbols, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.layers import scanners -from volatility.framework.objects import utility -from volatility.framework.symbols.linux.bash import BashIntermedSymbols -from volatility.plugins import timeliner -from volatility.plugins.linux import pslist +from volatility3.framework import constants, renderers, symbols, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.layers import scanners +from volatility3.framework.objects import utility +from volatility3.framework.symbols.linux.bash import BashIntermedSymbols +from volatility3.plugins import timeliner +from volatility3.plugins.linux import pslist class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): diff --git a/volatility/framework/plugins/linux/check_afinfo.py b/volatility3/framework/plugins/linux/check_afinfo.py similarity index 92% rename from volatility/framework/plugins/linux/check_afinfo.py rename to volatility3/framework/plugins/linux/check_afinfo.py index c3361b966..1b38fe9be 100644 --- a/volatility/framework/plugins/linux/check_afinfo.py +++ b/volatility3/framework/plugins/linux/check_afinfo.py @@ -6,11 +6,11 @@ found in Linux's /proc file system.""" import logging from typing import List -from volatility.framework import exceptions, interfaces, contexts -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints +from volatility3.framework import exceptions, interfaces, contexts +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/linux/check_creds.py b/volatility3/framework/plugins/linux/check_creds.py similarity index 92% rename from volatility/framework/plugins/linux/check_creds.py rename to volatility3/framework/plugins/linux/check_creds.py index 7d68bf644..0d87bce2a 100644 --- a/volatility/framework/plugins/linux/check_creds.py +++ b/volatility3/framework/plugins/linux/check_creds.py @@ -4,9 +4,9 @@ import logging -from volatility.framework import interfaces, renderers, constants -from volatility.framework.configuration import requirements -from volatility.plugins.linux import pslist +from volatility3.framework import interfaces, renderers, constants +from volatility3.framework.configuration import requirements +from volatility3.plugins.linux import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/linux/check_idt.py b/volatility3/framework/plugins/linux/check_idt.py similarity index 92% rename from volatility/framework/plugins/linux/check_idt.py rename to volatility3/framework/plugins/linux/check_idt.py index 4da33e8d8..0e021bb5c 100644 --- a/volatility/framework/plugins/linux/check_idt.py +++ b/volatility3/framework/plugins/linux/check_idt.py @@ -5,11 +5,11 @@ import logging from typing import List -from volatility.framework import interfaces, renderers, contexts, symbols -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import linux -from volatility.plugins.linux import lsmod +from volatility3.framework import interfaces, renderers, contexts, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import linux +from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py similarity index 88% rename from volatility/framework/plugins/linux/check_modules.py rename to volatility3/framework/plugins/linux/check_modules.py index 470ce0a2f..bdd8d921d 100644 --- a/volatility/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -5,12 +5,12 @@ import logging from typing import List -from volatility.framework import interfaces, renderers, exceptions, constants, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.linux import lsmod +from volatility3.framework import interfaces, renderers, exceptions, constants, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/linux/check_syscall.py b/volatility3/framework/plugins/linux/check_syscall.py similarity index 95% rename from volatility/framework/plugins/linux/check_syscall.py rename to volatility3/framework/plugins/linux/check_syscall.py index 30843077a..4a4381b8b 100644 --- a/volatility/framework/plugins/linux/check_syscall.py +++ b/volatility3/framework/plugins/linux/check_syscall.py @@ -6,11 +6,11 @@ found in Linux's /proc file system.""" import logging from typing import List -from volatility.framework import exceptions, interfaces, contexts -from volatility.framework import renderers, constants -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints +from volatility3.framework import exceptions, interfaces, contexts +from volatility3.framework import renderers, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/linux/elfs.py b/volatility3/framework/plugins/linux/elfs.py similarity index 89% rename from volatility/framework/plugins/linux/elfs.py rename to volatility3/framework/plugins/linux/elfs.py index da9281ec3..ac8b9fbfb 100644 --- a/volatility/framework/plugins/linux/elfs.py +++ b/volatility3/framework/plugins/linux/elfs.py @@ -6,12 +6,12 @@ found in Linux's /proc file system.""" from typing import List -from volatility.framework import renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.linux import pslist +from volatility3.framework import renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.linux import pslist class Elfs(plugins.PluginInterface): diff --git a/volatility/framework/plugins/linux/keyboard_notifiers.py b/volatility3/framework/plugins/linux/keyboard_notifiers.py similarity index 90% rename from volatility/framework/plugins/linux/keyboard_notifiers.py rename to volatility3/framework/plugins/linux/keyboard_notifiers.py index 7580b368b..cd7a70b34 100644 --- a/volatility/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility3/framework/plugins/linux/keyboard_notifiers.py @@ -4,11 +4,11 @@ import logging -from volatility.framework import interfaces, renderers, contexts, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import linux -from volatility.plugins.linux import lsmod +from volatility3.framework import interfaces, renderers, contexts, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import linux +from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py similarity index 89% rename from volatility/framework/plugins/linux/lsmod.py rename to volatility3/framework/plugins/linux/lsmod.py index ada3002a4..d75a9dff4 100644 --- a/volatility/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -7,12 +7,12 @@ found in Linux's /proc file system.""" import logging from typing import List, Iterable -from volatility.framework import contexts -from volatility.framework import exceptions, renderers, constants, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints +from volatility3.framework import contexts +from volatility3.framework import exceptions, renderers, constants, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/linux/lsof.py b/volatility3/framework/plugins/linux/lsof.py similarity index 89% rename from volatility/framework/plugins/linux/lsof.py rename to volatility3/framework/plugins/linux/lsof.py index 1ea348b19..b9a686a44 100644 --- a/volatility/framework/plugins/linux/lsof.py +++ b/volatility3/framework/plugins/linux/lsof.py @@ -6,12 +6,12 @@ found in Linux's /proc file system.""" import logging from typing import List -from volatility.framework import renderers, interfaces, constants -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.symbols import linux -from volatility.plugins.linux import pslist +from volatility3.framework import renderers, interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.symbols import linux +from volatility3.plugins.linux import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py similarity index 91% rename from volatility/framework/plugins/linux/malfind.py rename to volatility3/framework/plugins/linux/malfind.py index 0da89025f..41339cca2 100644 --- a/volatility/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -4,12 +4,12 @@ from typing import List -from volatility.framework import constants, interfaces -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.linux import pslist +from volatility3.framework import constants, interfaces +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.linux import pslist class Malfind(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/linux/proc.py b/volatility3/framework/plugins/linux/proc.py similarity index 91% rename from volatility/framework/plugins/linux/proc.py rename to volatility3/framework/plugins/linux/proc.py index 6b73f2352..53e9297de 100644 --- a/volatility/framework/plugins/linux/proc.py +++ b/volatility3/framework/plugins/linux/proc.py @@ -4,12 +4,12 @@ """A module containing a collection of plugins that produce data typically found in Linux's /proc file system.""" -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.linux import pslist +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.linux import pslist class Maps(plugins.PluginInterface): diff --git a/volatility/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py similarity index 95% rename from volatility/framework/plugins/linux/pslist.py rename to volatility3/framework/plugins/linux/pslist.py index 8a60d58c4..4c6d294e1 100644 --- a/volatility/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -4,9 +4,9 @@ from typing import Callable, Iterable, List, Any -from volatility.framework import renderers, interfaces, contexts -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility +from volatility3.framework import renderers, interfaces, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility class PsList(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/linux/pstree.py b/volatility3/framework/plugins/linux/pstree.py similarity index 95% rename from volatility/framework/plugins/linux/pstree.py rename to volatility3/framework/plugins/linux/pstree.py index c1e832950..ff47be760 100644 --- a/volatility/framework/plugins/linux/pstree.py +++ b/volatility3/framework/plugins/linux/pstree.py @@ -2,8 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework.objects import utility -from volatility.plugins.linux import pslist +from volatility3.framework.objects import utility +from volatility3.plugins.linux import pslist class PsTree(pslist.PsList): diff --git a/volatility/framework/plugins/linux/tty_check.py b/volatility3/framework/plugins/linux/tty_check.py similarity index 88% rename from volatility/framework/plugins/linux/tty_check.py rename to volatility3/framework/plugins/linux/tty_check.py index 90959d6a2..3693b6150 100644 --- a/volatility/framework/plugins/linux/tty_check.py +++ b/volatility3/framework/plugins/linux/tty_check.py @@ -5,13 +5,13 @@ import logging from typing import List -from volatility.framework import interfaces, renderers, exceptions, constants, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import linux -from volatility.plugins.linux import lsmod +from volatility3.framework import interfaces, renderers, exceptions, constants, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import linux +from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/__init__.py b/volatility3/framework/plugins/mac/__init__.py similarity index 100% rename from volatility/framework/plugins/mac/__init__.py rename to volatility3/framework/plugins/mac/__init__.py diff --git a/volatility/framework/plugins/mac/bash.py b/volatility3/framework/plugins/mac/bash.py similarity index 92% rename from volatility/framework/plugins/mac/bash.py rename to volatility3/framework/plugins/mac/bash.py index 9c923d33c..3540db6fb 100644 --- a/volatility/framework/plugins/mac/bash.py +++ b/volatility3/framework/plugins/mac/bash.py @@ -7,14 +7,14 @@ found in mac's /proc file system.""" import datetime import struct -from volatility.framework import constants, renderers, symbols -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.layers import scanners -from volatility.framework.objects import utility -from volatility.framework.symbols.linux.bash import BashIntermedSymbols -from volatility.plugins import timeliner -from volatility.plugins.mac import pslist +from volatility3.framework import constants, renderers, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.layers import scanners +from volatility3.framework.objects import utility +from volatility3.framework.symbols.linux.bash import BashIntermedSymbols +from volatility3.plugins import timeliner +from volatility3.plugins.mac import pslist class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): diff --git a/volatility/framework/plugins/mac/check_syscall.py b/volatility3/framework/plugins/mac/check_syscall.py similarity index 87% rename from volatility/framework/plugins/mac/check_syscall.py rename to volatility3/framework/plugins/mac/check_syscall.py index f1e0dc5d1..530e2f031 100644 --- a/volatility/framework/plugins/mac/check_syscall.py +++ b/volatility3/framework/plugins/mac/check_syscall.py @@ -4,13 +4,13 @@ import logging from typing import List -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/check_sysctl.py b/volatility3/framework/plugins/mac/check_sysctl.py similarity index 90% rename from volatility/framework/plugins/mac/check_sysctl.py rename to volatility3/framework/plugins/mac/check_sysctl.py index 5923430bb..2096b291a 100644 --- a/volatility/framework/plugins/mac/check_sysctl.py +++ b/volatility3/framework/plugins/mac/check_sysctl.py @@ -4,15 +4,15 @@ import logging from typing import List -import volatility -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +import volatility3 +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) @@ -55,7 +55,7 @@ class Check_sysctl(plugins.PluginInterface): return var_str def _process_sysctl_list(self, kernel, sysctl_list, recursive = 0): - if type(sysctl_list) == volatility.framework.objects.Pointer: + if type(sysctl_list) == volatility3.framework.objects.Pointer: sysctl_list = sysctl_list.dereference().cast("sysctl_oid_list") sysctl = sysctl_list.slh_first diff --git a/volatility/framework/plugins/mac/check_trap_table.py b/volatility3/framework/plugins/mac/check_trap_table.py similarity index 86% rename from volatility/framework/plugins/mac/check_trap_table.py rename to volatility3/framework/plugins/mac/check_trap_table.py index 99b509f40..b2861d5d5 100644 --- a/volatility/framework/plugins/mac/check_trap_table.py +++ b/volatility3/framework/plugins/mac/check_trap_table.py @@ -5,13 +5,13 @@ import logging from typing import List -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/ifconfig.py b/volatility3/framework/plugins/mac/ifconfig.py similarity index 88% rename from volatility/framework/plugins/mac/ifconfig.py rename to volatility3/framework/plugins/mac/ifconfig.py index 8bcfe7377..501ba8a56 100644 --- a/volatility/framework/plugins/mac/ifconfig.py +++ b/volatility3/framework/plugins/mac/ifconfig.py @@ -1,11 +1,11 @@ # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import exceptions, renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.symbols import mac +from volatility3.framework import exceptions, renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.symbols import mac class Ifconfig(plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/kauth_listeners.py b/volatility3/framework/plugins/mac/kauth_listeners.py similarity index 88% rename from volatility/framework/plugins/mac/kauth_listeners.py rename to volatility3/framework/plugins/mac/kauth_listeners.py index ec784f585..f4bbeaa4c 100644 --- a/volatility/framework/plugins/mac/kauth_listeners.py +++ b/volatility3/framework/plugins/mac/kauth_listeners.py @@ -2,12 +2,12 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import renderers, interfaces, contexts -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod, kauth_scopes +from volatility3.framework import renderers, interfaces, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod, kauth_scopes class Kauth_listeners(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/kauth_scopes.py b/volatility3/framework/plugins/mac/kauth_scopes.py similarity index 90% rename from volatility/framework/plugins/mac/kauth_scopes.py rename to volatility3/framework/plugins/mac/kauth_scopes.py index 9a9db6909..d63c72322 100644 --- a/volatility/framework/plugins/mac/kauth_scopes.py +++ b/volatility3/framework/plugins/mac/kauth_scopes.py @@ -4,12 +4,12 @@ from typing import Iterable, Callable, Tuple -from volatility.framework import renderers, interfaces, contexts -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +from volatility3.framework import renderers, interfaces, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod class Kauth_scopes(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/kevents.py b/volatility3/framework/plugins/mac/kevents.py similarity index 95% rename from volatility/framework/plugins/mac/kevents.py rename to volatility3/framework/plugins/mac/kevents.py index b3826ccfd..45bb29305 100644 --- a/volatility/framework/plugins/mac/kevents.py +++ b/volatility3/framework/plugins/mac/kevents.py @@ -4,11 +4,11 @@ from typing import Iterable, Callable, Tuple -from volatility.framework import renderers, interfaces, exceptions, contexts -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.symbols import mac -from volatility.plugins.mac import pslist +from volatility3.framework import renderers, interfaces, exceptions, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import pslist class Kevents(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/list_files.py b/volatility3/framework/plugins/mac/list_files.py similarity index 93% rename from volatility/framework/plugins/mac/list_files.py rename to volatility3/framework/plugins/mac/list_files.py index a1a062113..e9901c478 100644 --- a/volatility/framework/plugins/mac/list_files.py +++ b/volatility3/framework/plugins/mac/list_files.py @@ -4,13 +4,13 @@ import logging from typing import Iterable, Optional -from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import mount +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import mount vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/lsmod.py b/volatility3/framework/plugins/mac/lsmod.py similarity index 88% rename from volatility/framework/plugins/mac/lsmod.py rename to volatility3/framework/plugins/mac/lsmod.py index 129dbda9a..81639115d 100644 --- a/volatility/framework/plugins/mac/lsmod.py +++ b/volatility3/framework/plugins/mac/lsmod.py @@ -3,11 +3,11 @@ # """A module containing a collection of plugins that produce data typically found in Mac's lsmod command.""" -from volatility.framework import renderers, interfaces, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints +from volatility3.framework import renderers, interfaces, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints class Lsmod(plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/lsof.py b/volatility3/framework/plugins/mac/lsof.py similarity index 90% rename from volatility/framework/plugins/mac/lsof.py rename to volatility3/framework/plugins/mac/lsof.py index 0307b2217..38351009a 100644 --- a/volatility/framework/plugins/mac/lsof.py +++ b/volatility3/framework/plugins/mac/lsof.py @@ -4,11 +4,11 @@ import logging -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.symbols import mac -from volatility.plugins.mac import pslist +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/malfind.py b/volatility3/framework/plugins/mac/malfind.py similarity index 90% rename from volatility/framework/plugins/mac/malfind.py rename to volatility3/framework/plugins/mac/malfind.py index 3a920a8a5..64d7b5010 100644 --- a/volatility/framework/plugins/mac/malfind.py +++ b/volatility3/framework/plugins/mac/malfind.py @@ -2,13 +2,13 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import constants -from volatility.framework import interfaces -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.mac import pslist +from volatility3.framework import constants +from volatility3.framework import interfaces +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.mac import pslist class Malfind(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/mount.py b/volatility3/framework/plugins/mac/mount.py similarity index 89% rename from volatility/framework/plugins/mac/mount.py rename to volatility3/framework/plugins/mac/mount.py index 55193fac4..57ea9e5b6 100644 --- a/volatility/framework/plugins/mac/mount.py +++ b/volatility3/framework/plugins/mac/mount.py @@ -3,11 +3,11 @@ # """A module containing a collection of plugins that produce data typically found in Mac's mount command.""" -from volatility.framework import renderers, interfaces, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.symbols import mac +from volatility3.framework import renderers, interfaces, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.symbols import mac class Mount(plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/netstat.py b/volatility3/framework/plugins/mac/netstat.py similarity index 92% rename from volatility/framework/plugins/mac/netstat.py rename to volatility3/framework/plugins/mac/netstat.py index dc3c03297..3e04d5899 100644 --- a/volatility/framework/plugins/mac/netstat.py +++ b/volatility3/framework/plugins/mac/netstat.py @@ -5,13 +5,13 @@ import logging from typing import Iterable, Callable, Tuple -from volatility.framework import exceptions, renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import pslist +from volatility3.framework import exceptions, renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/proc_maps.py b/volatility3/framework/plugins/mac/proc_maps.py similarity index 90% rename from volatility/framework/plugins/mac/proc_maps.py rename to volatility3/framework/plugins/mac/proc_maps.py index 57a8d0215..3a0bef5ba 100644 --- a/volatility/framework/plugins/mac/proc_maps.py +++ b/volatility3/framework/plugins/mac/proc_maps.py @@ -2,11 +2,11 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.mac import pslist +from volatility3.framework import renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.mac import pslist class Maps(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/psaux.py b/volatility3/framework/plugins/mac/psaux.py similarity index 93% rename from volatility/framework/plugins/mac/psaux.py rename to volatility3/framework/plugins/mac/psaux.py index 2dca44da4..1bb720575 100644 --- a/volatility/framework/plugins/mac/psaux.py +++ b/volatility3/framework/plugins/mac/psaux.py @@ -4,11 +4,11 @@ """In-memory artifacts from OSX systems.""" from typing import Iterator, Tuple, Any, Generator, List -from volatility.framework import exceptions, renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.plugins.mac import pslist +from volatility3.framework import exceptions, renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.plugins.mac import pslist class Psaux(plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/pslist.py b/volatility3/framework/plugins/mac/pslist.py similarity index 98% rename from volatility/framework/plugins/mac/pslist.py rename to volatility3/framework/plugins/mac/pslist.py index 23fba1ac7..c9253e093 100644 --- a/volatility/framework/plugins/mac/pslist.py +++ b/volatility3/framework/plugins/mac/pslist.py @@ -5,10 +5,10 @@ import logging from typing import Callable, Iterable, List, Dict -from volatility.framework import renderers, interfaces, contexts, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.symbols import mac +from volatility3.framework import renderers, interfaces, contexts, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.symbols import mac vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/pstree.py b/volatility3/framework/plugins/mac/pstree.py similarity index 91% rename from volatility/framework/plugins/mac/pstree.py rename to volatility3/framework/plugins/mac/pstree.py index 7fda089f7..e499aa300 100644 --- a/volatility/framework/plugins/mac/pstree.py +++ b/volatility3/framework/plugins/mac/pstree.py @@ -2,11 +2,11 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.plugins.mac import pslist +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.plugins.mac import pslist class PsTree(plugins.PluginInterface): diff --git a/volatility/framework/plugins/mac/socket_filters.py b/volatility3/framework/plugins/mac/socket_filters.py similarity index 88% rename from volatility/framework/plugins/mac/socket_filters.py rename to volatility3/framework/plugins/mac/socket_filters.py index 800eb134d..b2bcba759 100644 --- a/volatility/framework/plugins/mac/socket_filters.py +++ b/volatility3/framework/plugins/mac/socket_filters.py @@ -4,14 +4,14 @@ import logging from typing import List -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/timers.py b/volatility3/framework/plugins/mac/timers.py similarity index 90% rename from volatility/framework/plugins/mac/timers.py rename to volatility3/framework/plugins/mac/timers.py index 94502d800..3169b2aeb 100644 --- a/volatility/framework/plugins/mac/timers.py +++ b/volatility3/framework/plugins/mac/timers.py @@ -4,13 +4,13 @@ import logging from typing import List -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/trustedbsd.py b/volatility3/framework/plugins/mac/trustedbsd.py similarity index 88% rename from volatility/framework/plugins/mac/trustedbsd.py rename to volatility3/framework/plugins/mac/trustedbsd.py index 73a313af4..d515959fb 100644 --- a/volatility/framework/plugins/mac/trustedbsd.py +++ b/volatility3/framework/plugins/mac/trustedbsd.py @@ -5,14 +5,14 @@ import logging from typing import List, Iterator, Any -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers, contexts -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import mac -from volatility.plugins.mac import lsmod +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import mac +from volatility3.plugins.mac import lsmod vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/vfsevents.py b/volatility3/framework/plugins/mac/vfsevents.py similarity index 92% rename from volatility/framework/plugins/mac/vfsevents.py rename to volatility3/framework/plugins/mac/vfsevents.py index 84d3adc51..9d4db7b97 100644 --- a/volatility/framework/plugins/mac/vfsevents.py +++ b/volatility3/framework/plugins/mac/vfsevents.py @@ -2,9 +2,9 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import renderers, interfaces, exceptions, contexts -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility +from volatility3.framework import renderers, interfaces, exceptions, contexts +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility class VFSevents(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/timeliner.py b/volatility3/framework/plugins/timeliner.py similarity index 98% rename from volatility/framework/plugins/timeliner.py rename to volatility3/framework/plugins/timeliner.py index 40148800d..2ec4d6961 100644 --- a/volatility/framework/plugins/timeliner.py +++ b/volatility3/framework/plugins/timeliner.py @@ -11,9 +11,9 @@ import logging import traceback from typing import Generator, Iterable, List, Optional, Tuple, Type -from volatility import framework -from volatility.framework import renderers, automagic, interfaces, plugins, exceptions -from volatility.framework.configuration import requirements +from volatility3 import framework +from volatility3.framework import renderers, automagic, interfaces, plugins, exceptions +from volatility3.framework.configuration import requirements vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/__init__.py b/volatility3/framework/plugins/windows/__init__.py similarity index 69% rename from volatility/framework/plugins/windows/__init__.py rename to volatility3/framework/plugins/windows/__init__.py index e7f81d48d..87a986e48 100644 --- a/volatility/framework/plugins/windows/__init__.py +++ b/volatility3/framework/plugins/windows/__init__.py @@ -3,6 +3,6 @@ # """All core windows plugins. -These modules should only be imported from volatility.plugins NOT -volatility.framework.plugins +These modules should only be imported from volatility3.plugins NOT +volatility3.framework.plugins """ diff --git a/volatility/framework/plugins/windows/bigpools.py b/volatility3/framework/plugins/windows/bigpools.py similarity index 92% rename from volatility/framework/plugins/windows/bigpools.py rename to volatility3/framework/plugins/windows/bigpools.py index 434d88df3..12d4d1f28 100644 --- a/volatility/framework/plugins/windows/bigpools.py +++ b/volatility3/framework/plugins/windows/bigpools.py @@ -5,13 +5,13 @@ import logging from typing import List, Optional, Tuple, Iterator -from volatility.framework import interfaces, renderers, exceptions, symbols -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import configuration -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import extensions -from volatility.framework.symbols.windows import versions +from volatility3.framework import interfaces, renderers, exceptions, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import configuration +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import extensions +from volatility3.framework.symbols.windows import versions vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py similarity index 95% rename from volatility/framework/plugins/windows/cachedump.py rename to volatility3/framework/plugins/windows/cachedump.py index 35eb0f593..02e3a540c 100644 --- a/volatility/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -7,11 +7,11 @@ from struct import unpack from Crypto.Cipher import ARC4, AES from Crypto.Hash import HMAC -from volatility.framework import interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.symbols.windows import versions -from volatility.plugins.windows import hashdump, lsadump -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.symbols.windows import versions +from volatility3.plugins.windows import hashdump, lsadump +from volatility3.plugins.windows.registry import hivelist class Cachedump(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py similarity index 97% rename from volatility/framework/plugins/windows/callbacks.py rename to volatility3/framework/plugins/windows/callbacks.py index 8f5280ad0..7702d67a7 100644 --- a/volatility/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -5,13 +5,13 @@ import logging from typing import List, Iterable, Tuple, Optional, Union -from volatility.framework import constants, exceptions, renderers, interfaces, symbols -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import versions -from volatility.plugins.windows import ssdt -from volatility.plugins.windows import svcscan +from volatility3.framework import constants, exceptions, renderers, interfaces, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import versions +from volatility3.plugins.windows import ssdt +from volatility3.plugins.windows import svcscan vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/cmdline.py b/volatility3/framework/plugins/windows/cmdline.py similarity index 94% rename from volatility/framework/plugins/windows/cmdline.py rename to volatility3/framework/plugins/windows/cmdline.py index 83ac2aa02..dfcf07f38 100644 --- a/volatility/framework/plugins/windows/cmdline.py +++ b/volatility3/framework/plugins/windows/cmdline.py @@ -4,10 +4,10 @@ import logging from typing import List -from volatility.framework import constants, exceptions, renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.plugins.windows import pslist +from volatility3.framework import constants, exceptions, renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py similarity index 95% rename from volatility/framework/plugins/windows/dlllist.py rename to volatility3/framework/plugins/windows/dlllist.py index 94de9d193..c5912afa9 100644 --- a/volatility/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -6,13 +6,13 @@ import logging import ntpath from typing import List, Optional, Type -from volatility.framework import exceptions, renderers, interfaces, constants -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints, conversion -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe -from volatility.plugins import timeliner -from volatility.plugins.windows import pslist, info +from volatility3.framework import exceptions, renderers, interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints, conversion +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins import timeliner +from volatility3.plugins.windows import pslist, info vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/driverirp.py b/volatility3/framework/plugins/windows/driverirp.py similarity index 92% rename from volatility/framework/plugins/windows/driverirp.py rename to volatility3/framework/plugins/windows/driverirp.py index c77e0801d..27f86f3b0 100644 --- a/volatility/framework/plugins/windows/driverirp.py +++ b/volatility3/framework/plugins/windows/driverirp.py @@ -2,11 +2,11 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import constants -from volatility.framework import renderers, exceptions, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import ssdt, driverscan +from volatility3.framework import constants +from volatility3.framework import renderers, exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import ssdt, driverscan MAJOR_FUNCTIONS = [ 'IRP_MJ_CREATE', 'IRP_MJ_CREATE_NAMED_PIPE', 'IRP_MJ_CLOSE', 'IRP_MJ_READ', 'IRP_MJ_WRITE', diff --git a/volatility/framework/plugins/windows/driverscan.py b/volatility3/framework/plugins/windows/driverscan.py similarity index 93% rename from volatility/framework/plugins/windows/driverscan.py rename to volatility3/framework/plugins/windows/driverscan.py index e3d1bd5b2..be941836f 100644 --- a/volatility/framework/plugins/windows/driverscan.py +++ b/volatility3/framework/plugins/windows/driverscan.py @@ -4,10 +4,10 @@ from typing import Iterable -from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import poolscanner +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import poolscanner class DriverScan(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py similarity index 97% rename from volatility/framework/plugins/windows/dumpfiles.py rename to volatility3/framework/plugins/windows/dumpfiles.py index d17b30244..e73de42fa 100755 --- a/volatility/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -4,12 +4,12 @@ import logging import ntpath -from volatility.framework import interfaces, renderers, exceptions, constants -from volatility.plugins.windows import handles -from volatility.plugins.windows import pslist -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.objects import utility +from volatility3.framework import interfaces, renderers, exceptions, constants +from volatility3.plugins.windows import handles +from volatility3.plugins.windows import pslist +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.objects import utility from typing import List, Tuple, Type, Optional vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py similarity index 94% rename from volatility/framework/plugins/windows/envars.py rename to volatility3/framework/plugins/windows/envars.py index 50f99659f..7abcfa159 100644 --- a/volatility/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -3,11 +3,11 @@ import logging from typing import List -from volatility.framework import renderers, interfaces, objects, exceptions, constants -from volatility.framework.configuration import requirements -from volatility.framework.layers import registry -from volatility.plugins.windows import pslist -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import renderers, interfaces, objects, exceptions, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import registry +from volatility3.plugins.windows import pslist +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/filescan.py b/volatility3/framework/plugins/windows/filescan.py similarity index 91% rename from volatility/framework/plugins/windows/filescan.py rename to volatility3/framework/plugins/windows/filescan.py index 3f59e02e5..b53352b6e 100644 --- a/volatility/framework/plugins/windows/filescan.py +++ b/volatility3/framework/plugins/windows/filescan.py @@ -4,10 +4,10 @@ from typing import Iterable -from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import poolscanner +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import poolscanner class FileScan(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py similarity index 92% rename from volatility/framework/plugins/windows/getservicesids.py rename to volatility3/framework/plugins/windows/getservicesids.py index 0a5a96820..c2029b937 100644 --- a/volatility/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -8,9 +8,9 @@ import os import struct from typing import List -from volatility.framework import renderers, interfaces, constants, exceptions -from volatility.framework.configuration import requirements -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import renderers, interfaces, constants, exceptions +from volatility3.framework.configuration import requirements +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py similarity index 93% rename from volatility/framework/plugins/windows/getsids.py rename to volatility3/framework/plugins/windows/getsids.py index 5f7e2dcf4..c9aa9cc5c 100644 --- a/volatility/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -8,12 +8,12 @@ import os import re from typing import List, Dict, Union -from volatility.framework import renderers, interfaces, objects, exceptions, constants, layers -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols.windows.extensions import registry -from volatility.plugins.windows import pslist -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import renderers, interfaces, objects, exceptions, constants, layers +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols.windows.extensions import registry +from volatility3.plugins.windows import pslist +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py similarity index 97% rename from volatility/framework/plugins/windows/handles.py rename to volatility3/framework/plugins/windows/handles.py index 5f697bc23..2951a5bdc 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -5,11 +5,11 @@ import logging from typing import List, Optional, Dict -from volatility.framework import constants, exceptions, renderers, interfaces, symbols -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import pslist +from volatility3.framework import constants, exceptions, renderers, interfaces, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py similarity index 98% rename from volatility/framework/plugins/windows/hashdump.py rename to volatility3/framework/plugins/windows/hashdump.py index 64e312bb0..d78684beb 100644 --- a/volatility/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -10,10 +10,10 @@ from typing import List, Tuple, Optional from Crypto.Cipher import ARC4, DES, AES from Crypto.Hash import MD5 -from volatility.framework import interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.symbols.windows.extensions import registry -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.symbols.windows.extensions import registry +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/info.py b/volatility3/framework/plugins/windows/info.py similarity index 96% rename from volatility/framework/plugins/windows/info.py rename to volatility3/framework/plugins/windows/info.py index 8a40f305a..3cb4f1bb7 100644 --- a/volatility/framework/plugins/windows/info.py +++ b/volatility3/framework/plugins/windows/info.py @@ -5,12 +5,12 @@ import time from typing import List, Tuple, Iterable -from volatility.framework import constants, interfaces, layers, symbols -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import TreeGrid -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import extensions +from volatility3.framework import constants, interfaces, layers, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import TreeGrid +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import extensions class Info(plugins.PluginInterface): diff --git a/volatility/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py similarity index 95% rename from volatility/framework/plugins/windows/lsadump.py rename to volatility3/framework/plugins/windows/lsadump.py index a0b674855..538933f7b 100644 --- a/volatility/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -7,11 +7,11 @@ from struct import unpack from Crypto.Cipher import ARC4, DES, AES from Crypto.Hash import MD5, SHA256 -from volatility.framework import interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.symbols.windows import versions -from volatility.plugins.windows import hashdump -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.symbols.windows import versions +from volatility3.plugins.windows import hashdump +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py similarity index 95% rename from volatility/framework/plugins/windows/malfind.py rename to volatility3/framework/plugins/windows/malfind.py index 17fcf11b8..ed35ef649 100644 --- a/volatility/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -4,12 +4,12 @@ import logging from typing import Iterable, Tuple -from volatility.framework import interfaces, symbols, exceptions -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import pslist, vadinfo +from volatility3.framework import interfaces, symbols, exceptions +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist, vadinfo vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/memmap.py b/volatility3/framework/plugins/windows/memmap.py similarity index 94% rename from volatility/framework/plugins/windows/memmap.py rename to volatility3/framework/plugins/windows/memmap.py index 627baca2f..42cf3b9b0 100644 --- a/volatility/framework/plugins/windows/memmap.py +++ b/volatility3/framework/plugins/windows/memmap.py @@ -4,10 +4,10 @@ import logging from typing import List -from volatility.framework import exceptions, renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import pslist +from volatility3.framework import exceptions, renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/modscan.py b/volatility3/framework/plugins/windows/modscan.py similarity index 95% rename from volatility/framework/plugins/windows/modscan.py rename to volatility3/framework/plugins/windows/modscan.py index 3ff0f399a..0a5cb7c9a 100644 --- a/volatility/framework/plugins/windows/modscan.py +++ b/volatility3/framework/plugins/windows/modscan.py @@ -4,12 +4,12 @@ import logging from typing import Iterable, List, Generator -from volatility.framework import renderers, interfaces, exceptions, constants -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe -from volatility.plugins.windows import poolscanner, dlllist, pslist +from volatility3.framework import renderers, interfaces, exceptions, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins.windows import poolscanner, dlllist, pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py similarity index 94% rename from volatility/framework/plugins/windows/modules.py rename to volatility3/framework/plugins/windows/modules.py index df2c04fef..e1384a015 100644 --- a/volatility/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -4,14 +4,14 @@ import logging from typing import List, Iterable, Generator -from volatility.framework import constants -from volatility.framework import exceptions, interfaces -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe -from volatility.plugins.windows import pslist, dlllist +from volatility3.framework import constants +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins.windows import pslist, dlllist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/mutantscan.py b/volatility3/framework/plugins/windows/mutantscan.py similarity index 91% rename from volatility/framework/plugins/windows/mutantscan.py rename to volatility3/framework/plugins/windows/mutantscan.py index d9053c44a..c886960c6 100644 --- a/volatility/framework/plugins/windows/mutantscan.py +++ b/volatility3/framework/plugins/windows/mutantscan.py @@ -4,10 +4,10 @@ from typing import Iterable -from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import poolscanner +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import poolscanner class MutantScan(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py similarity index 97% rename from volatility/framework/plugins/windows/netscan.py rename to volatility3/framework/plugins/windows/netscan.py index 09b02e3ac..cb455aa03 100644 --- a/volatility/framework/plugins/windows/netscan.py +++ b/volatility3/framework/plugins/windows/netscan.py @@ -6,14 +6,14 @@ import datetime import logging from typing import Iterable, List, Optional -from volatility.framework import constants, exceptions, interfaces, renderers, symbols -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import versions -from volatility.framework.symbols.windows.extensions import network -from volatility.plugins import timeliner -from volatility.plugins.windows import info, poolscanner +from volatility3.framework import constants, exceptions, interfaces, renderers, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import versions +from volatility3.framework.symbols.windows.extensions import network +from volatility3.plugins import timeliner +from volatility3.plugins.windows import info, poolscanner vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py similarity index 97% rename from volatility/framework/plugins/windows/poolscanner.py rename to volatility3/framework/plugins/windows/poolscanner.py index c888c1f6a..f61c8566b 100644 --- a/volatility/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -6,14 +6,14 @@ import enum import logging from typing import Dict, Generator, List, Optional, Tuple -from volatility.framework import constants, interfaces, renderers, exceptions, symbols -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins, configuration -from volatility.framework.layers import scanners -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import extensions, versions -from volatility.plugins.windows import handles +from volatility3.framework import constants, interfaces, renderers, exceptions, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins, configuration +from volatility3.framework.layers import scanners +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import extensions, versions +from volatility3.plugins.windows import handles vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/privileges.py b/volatility3/framework/plugins/windows/privileges.py similarity index 93% rename from volatility/framework/plugins/windows/privileges.py rename to volatility3/framework/plugins/windows/privileges.py index f24aa7be3..cfd2d70e0 100644 --- a/volatility/framework/plugins/windows/privileges.py +++ b/volatility3/framework/plugins/windows/privileges.py @@ -6,9 +6,9 @@ import logging import os from typing import List -from volatility.framework import renderers, interfaces, objects, exceptions, constants -from volatility.framework.configuration import requirements -from volatility.plugins.windows import pslist +from volatility3.framework import renderers, interfaces, objects, exceptions, constants +from volatility3.framework.configuration import requirements +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py similarity index 96% rename from volatility/framework/plugins/windows/pslist.py rename to volatility3/framework/plugins/windows/pslist.py index be3bf0235..1428936f0 100644 --- a/volatility/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -6,13 +6,13 @@ import datetime import logging from typing import Callable, Iterable, List, Type -from volatility.framework import renderers, interfaces, layers, constants -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe -from volatility.plugins import timeliner +from volatility3.framework import renderers, interfaces, layers, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins import timeliner vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/psscan.py b/volatility3/framework/plugins/windows/psscan.py similarity index 95% rename from volatility/framework/plugins/windows/psscan.py rename to volatility3/framework/plugins/windows/psscan.py index 76823ee37..2458ee42e 100644 --- a/volatility/framework/plugins/windows/psscan.py +++ b/volatility3/framework/plugins/windows/psscan.py @@ -6,15 +6,15 @@ import datetime import logging from typing import Iterable, Callable, Tuple -from volatility.framework import renderers, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe -from volatility.plugins import timeliner -from volatility.plugins.windows import info -from volatility.plugins.windows import poolscanner -from volatility.plugins.windows import pslist +from volatility3.framework import renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins import timeliner +from volatility3.plugins.windows import info +from volatility3.plugins.windows import poolscanner +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/pstree.py b/volatility3/framework/plugins/windows/pstree.py similarity index 95% rename from volatility/framework/plugins/windows/pstree.py rename to volatility3/framework/plugins/windows/pstree.py index a4027ea7a..0d79d3d5b 100644 --- a/volatility/framework/plugins/windows/pstree.py +++ b/volatility3/framework/plugins/windows/pstree.py @@ -4,10 +4,10 @@ import datetime from typing import Dict, Set -from volatility.framework import objects, interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import pslist +from volatility3.framework import objects, interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist class PsTree(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/windows/registry/__init__.py b/volatility3/framework/plugins/windows/registry/__init__.py similarity index 70% rename from volatility/framework/plugins/windows/registry/__init__.py rename to volatility3/framework/plugins/windows/registry/__init__.py index 4939c7755..4351a2ca2 100644 --- a/volatility/framework/plugins/windows/registry/__init__.py +++ b/volatility3/framework/plugins/windows/registry/__init__.py @@ -3,6 +3,6 @@ # """All core windows registry plugins. -These modules should only be imported from volatility.plugins NOT -volatility.framework.plugins +These modules should only be imported from volatility3.plugins NOT +volatility3.framework.plugins """ diff --git a/volatility/framework/plugins/windows/registry/hivelist.py b/volatility3/framework/plugins/windows/registry/hivelist.py similarity index 97% rename from volatility/framework/plugins/windows/registry/hivelist.py rename to volatility3/framework/plugins/windows/registry/hivelist.py index 81aa6b26a..d5ac804a5 100644 --- a/volatility/framework/plugins/windows/registry/hivelist.py +++ b/volatility3/framework/plugins/windows/registry/hivelist.py @@ -4,11 +4,11 @@ import logging from typing import Iterator, List, Tuple, Iterable, Optional -from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import registry -from volatility.framework.renderers import format_hints -from volatility.plugins.windows.registry import hivescan +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import registry +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows.registry import hivescan vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/registry/hivescan.py b/volatility3/framework/plugins/windows/registry/hivescan.py similarity index 91% rename from volatility/framework/plugins/windows/registry/hivescan.py rename to volatility3/framework/plugins/windows/registry/hivescan.py index 466e27763..558638cfd 100644 --- a/volatility/framework/plugins/windows/registry/hivescan.py +++ b/volatility3/framework/plugins/windows/registry/hivescan.py @@ -4,11 +4,11 @@ from typing import Iterable -from volatility.framework import renderers, interfaces, symbols -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols.windows import versions -from volatility.plugins.windows import poolscanner, bigpools +from volatility3.framework import renderers, interfaces, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols.windows import versions +from volatility3.plugins.windows import poolscanner, bigpools class HiveScan(interfaces.plugins.PluginInterface): diff --git a/volatility/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py similarity index 95% rename from volatility/framework/plugins/windows/registry/printkey.py rename to volatility3/framework/plugins/windows/registry/printkey.py index da660792e..5709b246d 100644 --- a/volatility/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -6,12 +6,12 @@ import datetime import logging from typing import List, Sequence, Iterable, Tuple, Union -from volatility.framework import objects, renderers, exceptions, interfaces, constants -from volatility.framework.configuration import requirements -from volatility.framework.layers.registry import RegistryHive, RegistryFormatException -from volatility.framework.renderers import TreeGrid, conversion, format_hints -from volatility.framework.symbols.windows.extensions.registry import RegValueTypes -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import objects, renderers, exceptions, interfaces, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.layers.registry import RegistryHive, RegistryFormatException +from volatility3.framework.renderers import TreeGrid, conversion, format_hints +from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/registry/userassist.json b/volatility3/framework/plugins/windows/registry/userassist.json similarity index 100% rename from volatility/framework/plugins/windows/registry/userassist.json rename to volatility3/framework/plugins/windows/registry/userassist.json diff --git a/volatility/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py similarity index 96% rename from volatility/framework/plugins/windows/registry/userassist.py rename to volatility3/framework/plugins/windows/registry/userassist.py index c18d92edf..16e997d0f 100644 --- a/volatility/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -9,13 +9,13 @@ import logging import os from typing import Any, List, Tuple, Generator -from volatility.framework import exceptions, renderers, constants, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.layers.physical import BufferDataLayer -from volatility.framework.layers.registry import RegistryHive -from volatility.framework.renderers import format_hints, conversion -from volatility.framework.symbols import intermed -from volatility.plugins.windows.registry import hivelist +from volatility3.framework import exceptions, renderers, constants, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.layers.physical import BufferDataLayer +from volatility3.framework.layers.registry import RegistryHive +from volatility3.framework.renderers import format_hints, conversion +from volatility3.framework.symbols import intermed +from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/sids_and_privileges.json b/volatility3/framework/plugins/windows/sids_and_privileges.json similarity index 100% rename from volatility/framework/plugins/windows/sids_and_privileges.json rename to volatility3/framework/plugins/windows/sids_and_privileges.json diff --git a/volatility/framework/plugins/windows/ssdt.py b/volatility3/framework/plugins/windows/ssdt.py similarity index 93% rename from volatility/framework/plugins/windows/ssdt.py rename to volatility3/framework/plugins/windows/ssdt.py index 539d2e0a4..c510dec92 100644 --- a/volatility/framework/plugins/windows/ssdt.py +++ b/volatility3/framework/plugins/windows/ssdt.py @@ -5,14 +5,14 @@ import os from typing import Any, Iterator, List, Tuple -from volatility.framework import constants, interfaces -from volatility.framework import contexts -from volatility.framework import exceptions, symbols -from volatility.framework import renderers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import modules +from volatility3.framework import constants, interfaces +from volatility3.framework import contexts +from volatility3.framework import exceptions, symbols +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import modules class SSDT(plugins.PluginInterface): diff --git a/volatility/framework/plugins/windows/strings.py b/volatility3/framework/plugins/windows/strings.py similarity index 95% rename from volatility/framework/plugins/windows/strings.py rename to volatility3/framework/plugins/windows/strings.py index 90fb82df8..8b18ef812 100644 --- a/volatility/framework/plugins/windows/strings.py +++ b/volatility3/framework/plugins/windows/strings.py @@ -7,11 +7,11 @@ import re from os import path from typing import Dict, Generator, List, Set, Tuple -from volatility.framework import interfaces, renderers, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import intel, resources, linear -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import pslist +from volatility3.framework import interfaces, renderers, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import intel, resources, linear +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py similarity index 94% rename from volatility/framework/plugins/windows/svcscan.py rename to volatility3/framework/plugins/windows/svcscan.py index 8c9866631..23648ada2 100644 --- a/volatility/framework/plugins/windows/svcscan.py +++ b/volatility3/framework/plugins/windows/svcscan.py @@ -5,14 +5,14 @@ import logging from typing import List -from volatility.framework import interfaces, renderers, constants, symbols, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import scanners -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import versions -from volatility.framework.symbols.windows.extensions import services -from volatility.plugins.windows import poolscanner, vadyarascan, pslist +from volatility3.framework import interfaces, renderers, constants, symbols, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import scanners +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import versions +from volatility3.framework.symbols.windows.extensions import services +from volatility3.plugins.windows import poolscanner, vadyarascan, pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/symlinkscan.py b/volatility3/framework/plugins/windows/symlinkscan.py similarity index 91% rename from volatility/framework/plugins/windows/symlinkscan.py rename to volatility3/framework/plugins/windows/symlinkscan.py index 74f5e116a..7d8a54869 100644 --- a/volatility/framework/plugins/windows/symlinkscan.py +++ b/volatility3/framework/plugins/windows/symlinkscan.py @@ -5,11 +5,11 @@ import datetime from typing import Iterable -from volatility.framework import renderers, exceptions, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins import timeliner -from volatility.plugins.windows import poolscanner +from volatility3.framework import renderers, exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins import timeliner +from volatility3.plugins.windows import poolscanner class SymlinkScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py similarity index 97% rename from volatility/framework/plugins/windows/vadinfo.py rename to volatility3/framework/plugins/windows/vadinfo.py index 25d232c24..8d4ca027a 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -5,11 +5,11 @@ import logging from typing import Callable, List, Generator, Iterable, Type, Optional -from volatility.framework import renderers, interfaces, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints -from volatility.plugins.windows import pslist +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py similarity index 94% rename from volatility/framework/plugins/windows/vadyarascan.py rename to volatility3/framework/plugins/windows/vadyarascan.py index 799cdc4a2..bf597140f 100644 --- a/volatility/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -5,11 +5,11 @@ import logging from typing import Iterable, List, Tuple -from volatility.framework import interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.plugins import yarascan -from volatility.plugins.windows import pslist +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins import yarascan +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/verinfo.py b/volatility3/framework/plugins/windows/verinfo.py similarity index 95% rename from volatility/framework/plugins/windows/verinfo.py rename to volatility3/framework/plugins/windows/verinfo.py index 5338a3178..52c8e462a 100644 --- a/volatility/framework/plugins/windows/verinfo.py +++ b/volatility3/framework/plugins/windows/verinfo.py @@ -6,12 +6,12 @@ import io import logging from typing import Generator, List, Tuple -from volatility.framework import exceptions, renderers, constants, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.renderers import format_hints -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows.extensions import pe -from volatility.plugins.windows import pslist, modules, dlllist +from volatility3.framework import exceptions, renderers, constants, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins.windows import pslist, modules, dlllist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/windows/virtmap.py b/volatility3/framework/plugins/windows/virtmap.py similarity index 96% rename from volatility/framework/plugins/windows/virtmap.py rename to volatility3/framework/plugins/windows/virtmap.py index 5ce7d5d78..93ec763cc 100644 --- a/volatility/framework/plugins/windows/virtmap.py +++ b/volatility3/framework/plugins/windows/virtmap.py @@ -5,10 +5,10 @@ import logging from typing import List, Tuple, Dict, Generator -from volatility.framework import interfaces, renderers, exceptions -from volatility.framework.configuration import requirements -from volatility.framework.layers import intel -from volatility.framework.renderers import format_hints +from volatility3.framework import interfaces, renderers, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import intel +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py similarity index 93% rename from volatility/framework/plugins/yarascan.py rename to volatility3/framework/plugins/yarascan.py index 4e3abee25..8c49c0824 100644 --- a/volatility/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -5,11 +5,11 @@ import logging from typing import Iterable, Tuple, List, Dict, Any -from volatility.framework import interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.layers import resources -from volatility.framework.renderers import format_hints +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.layers import resources +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) diff --git a/volatility/framework/renderers/__init__.py b/volatility3/framework/renderers/__init__.py similarity index 99% rename from volatility/framework/renderers/__init__.py rename to volatility3/framework/renderers/__init__.py index 431ac8034..c7dc126b2 100644 --- a/volatility/framework/renderers/__init__.py +++ b/volatility3/framework/renderers/__init__.py @@ -11,8 +11,8 @@ import datetime import logging from typing import Any, Callable, Iterable, List, Optional, Sequence, Tuple, TypeVar, Union -from volatility.framework import interfaces -from volatility.framework.interfaces import renderers +from volatility3.framework import interfaces +from volatility3.framework.interfaces import renderers vollog = logging.getLogger(__name__) diff --git a/volatility/framework/renderers/conversion.py b/volatility3/framework/renderers/conversion.py similarity index 98% rename from volatility/framework/renderers/conversion.py rename to volatility3/framework/renderers/conversion.py index c570c124f..b60b47411 100644 --- a/volatility/framework/renderers/conversion.py +++ b/volatility3/framework/renderers/conversion.py @@ -8,7 +8,7 @@ import socket import struct from typing import Union -from volatility.framework import interfaces, renderers +from volatility3.framework import interfaces, renderers def wintime_to_datetime(wintime: int) -> Union[interfaces.renderers.BaseAbsentValue, datetime.datetime]: diff --git a/volatility/framework/renderers/format_hints.py b/volatility3/framework/renderers/format_hints.py similarity index 100% rename from volatility/framework/renderers/format_hints.py rename to volatility3/framework/renderers/format_hints.py diff --git a/volatility/framework/symbols/__init__.py b/volatility3/framework/symbols/__init__.py similarity index 99% rename from volatility/framework/symbols/__init__.py rename to volatility3/framework/symbols/__init__.py index 6cbf41196..c2444682c 100644 --- a/volatility/framework/symbols/__init__.py +++ b/volatility3/framework/symbols/__init__.py @@ -8,7 +8,7 @@ import enum import logging from typing import Any, Dict, Iterable, Iterator, TypeVar, List -from volatility.framework import constants, exceptions, interfaces, objects +from volatility3.framework import constants, exceptions, interfaces, objects vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/generic/__init__.py b/volatility3/framework/symbols/generic/__init__.py similarity index 97% rename from volatility/framework/symbols/generic/__init__.py rename to volatility3/framework/symbols/generic/__init__.py index be0bfb59a..68b4e9252 100644 --- a/volatility/framework/symbols/generic/__init__.py +++ b/volatility3/framework/symbols/generic/__init__.py @@ -6,7 +6,7 @@ import random import string from typing import Union -from volatility.framework import objects, interfaces +from volatility3.framework import objects, interfaces class GenericIntelProcess(objects.StructType): diff --git a/volatility/framework/symbols/generic/qemu.json b/volatility3/framework/symbols/generic/qemu.json similarity index 100% rename from volatility/framework/symbols/generic/qemu.json rename to volatility3/framework/symbols/generic/qemu.json diff --git a/volatility/framework/symbols/intermed.py b/volatility3/framework/symbols/intermed.py similarity index 98% rename from volatility/framework/symbols/intermed.py rename to volatility3/framework/symbols/intermed.py index b383846a1..0ff03cbca 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility3/framework/symbols/intermed.py @@ -13,11 +13,11 @@ import zipfile from abc import ABCMeta from typing import Any, Dict, Generator, Iterable, List, Optional, Type, Tuple, Mapping -from volatility.framework.layers import resources -from volatility import schemas, symbols -from volatility.framework import class_subclasses, constants, exceptions, interfaces, objects -from volatility.framework.configuration import requirements -from volatility.framework.symbols import native, metadata +from volatility3.framework.layers import resources +from volatility3 import schemas, symbols +from volatility3.framework import class_subclasses, constants, exceptions, interfaces, objects +from volatility3.framework.configuration import requirements +from volatility3.framework.symbols import native, metadata vollog = logging.getLogger(__name__) @@ -71,7 +71,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): * Enums can specify a list of names and values and a type inside which the numeric encoding will fit * Metadata defines information about the originating file - These are documented in JSONSchema JSON files located in volatility/schemas. + These are documented in JSONSchema JSON files located in volatility3/schemas. """ def __init__(self, @@ -229,7 +229,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): Args: context: The context that the current plugin is being run within config_path: The configuration path for reading/storing configuration information this symbol table may use - sub_path: The path under a suitable symbol path (defaults to volatility/symbols and volatility/framework/symbols) to check + sub_path: The path under a suitable symbol path (defaults to volatility3/symbols and volatility3/framework/symbols) to check filename: Basename of the file to find under the sub_path native_types: Set of native types, defaults to native types read from the intermediate symbol format file table_mapping: a dictionary of table names mentioned within the ISF file, and the tables within the context which they map to diff --git a/volatility/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py similarity index 96% rename from volatility/framework/symbols/linux/__init__.py rename to volatility3/framework/symbols/linux/__init__.py index d8c88d07a..0d8e99e42 100644 --- a/volatility/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -3,11 +3,11 @@ # from typing import List, Tuple, Iterator -from volatility.framework import exceptions, constants, interfaces, objects, contexts -from volatility.framework.objects import utility -from volatility.framework.symbols import intermed -from volatility.framework.symbols.linux import extensions -from volatility.framework.objects import utility +from volatility3.framework import exceptions, constants, interfaces, objects, contexts +from volatility3.framework.objects import utility +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.linux import extensions +from volatility3.framework.objects import utility class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): diff --git a/volatility/framework/symbols/linux/bash.py b/volatility3/framework/symbols/linux/bash.py similarity index 77% rename from volatility/framework/symbols/linux/bash.py rename to volatility3/framework/symbols/linux/bash.py index 570d2cda5..f1f40ace1 100644 --- a/volatility/framework/symbols/linux/bash.py +++ b/volatility3/framework/symbols/linux/bash.py @@ -2,8 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework.symbols import intermed -from volatility.framework.symbols.linux.extensions import bash +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.linux.extensions import bash class BashIntermedSymbols(intermed.IntermediateSymbolTable): diff --git a/volatility/framework/symbols/linux/bash32.json b/volatility3/framework/symbols/linux/bash32.json similarity index 100% rename from volatility/framework/symbols/linux/bash32.json rename to volatility3/framework/symbols/linux/bash32.json diff --git a/volatility/framework/symbols/linux/bash64.json b/volatility3/framework/symbols/linux/bash64.json similarity index 100% rename from volatility/framework/symbols/linux/bash64.json rename to volatility3/framework/symbols/linux/bash64.json diff --git a/volatility/framework/symbols/linux/elf.json b/volatility3/framework/symbols/linux/elf.json similarity index 100% rename from volatility/framework/symbols/linux/elf.json rename to volatility3/framework/symbols/linux/elf.json diff --git a/volatility/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py similarity index 97% rename from volatility/framework/symbols/linux/extensions/__init__.py rename to volatility3/framework/symbols/linux/extensions/__init__.py index c601c0979..5bcfda11e 100644 --- a/volatility/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -6,13 +6,13 @@ import collections.abc import logging from typing import Generator, Iterable, Iterator, Optional, Tuple -from volatility.framework import constants -from volatility.framework import exceptions, objects, interfaces, symbols -from volatility.framework.layers import linear -from volatility.framework.objects import utility -from volatility.framework.symbols import generic, linux -from volatility.framework.symbols import intermed -from volatility.framework.symbols.linux.extensions import elf +from volatility3.framework import constants +from volatility3.framework import exceptions, objects, interfaces, symbols +from volatility3.framework.layers import linear +from volatility3.framework.objects import utility +from volatility3.framework.symbols import generic, linux +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.linux.extensions import elf vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/linux/extensions/bash.py b/volatility3/framework/symbols/linux/extensions/bash.py similarity index 89% rename from volatility/framework/symbols/linux/extensions/bash.py rename to volatility3/framework/symbols/linux/extensions/bash.py index c583b67a4..40fa2521d 100644 --- a/volatility/framework/symbols/linux/extensions/bash.py +++ b/volatility3/framework/symbols/linux/extensions/bash.py @@ -2,10 +2,10 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import exceptions -from volatility.framework import objects -from volatility.framework.objects import utility -from volatility.framework.renderers import conversion +from volatility3.framework import exceptions +from volatility3.framework import objects +from volatility3.framework.objects import utility +from volatility3.framework.renderers import conversion class hist_entry(objects.StructType): diff --git a/volatility/framework/symbols/linux/extensions/elf.py b/volatility3/framework/symbols/linux/extensions/elf.py similarity index 98% rename from volatility/framework/symbols/linux/extensions/elf.py rename to volatility3/framework/symbols/linux/extensions/elf.py index 505132ea9..0774e937a 100644 --- a/volatility/framework/symbols/linux/extensions/elf.py +++ b/volatility3/framework/symbols/linux/extensions/elf.py @@ -4,8 +4,8 @@ from typing import Dict, Tuple -from volatility.framework import constants -from volatility.framework import objects, interfaces +from volatility3.framework import constants +from volatility3.framework import objects, interfaces class elf(objects.StructType): diff --git a/volatility/framework/symbols/mac/__init__.py b/volatility3/framework/symbols/mac/__init__.py similarity index 97% rename from volatility/framework/symbols/mac/__init__.py rename to volatility3/framework/symbols/mac/__init__.py index 4343a38f3..54a5259d0 100644 --- a/volatility/framework/symbols/mac/__init__.py +++ b/volatility3/framework/symbols/mac/__init__.py @@ -3,9 +3,9 @@ # from typing import Iterator, Any, Iterable, List, Tuple, Set -from volatility.framework import interfaces, objects, exceptions, constants -from volatility.framework.symbols import intermed -from volatility.framework.symbols.mac import extensions +from volatility3.framework import interfaces, objects, exceptions, constants +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.mac import extensions class MacKernelIntermedSymbols(intermed.IntermediateSymbolTable): diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility3/framework/symbols/mac/extensions/__init__.py similarity index 98% rename from volatility/framework/symbols/mac/extensions/__init__.py rename to volatility3/framework/symbols/mac/extensions/__init__.py index e433318ae..37d733af6 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility3/framework/symbols/mac/extensions/__init__.py @@ -4,11 +4,11 @@ from typing import Generator, Iterable, Optional, Set, Tuple -from volatility.framework import constants, objects, renderers -from volatility.framework import exceptions, interfaces -from volatility.framework.objects import utility -from volatility.framework.renderers import conversion -from volatility.framework.symbols import generic +from volatility3.framework import constants, objects, renderers +from volatility3.framework import exceptions, interfaces +from volatility3.framework.objects import utility +from volatility3.framework.renderers import conversion +from volatility3.framework.symbols import generic class proc(generic.GenericIntelProcess): @@ -517,7 +517,7 @@ class sysctl_oid(objects.StructType): Returns: A combination of: - R - readable + R - readable W - writeable L - self handles locking """ diff --git a/volatility/framework/symbols/metadata.py b/volatility3/framework/symbols/metadata.py similarity index 96% rename from volatility/framework/symbols/metadata.py rename to volatility3/framework/symbols/metadata.py index 444fb6481..7cde686ee 100644 --- a/volatility/framework/symbols/metadata.py +++ b/volatility3/framework/symbols/metadata.py @@ -4,7 +4,7 @@ from typing import Optional, Tuple -from volatility.framework import interfaces +from volatility3.framework import interfaces class WindowsMetadata(interfaces.symbols.MetadataInterface): diff --git a/volatility/framework/symbols/native.py b/volatility3/framework/symbols/native.py similarity index 98% rename from volatility/framework/symbols/native.py rename to volatility3/framework/symbols/native.py index 26d12bd7e..fdc161322 100644 --- a/volatility/framework/symbols/native.py +++ b/volatility3/framework/symbols/native.py @@ -5,7 +5,7 @@ import copy from typing import Any, Dict, Iterable, Optional, Type -from volatility.framework import constants, interfaces, objects +from volatility3.framework import constants, interfaces, objects class NativeTable(interfaces.symbols.NativeTableInterface): diff --git a/volatility/framework/symbols/windows/__init__.py b/volatility3/framework/symbols/windows/__init__.py similarity index 92% rename from volatility/framework/symbols/windows/__init__.py rename to volatility3/framework/symbols/windows/__init__.py index d99706022..3aa607574 100755 --- a/volatility/framework/symbols/windows/__init__.py +++ b/volatility3/framework/symbols/windows/__init__.py @@ -1,10 +1,10 @@ # This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import volatility.framework.symbols.windows.extensions.pool -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import extensions -from volatility.framework.symbols.windows.extensions import registry, pool +import volatility3.framework.symbols.windows.extensions.pool +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import extensions +from volatility3.framework.symbols.windows.extensions import registry, pool class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): diff --git a/volatility/framework/symbols/windows/bigpools-vista-x64.json b/volatility3/framework/symbols/windows/bigpools-vista-x64.json similarity index 100% rename from volatility/framework/symbols/windows/bigpools-vista-x64.json rename to volatility3/framework/symbols/windows/bigpools-vista-x64.json diff --git a/volatility/framework/symbols/windows/bigpools-vista-x86.json b/volatility3/framework/symbols/windows/bigpools-vista-x86.json similarity index 100% rename from volatility/framework/symbols/windows/bigpools-vista-x86.json rename to volatility3/framework/symbols/windows/bigpools-vista-x86.json diff --git a/volatility/framework/symbols/windows/bigpools-win10-x64.json b/volatility3/framework/symbols/windows/bigpools-win10-x64.json similarity index 100% rename from volatility/framework/symbols/windows/bigpools-win10-x64.json rename to volatility3/framework/symbols/windows/bigpools-win10-x64.json diff --git a/volatility/framework/symbols/windows/bigpools-win10-x86.json b/volatility3/framework/symbols/windows/bigpools-win10-x86.json similarity index 100% rename from volatility/framework/symbols/windows/bigpools-win10-x86.json rename to volatility3/framework/symbols/windows/bigpools-win10-x86.json diff --git a/volatility/framework/symbols/windows/bigpools-x64.json b/volatility3/framework/symbols/windows/bigpools-x64.json similarity index 100% rename from volatility/framework/symbols/windows/bigpools-x64.json rename to volatility3/framework/symbols/windows/bigpools-x64.json diff --git a/volatility/framework/symbols/windows/bigpools-x86.json b/volatility3/framework/symbols/windows/bigpools-x86.json similarity index 100% rename from volatility/framework/symbols/windows/bigpools-x86.json rename to volatility3/framework/symbols/windows/bigpools-x86.json diff --git a/volatility/framework/symbols/windows/callbacks-x64.json b/volatility3/framework/symbols/windows/callbacks-x64.json similarity index 100% rename from volatility/framework/symbols/windows/callbacks-x64.json rename to volatility3/framework/symbols/windows/callbacks-x64.json diff --git a/volatility/framework/symbols/windows/callbacks-x86.json b/volatility3/framework/symbols/windows/callbacks-x86.json similarity index 100% rename from volatility/framework/symbols/windows/callbacks-x86.json rename to volatility3/framework/symbols/windows/callbacks-x86.json diff --git a/volatility/framework/symbols/windows/crash.json b/volatility3/framework/symbols/windows/crash.json similarity index 100% rename from volatility/framework/symbols/windows/crash.json rename to volatility3/framework/symbols/windows/crash.json diff --git a/volatility/framework/symbols/windows/crash64.json b/volatility3/framework/symbols/windows/crash64.json similarity index 100% rename from volatility/framework/symbols/windows/crash64.json rename to volatility3/framework/symbols/windows/crash64.json diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py similarity index 99% rename from volatility/framework/symbols/windows/extensions/__init__.py rename to volatility3/framework/symbols/windows/extensions/__init__.py index b320566aa..f402c800f 100755 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -9,11 +9,11 @@ import logging import math from typing import Iterable, Iterator, Optional, Union, Tuple, List -from volatility.framework import constants, exceptions, interfaces, objects, renderers, symbols -from volatility.framework.layers import intel -from volatility.framework.renderers import conversion -from volatility.framework.symbols import generic -from volatility.framework.symbols.windows.extensions import pool, pe, kdbg +from volatility3.framework import constants, exceptions, interfaces, objects, renderers, symbols +from volatility3.framework.layers import intel +from volatility3.framework.renderers import conversion +from volatility3.framework.symbols import generic +from volatility3.framework.symbols.windows.extensions import pool, pe, kdbg vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/windows/extensions/kdbg.py b/volatility3/framework/symbols/windows/extensions/kdbg.py similarity index 93% rename from volatility/framework/symbols/windows/extensions/kdbg.py rename to volatility3/framework/symbols/windows/extensions/kdbg.py index 6a98d62b9..437edf823 100644 --- a/volatility/framework/symbols/windows/extensions/kdbg.py +++ b/volatility3/framework/symbols/windows/extensions/kdbg.py @@ -2,8 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import constants -from volatility.framework import objects +from volatility3.framework import constants +from volatility3.framework import objects class KDDEBUGGER_DATA64(objects.StructType): diff --git a/volatility/framework/symbols/windows/extensions/network.py b/volatility3/framework/symbols/windows/extensions/network.py similarity index 97% rename from volatility/framework/symbols/windows/extensions/network.py rename to volatility3/framework/symbols/windows/extensions/network.py index c3f8d17cc..78b4c77d7 100644 --- a/volatility/framework/symbols/windows/extensions/network.py +++ b/volatility3/framework/symbols/windows/extensions/network.py @@ -6,10 +6,10 @@ import logging import socket from typing import Dict, Tuple, List, Union -from volatility.framework import exceptions -from volatility.framework import objects, interfaces -from volatility.framework.objects import Array -from volatility.framework.renderers import conversion +from volatility3.framework import exceptions +from volatility3.framework import objects, interfaces +from volatility3.framework.objects import Array +from volatility3.framework.renderers import conversion vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/windows/extensions/pe.py b/volatility3/framework/symbols/windows/extensions/pe.py similarity index 98% rename from volatility/framework/symbols/windows/extensions/pe.py rename to volatility3/framework/symbols/windows/extensions/pe.py index 39bbf00c0..b7b6d71df 100644 --- a/volatility/framework/symbols/windows/extensions/pe.py +++ b/volatility3/framework/symbols/windows/extensions/pe.py @@ -5,9 +5,9 @@ from typing import Generator, Tuple import logging -from volatility.framework import constants -from volatility.framework import objects, interfaces -from volatility.framework.renderers import conversion +from volatility3.framework import constants +from volatility3.framework import objects, interfaces +from volatility3.framework.renderers import conversion vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/windows/extensions/pool.py b/volatility3/framework/symbols/windows/extensions/pool.py similarity index 99% rename from volatility/framework/symbols/windows/extensions/pool.py rename to volatility3/framework/symbols/windows/extensions/pool.py index c029964af..895533840 100644 --- a/volatility/framework/symbols/windows/extensions/pool.py +++ b/volatility3/framework/symbols/windows/extensions/pool.py @@ -3,8 +3,8 @@ import logging import struct from typing import Optional, Tuple, List, Dict, Union -from volatility.framework import objects, interfaces, constants, symbols, exceptions, renderers -from volatility.framework.renderers import conversion +from volatility3.framework import objects, interfaces, constants, symbols, exceptions, renderers +from volatility3.framework.renderers import conversion vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py similarity index 98% rename from volatility/framework/symbols/windows/extensions/registry.py rename to volatility3/framework/symbols/windows/extensions/registry.py index cf15e6c18..3cf2469ff 100644 --- a/volatility/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -7,8 +7,8 @@ import logging import struct from typing import Optional, Iterable, Union -from volatility.framework import constants, exceptions, objects, interfaces -from volatility.framework.layers.registry import RegistryHive, RegistryInvalidIndex, RegistryFormatException +from volatility3.framework import constants, exceptions, objects, interfaces +from volatility3.framework.layers.registry import RegistryHive, RegistryInvalidIndex, RegistryFormatException vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/windows/extensions/services.py b/volatility3/framework/symbols/windows/extensions/services.py similarity index 96% rename from volatility/framework/symbols/windows/extensions/services.py rename to volatility3/framework/symbols/windows/extensions/services.py index fa372609e..5e04c51b6 100644 --- a/volatility/framework/symbols/windows/extensions/services.py +++ b/volatility3/framework/symbols/windows/extensions/services.py @@ -2,10 +2,10 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.framework import objects, interfaces -from volatility.framework import exceptions -from volatility.framework.symbols.wrappers import Flags -from volatility.framework import renderers +from volatility3.framework import objects, interfaces +from volatility3.framework import exceptions +from volatility3.framework.symbols.wrappers import Flags +from volatility3.framework import renderers from typing import Union diff --git a/volatility/framework/symbols/windows/kdbg.json b/volatility3/framework/symbols/windows/kdbg.json similarity index 100% rename from volatility/framework/symbols/windows/kdbg.json rename to volatility3/framework/symbols/windows/kdbg.json diff --git a/volatility/framework/symbols/windows/netscan-vista-sp12-x64.json b/volatility3/framework/symbols/windows/netscan-vista-sp12-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-vista-sp12-x64.json rename to volatility3/framework/symbols/windows/netscan-vista-sp12-x64.json diff --git a/volatility/framework/symbols/windows/netscan-vista-x64.json b/volatility3/framework/symbols/windows/netscan-vista-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-vista-x64.json rename to volatility3/framework/symbols/windows/netscan-vista-x64.json diff --git a/volatility/framework/symbols/windows/netscan-vista-x86.json b/volatility3/framework/symbols/windows/netscan-vista-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-vista-x86.json rename to volatility3/framework/symbols/windows/netscan-vista-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win10-14393-x86.json b/volatility3/framework/symbols/windows/netscan-win10-14393-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-14393-x86.json rename to volatility3/framework/symbols/windows/netscan-win10-14393-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win10-15063-x64.json b/volatility3/framework/symbols/windows/netscan-win10-15063-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-15063-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-15063-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-15063-x86.json b/volatility3/framework/symbols/windows/netscan-win10-15063-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-15063-x86.json rename to volatility3/framework/symbols/windows/netscan-win10-15063-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win10-16299-x64.json b/volatility3/framework/symbols/windows/netscan-win10-16299-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-16299-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-16299-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-17134-x64.json b/volatility3/framework/symbols/windows/netscan-win10-17134-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-17134-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-17134-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-17134-x86.json b/volatility3/framework/symbols/windows/netscan-win10-17134-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-17134-x86.json rename to volatility3/framework/symbols/windows/netscan-win10-17134-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win10-17763-x64.json b/volatility3/framework/symbols/windows/netscan-win10-17763-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-17763-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-17763-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-18363-x64.json b/volatility3/framework/symbols/windows/netscan-win10-18363-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-18363-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-18363-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-19041-x64.json b/volatility3/framework/symbols/windows/netscan-win10-19041-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-19041-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-19041-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-19041-x86.json b/volatility3/framework/symbols/windows/netscan-win10-19041-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-19041-x86.json rename to volatility3/framework/symbols/windows/netscan-win10-19041-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win10-x64.json b/volatility3/framework/symbols/windows/netscan-win10-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-x64.json rename to volatility3/framework/symbols/windows/netscan-win10-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win10-x86.json b/volatility3/framework/symbols/windows/netscan-win10-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win10-x86.json rename to volatility3/framework/symbols/windows/netscan-win10-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win7-x64.json b/volatility3/framework/symbols/windows/netscan-win7-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win7-x64.json rename to volatility3/framework/symbols/windows/netscan-win7-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win7-x86.json b/volatility3/framework/symbols/windows/netscan-win7-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win7-x86.json rename to volatility3/framework/symbols/windows/netscan-win7-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win8-x64.json b/volatility3/framework/symbols/windows/netscan-win8-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win8-x64.json rename to volatility3/framework/symbols/windows/netscan-win8-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win8-x86.json b/volatility3/framework/symbols/windows/netscan-win8-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win8-x86.json rename to volatility3/framework/symbols/windows/netscan-win8-x86.json diff --git a/volatility/framework/symbols/windows/netscan-win81-x64.json b/volatility3/framework/symbols/windows/netscan-win81-x64.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win81-x64.json rename to volatility3/framework/symbols/windows/netscan-win81-x64.json diff --git a/volatility/framework/symbols/windows/netscan-win81-x86.json b/volatility3/framework/symbols/windows/netscan-win81-x86.json similarity index 100% rename from volatility/framework/symbols/windows/netscan-win81-x86.json rename to volatility3/framework/symbols/windows/netscan-win81-x86.json diff --git a/volatility/framework/symbols/windows/pdb.json b/volatility3/framework/symbols/windows/pdb.json similarity index 100% rename from volatility/framework/symbols/windows/pdb.json rename to volatility3/framework/symbols/windows/pdb.json diff --git a/volatility/framework/symbols/windows/pdbconv.py b/volatility3/framework/symbols/windows/pdbconv.py similarity index 99% rename from volatility/framework/symbols/windows/pdbconv.py rename to volatility3/framework/symbols/windows/pdbconv.py index d2dbcfc50..5116b8f78 100644 --- a/volatility/framework/symbols/windows/pdbconv.py +++ b/volatility3/framework/symbols/windows/pdbconv.py @@ -10,8 +10,8 @@ from bisect import bisect from typing import Tuple, Dict, Any, Optional, Union, List from urllib import request, error -from volatility.framework import contexts, interfaces, constants -from volatility.framework.layers import physical, msf, resources +from volatility3.framework import contexts, interfaces, constants +from volatility3.framework.layers import physical, msf, resources vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py similarity index 96% rename from volatility/framework/symbols/windows/pdbutil.py rename to volatility3/framework/symbols/windows/pdbutil.py index 7e1558304..653c953b1 100644 --- a/volatility/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -11,11 +11,11 @@ import struct from typing import Any, Dict, Generator, List, Optional, Tuple, Union from urllib import request -from volatility import symbols -from volatility.framework import constants, interfaces -from volatility.framework.configuration.requirements import SymbolTableRequirement -from volatility.framework.symbols import intermed -from volatility.framework.symbols.windows import pdbconv +from volatility3 import symbols +from volatility3.framework import constants, interfaces +from volatility3.framework.configuration.requirements import SymbolTableRequirement +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import pdbconv vollog = logging.getLogger(__name__) @@ -29,7 +29,7 @@ class PDBUtility: context: interfaces.context.ContextInterface, layer_name: str, offset: int, - symbol_table_class: str = "volatility.framework.symbols.intermed.IntermediateSymbolTable", + symbol_table_class: str = "volatility3.framework.symbols.intermed.IntermediateSymbolTable", config_path: str = None, progress_callback: constants.ProgressCallback = None) -> Optional[str]: """Produces the name of a symbol table loaded from the offset for an MZ header @@ -274,7 +274,7 @@ class PDBUtility: class PdbSignatureScanner(interfaces.layers.ScannerInterface): - """A :class:`~volatility.framework.interfaces.layers.ScannerInterface` + """A :class:`~volatility3.framework.interfaces.layers.ScannerInterface` based scanner use to identify Windows PDB records. Args: diff --git a/volatility/framework/symbols/windows/pe.json b/volatility3/framework/symbols/windows/pe.json similarity index 100% rename from volatility/framework/symbols/windows/pe.json rename to volatility3/framework/symbols/windows/pe.json diff --git a/volatility/framework/symbols/windows/poolheader-x64-win7.json b/volatility3/framework/symbols/windows/poolheader-x64-win7.json similarity index 100% rename from volatility/framework/symbols/windows/poolheader-x64-win7.json rename to volatility3/framework/symbols/windows/poolheader-x64-win7.json diff --git a/volatility/framework/symbols/windows/poolheader-x64.json b/volatility3/framework/symbols/windows/poolheader-x64.json similarity index 100% rename from volatility/framework/symbols/windows/poolheader-x64.json rename to volatility3/framework/symbols/windows/poolheader-x64.json diff --git a/volatility/framework/symbols/windows/poolheader-x86.json b/volatility3/framework/symbols/windows/poolheader-x86.json similarity index 100% rename from volatility/framework/symbols/windows/poolheader-x86.json rename to volatility3/framework/symbols/windows/poolheader-x86.json diff --git a/volatility/framework/symbols/windows/registry.json b/volatility3/framework/symbols/windows/registry.json similarity index 100% rename from volatility/framework/symbols/windows/registry.json rename to volatility3/framework/symbols/windows/registry.json diff --git a/volatility/framework/symbols/windows/services-vista-x64.json b/volatility3/framework/symbols/windows/services-vista-x64.json similarity index 100% rename from volatility/framework/symbols/windows/services-vista-x64.json rename to volatility3/framework/symbols/windows/services-vista-x64.json diff --git a/volatility/framework/symbols/windows/services-vista-x86.json b/volatility3/framework/symbols/windows/services-vista-x86.json similarity index 100% rename from volatility/framework/symbols/windows/services-vista-x86.json rename to volatility3/framework/symbols/windows/services-vista-x86.json diff --git a/volatility/framework/symbols/windows/services-win10-15063-x64.json b/volatility3/framework/symbols/windows/services-win10-15063-x64.json similarity index 100% rename from volatility/framework/symbols/windows/services-win10-15063-x64.json rename to volatility3/framework/symbols/windows/services-win10-15063-x64.json diff --git a/volatility/framework/symbols/windows/services-win10-15063-x86.json b/volatility3/framework/symbols/windows/services-win10-15063-x86.json similarity index 100% rename from volatility/framework/symbols/windows/services-win10-15063-x86.json rename to volatility3/framework/symbols/windows/services-win10-15063-x86.json diff --git a/volatility/framework/symbols/windows/services-win10-16299-x64.json b/volatility3/framework/symbols/windows/services-win10-16299-x64.json similarity index 100% rename from volatility/framework/symbols/windows/services-win10-16299-x64.json rename to volatility3/framework/symbols/windows/services-win10-16299-x64.json diff --git a/volatility/framework/symbols/windows/services-win10-16299-x86.json b/volatility3/framework/symbols/windows/services-win10-16299-x86.json similarity index 100% rename from volatility/framework/symbols/windows/services-win10-16299-x86.json rename to volatility3/framework/symbols/windows/services-win10-16299-x86.json diff --git a/volatility/framework/symbols/windows/services-win8-x64.json b/volatility3/framework/symbols/windows/services-win8-x64.json similarity index 100% rename from volatility/framework/symbols/windows/services-win8-x64.json rename to volatility3/framework/symbols/windows/services-win8-x64.json diff --git a/volatility/framework/symbols/windows/services-win8-x86.json b/volatility3/framework/symbols/windows/services-win8-x86.json similarity index 100% rename from volatility/framework/symbols/windows/services-win8-x86.json rename to volatility3/framework/symbols/windows/services-win8-x86.json diff --git a/volatility/framework/symbols/windows/services-xp-2003-x64.json b/volatility3/framework/symbols/windows/services-xp-2003-x64.json similarity index 100% rename from volatility/framework/symbols/windows/services-xp-2003-x64.json rename to volatility3/framework/symbols/windows/services-xp-2003-x64.json diff --git a/volatility/framework/symbols/windows/services-xp-x86.json b/volatility3/framework/symbols/windows/services-xp-x86.json similarity index 100% rename from volatility/framework/symbols/windows/services-xp-x86.json rename to volatility3/framework/symbols/windows/services-xp-x86.json diff --git a/volatility/framework/symbols/windows/versions.py b/volatility3/framework/symbols/windows/versions.py similarity index 98% rename from volatility/framework/symbols/windows/versions.py rename to volatility3/framework/symbols/windows/versions.py index 3a7e84b5b..d38cdb701 100644 --- a/volatility/framework/symbols/windows/versions.py +++ b/volatility3/framework/symbols/windows/versions.py @@ -1,7 +1,7 @@ import logging from typing import Callable, Tuple, List, Optional -from volatility.framework import interfaces, constants, exceptions +from volatility3.framework import interfaces, constants, exceptions vollog = logging.getLogger(__name__) diff --git a/volatility/framework/symbols/wrappers.py b/volatility3/framework/symbols/wrappers.py similarity index 94% rename from volatility/framework/symbols/wrappers.py rename to volatility3/framework/symbols/wrappers.py index 307da4ec9..8cf51df23 100644 --- a/volatility/framework/symbols/wrappers.py +++ b/volatility3/framework/symbols/wrappers.py @@ -4,7 +4,7 @@ from typing import List, Mapping -from volatility.framework import interfaces +from volatility3.framework import interfaces class Flags: diff --git a/volatility/plugins/__init__.py b/volatility3/plugins/__init__.py similarity index 94% rename from volatility/plugins/__init__.py rename to volatility3/plugins/__init__.py index 8ecd9c946..6afa8baf4 100644 --- a/volatility/plugins/__init__.py +++ b/volatility3/plugins/__init__.py @@ -12,6 +12,6 @@ are dependent upon, please DO NOT alter or remove this file unless you know the The framework is configured this way to allow plugin developers/users to override any plugin functionality whether existing or new. """ -from volatility.framework import constants +from volatility3.framework import constants __path__ = constants.PLUGINS_PATH diff --git a/volatility/plugins/linux/__init__.py b/volatility3/plugins/linux/__init__.py similarity index 100% rename from volatility/plugins/linux/__init__.py rename to volatility3/plugins/linux/__init__.py diff --git a/volatility/plugins/mac/__init__.py b/volatility3/plugins/mac/__init__.py similarity index 100% rename from volatility/plugins/mac/__init__.py rename to volatility3/plugins/mac/__init__.py diff --git a/volatility/plugins/windows/__init__.py b/volatility3/plugins/windows/__init__.py similarity index 100% rename from volatility/plugins/windows/__init__.py rename to volatility3/plugins/windows/__init__.py diff --git a/volatility/plugins/windows/registry/__init__.py b/volatility3/plugins/windows/registry/__init__.py similarity index 100% rename from volatility/plugins/windows/registry/__init__.py rename to volatility3/plugins/windows/registry/__init__.py diff --git a/volatility/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py similarity index 93% rename from volatility/plugins/windows/registry/certificates.py rename to volatility3/plugins/windows/registry/certificates.py index 8fd574670..fac98423a 100644 --- a/volatility/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -1,10 +1,10 @@ import struct from typing import List, Iterator, Tuple -from volatility.framework import interfaces, renderers -from volatility.framework.configuration import requirements -from volatility.framework.symbols.windows.extensions.registry import RegValueTypes -from volatility.plugins.windows.registry import hivelist, printkey +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes +from volatility3.plugins.windows.registry import hivelist, printkey class Certificates(interfaces.plugins.PluginInterface): diff --git a/volatility/plugins/windows/statistics.py b/volatility3/plugins/windows/statistics.py similarity index 93% rename from volatility/plugins/windows/statistics.py rename to volatility3/plugins/windows/statistics.py index 2e637bf6f..e6f2016ed 100644 --- a/volatility/plugins/windows/statistics.py +++ b/volatility3/plugins/windows/statistics.py @@ -4,10 +4,10 @@ import logging from typing import List -from volatility.framework import renderers, exceptions, interfaces -from volatility.framework.configuration import requirements -from volatility.framework.interfaces import plugins -from volatility.framework.layers import intel +from volatility3.framework import renderers, exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.layers import intel vollog = logging.getLogger(__name__) diff --git a/volatility/schemas/__init__.py b/volatility3/schemas/__init__.py similarity index 98% rename from volatility/schemas/__init__.py rename to volatility3/schemas/__init__.py index 40bc235f4..ea7f0579d 100644 --- a/volatility/schemas/__init__.py +++ b/volatility3/schemas/__init__.py @@ -8,7 +8,7 @@ import logging import os from typing import Set, Any, Dict -from volatility.framework import constants +from volatility3.framework import constants vollog = logging.getLogger(__name__) diff --git a/volatility/schemas/schema-0.1.0.json b/volatility3/schemas/schema-0.1.0.json similarity index 100% rename from volatility/schemas/schema-0.1.0.json rename to volatility3/schemas/schema-0.1.0.json diff --git a/volatility/schemas/schema-2.0.0.json b/volatility3/schemas/schema-2.0.0.json similarity index 100% rename from volatility/schemas/schema-2.0.0.json rename to volatility3/schemas/schema-2.0.0.json diff --git a/volatility/schemas/schema-2.1.0.json b/volatility3/schemas/schema-2.1.0.json similarity index 100% rename from volatility/schemas/schema-2.1.0.json rename to volatility3/schemas/schema-2.1.0.json diff --git a/volatility/schemas/schema-4.0.0.json b/volatility3/schemas/schema-4.0.0.json similarity index 100% rename from volatility/schemas/schema-4.0.0.json rename to volatility3/schemas/schema-4.0.0.json diff --git a/volatility/schemas/schema-4.1.0.json b/volatility3/schemas/schema-4.1.0.json similarity index 100% rename from volatility/schemas/schema-4.1.0.json rename to volatility3/schemas/schema-4.1.0.json diff --git a/volatility/schemas/schema-6.0.0.json b/volatility3/schemas/schema-6.0.0.json similarity index 100% rename from volatility/schemas/schema-6.0.0.json rename to volatility3/schemas/schema-6.0.0.json diff --git a/volatility/schemas/schema-6.1.0.json b/volatility3/schemas/schema-6.1.0.json similarity index 100% rename from volatility/schemas/schema-6.1.0.json rename to volatility3/schemas/schema-6.1.0.json diff --git a/volatility/schemas/schema-6.2.0.json b/volatility3/schemas/schema-6.2.0.json similarity index 100% rename from volatility/schemas/schema-6.2.0.json rename to volatility3/schemas/schema-6.2.0.json diff --git a/volatility/symbols/__init__.py b/volatility3/symbols/__init__.py similarity index 89% rename from volatility/symbols/__init__.py rename to volatility3/symbols/__init__.py index e656d0649..c35f07cbe 100644 --- a/volatility/symbols/__init__.py +++ b/volatility3/symbols/__init__.py @@ -6,6 +6,6 @@ This is the namespace for all volatility symbols, and determines the path for loading symbol ISF files """ -from volatility.framework import constants +from volatility3.framework import constants __path__ = constants.SYMBOL_BASEPATHS diff --git a/volshell.py b/volshell.py index 4de304daf..590994324 100644 --- a/volshell.py +++ b/volshell.py @@ -4,7 +4,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility.cli import volshell +from volatility3.cli import volshell if __name__ == '__main__': volshell.main() diff --git a/volshell.spec b/volshell.spec index 832332c23..6654772ca 100644 --- a/volshell.spec +++ b/volshell.spec @@ -31,16 +31,16 @@ sys.path.append(os.getcwd()) vol_analysis = Analysis(['volshell.py'], pathex = [], binaries = binaries, - datas = collect_data_files('volatility.framework') + \ - collect_data_files('volatility.framework.automagic', include_py_files = True) + \ - collect_data_files('volatility.framework.plugins', include_py_files = True) + \ - collect_data_files('volatility.framework.layers', include_py_files = True) + \ - collect_data_files('volatility.cli', include_py_files = True) + \ - collect_data_files('volatility.schemas') + \ - collect_data_files('volatility.plugins', include_py_files = True), - hiddenimports = collect_submodules('volatility.framework.automagic') + \ - collect_submodules('volatility.framework.plugins') + \ - collect_submodules('volatility.framework.symbols'), + datas = collect_data_files('volatility3.framework') + \ + collect_data_files('volatility3.framework.automagic', include_py_files = True) + \ + collect_data_files('volatility3.framework.plugins', include_py_files = True) + \ + collect_data_files('volatility3.framework.layers', include_py_files = True) + \ + collect_data_files('volatility3.cli', include_py_files = True) + \ + collect_data_files('volatility3.schemas') + \ + collect_data_files('volatility3.plugins', include_py_files = True), + hiddenimports = collect_submodules('volatility3.framework.automagic') + \ + collect_submodules('volatility3.framework.plugins') + \ + collect_submodules('volatility3.framework.symbols'), hookspath = [], runtime_hooks = [], excludes = [],