WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Core: Rename the top level namespace

Browse Source
This commit is contained in:
Mike Auty
2021-01-20 21:21:16 +00:00
parent 1477887831
commit 3911098d27
248 changed files with 813 additions and 813 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+3 -3
View File
@@ -14,9 +14,9 @@ workspace.xml
# Manually generated files
.mypy_cache
stubs
volatility/symbols/linux*
volatility/symbols/windows*
volatility/symbols/mac*
volatility3/symbols/linux*
volatility3/symbols/windows*
volatility3/symbols/mac*
# Mac metadata files
.DS_Store
development/schema_validate.py
+1 -1
View File
@@ -17,7 +17,7 @@ logger = logging.getLogger("")
logger.addHandler(console)
logger.setLevel(logging.DEBUG)
from volatility import schemas
from volatility3 import schemas
if __name__ == '__main__':
parser = argparse.ArgumentParser("Validates ")
doc/source/conf.py
+12 -12
View File
@@ -21,18 +21,18 @@ import sphinx.ext.apidoc
def setup(app):
volatility_directory = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..', 'volatility'))
volatility_directory = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..', 'volatility3'))
source_dir = os.path.abspath(os.path.dirname(__file__))
sphinx.ext.apidoc.main(argv = ['-e', '-M', '-f', '-T', '-o', source_dir, volatility_directory])
# Go through the volatility.framework.plugins files and change them to volatility.plugins
# Go through the volatility3.framework.plugins files and change them to volatility3.plugins
for dir, _, files in os.walk(os.path.dirname(__file__)):
for filename in files:
if filename.startswith('volatility.framework.plugins') and filename != 'volatility.framework.plugins.rst':
# Change all volatility.framework.plugins to volatility.plugins in the file
if filename.startswith('volatility3.framework.plugins') and filename != 'volatility3.framework.plugins.rst':
# Change all volatility3.framework.plugins to volatility3.plugins in the file
# Rename the file
new_filename = filename.replace('volatility.framework.plugins', 'volatility.plugins')
new_filename = filename.replace('volatility3.framework.plugins', 'volatility3.plugins')
replace_string = b"Submodules\n----------\n\n.. toctree::\n\n"
submodules = replace_string
@@ -48,22 +48,22 @@ def setup(app):
with open(os.path.join(dir, new_filename), 'wb') as newfile:
with open(os.path.join(dir, filename), "rb") as oldfile:
line = oldfile.read()
correct_plugins = line.replace(b'volatility.framework.plugins', b'volatility.plugins')
correct_plugins = line.replace(b'volatility3.framework.plugins', b'volatility3.plugins')
correct_submodules = correct_plugins.replace(replace_string, submodules)
newfile.write(correct_submodules)
os.remove(os.path.join(dir, filename))
elif filename == 'volatility.framework.rst':
elif filename == 'volatility3.framework.rst':
with open(os.path.join(dir, filename), "rb") as contents:
lines = contents.readlines()
plugins_seen = False
with open(os.path.join(dir, filename), "wb") as contents:
for line in lines:
if b'volatility.framework.plugins' in line:
if b'volatility3.framework.plugins' in line:
plugins_seen = True
if plugins_seen and line == b'':
contents.write(b' volatility.plugins')
contents.write(b' volatility3.plugins')
contents.write(line)
elif filename == 'volatility.plugins.rst':
elif filename == 'volatility3.plugins.rst':
with open(os.path.join(dir, filename), "rb") as contents:
lines = contents.readlines()
with open(os.path.join(dir, 'volatility.framework.plugins.rst'), "rb") as contents:
@@ -82,7 +82,7 @@ def setup(app):
for line in lines:
contents.write(line)
for line in submodule_lines:
contents.write(line.replace(b'volatility.framework.plugins', b'volatility.plugins'))
contents.write(line.replace(b'volatility3.framework.plugins', b'volatility3.plugins'))
# If extensions (or modules to document with autodoc) are in another directory,
@@ -90,7 +90,7 @@ def setup(app):
# documentation root, use os.path.abspath to make it absolute, like shown here.
sys.path.insert(0, os.path.abspath('../..'))
from volatility.framework import constants
from volatility3.framework import constants
# -- General configuration ------------------------------------------------
setup.py
+4 -4
View File
@@ -4,9 +4,9 @@
import setuptools
from volatility.framework import constants
from volatility3.framework import constants
setuptools.setup(name = "volatility",
setuptools.setup(name = "volatility3",
description = "Memory forensics framework",
version = constants.PACKAGE_VERSION,
license = "VSL",
@@ -27,8 +27,8 @@ setuptools.setup(name = "volatility",
packages = setuptools.find_packages(exclude = ["development", "development.*"]),
entry_points = {
'console_scripts': [
'vol = volatility.cli:main',
'volshell = volatility.cli.volshell:main',
'vol = volatility3.cli:main',
'volshell = volatility3.cli.volshell:main',
],
},
install_requires = ["pefile"],
vol.py
+2 -2
View File
@@ -4,7 +4,7 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
import volatility.cli
import volatility3.cli
if __name__ == '__main__':
volatility.cli.main()
volatility3.cli.main()
vol.spec
+19 -19
View File
@@ -31,15 +31,15 @@ sys.path.append(os.getcwd())
vol_analysis = Analysis(['vol.py'],
pathex = [],
binaries = binaries,
datas = collect_data_files('volatility.framework') + \
collect_data_files('volatility.framework.automagic', include_py_files = True) + \
collect_data_files('volatility.framework.plugins', include_py_files = True) + \
collect_data_files('volatility.framework.layers', include_py_files = True) + \
collect_data_files('volatility.schemas') + \
collect_data_files('volatility.plugins', include_py_files = True),
hiddenimports = collect_submodules('volatility.framework.automagic') + \
collect_submodules('volatility.framework.plugins') + \
collect_submodules('volatility.framework.symbols'),
datas = collect_data_files('volatility3.framework') + \
collect_data_files('volatility3.framework.automagic', include_py_files = True) + \
collect_data_files('volatility3.framework.plugins', include_py_files = True) + \
collect_data_files('volatility3.framework.layers', include_py_files = True) + \
collect_data_files('volatility3.schemas') + \
collect_data_files('volatility3.plugins', include_py_files = True),
hiddenimports = collect_submodules('volatility3.framework.automagic') + \
collect_submodules('volatility3.framework.plugins') + \
collect_submodules('volatility3.framework.symbols'),
hookspath = [],
runtime_hooks = [],
excludes = [],
@@ -55,16 +55,16 @@ vol_analysis = Analysis(['vol.py'],
# volshell_analysis = Analysis(['volshell.py'],
# pathex = [],
# binaries = [],
# datas = collect_data_files('volatility.framework') + \
# collect_data_files('volatility.framework.automagic', include_py_files = True) + \
# collect_data_files('volatility.framework.plugins', include_py_files = True) + \
# collect_data_files('volatility.framework.layers', include_py_files = True) + \
# collect_data_files('volatility.cli', include_py_files = True) + \
# collect_data_files('volatility.schemas') + \
# collect_data_files('volatility.plugins', include_py_files = True),
# hiddenimports = collect_submodules('volatility.framework.automagic') + \
# collect_submodules('volatility.framework.plugins') + \
# collect_submodules('volatility.framework.symbols'),
# datas = collect_data_files('volatility3.framework') + \
# collect_data_files('volatility3.framework.automagic', include_py_files = True) + \
# collect_data_files('volatility3.framework.plugins', include_py_files = True) + \
# collect_data_files('volatility3.framework.layers', include_py_files = True) + \
# collect_data_files('volatility3.cli', include_py_files = True) + \
# collect_data_files('volatility3.schemas') + \
# collect_data_files('volatility3.plugins', include_py_files = True),
# hiddenimports = collect_submodules('volatility3.framework.automagic') + \
# collect_submodules('volatility3.framework.plugins') + \
# collect_submodules('volatility3.framework.symbols'),
# hookspath = [],
# runtime_hooks = [],
# excludes = [],
volatility/__init__.py → volatility3/__init__.py
+9 -9
View File
@@ -35,8 +35,8 @@ class WarningFindSpec(abc.MetaPathFinder):
def find_spec(fullname: str, path: Optional[List[str]], target: None = None, **kwargs) -> None:
"""Mock find_spec method that just checks the name, this must go
first."""
if fullname.startswith("volatility.framework.plugins."):
warning = "Please do not use the volatility.framework.plugins namespace directly, only use volatility.plugins"
if fullname.startswith("volatility3.framework.plugins."):
warning = "Please do not use the volatility3.framework.plugins namespace directly, only use volatility3.plugins"
# Pyinstaller uses walk_packages to import, but needs to read the modules to figure out dependencies
# As such, we only print the warning when directly imported rather than from within walk_packages
if inspect.stack()[-2].function != 'walk_packages':
@@ -46,17 +46,17 @@ class WarningFindSpec(abc.MetaPathFinder):
warning_find_spec = [WarningFindSpec()] # type: List[abc.MetaPathFinder]
sys.meta_path = warning_find_spec + sys.meta_path
# We point the volatility.plugins __path__ variable at BOTH
# volatility/plugins
# volatility/framework/plugins
# We point the volatility3.plugins __path__ variable at BOTH
# volatility3/plugins
# volatility3/framework/plugins
# in that order.
#
# This will allow our users to override any component of any plugin without monkey patching,
# but it also allows us to clear out the plugins directory to get back to proper functionality.
# This offered the greatest flexibility for users whilst allowing us to keep the core separate and clean.
#
# This means that all plugins should be imported as volatility.plugins (otherwise they'll be imported twice,
# once as volatility.plugins.NAME and once as volatility.framework.plugins.NAME). We therefore throw an error
# if anyone tries to import anything under the volatility.framework.plugins.* namespace
# This means that all plugins should be imported as volatility3.plugins (otherwise they'll be imported twice,
# once as volatility3.plugins.NAME and once as volatility3.framework.plugins.NAME). We therefore throw an error
# if anyone tries to import anything under the volatility3.framework.plugins.* namespace
#
# The remediation is to only ever import form volatility.plugins instead.
# The remediation is to only ever import form volatility3.plugins instead.
volatility/cli/__init__.py → volatility3/cli/__init__.py
+23 -23
View File
@@ -22,13 +22,13 @@ import traceback
from typing import Dict, Type, Union, Any
from urllib import parse, request
import volatility.plugins
import volatility.symbols
from volatility import framework
from volatility.cli import text_renderer, volargparse
from volatility.framework import automagic, constants, contexts, exceptions, interfaces, plugins, configuration
from volatility.framework.automagic import stacker
from volatility.framework.configuration import requirements
import volatility3.plugins
import volatility3.symbols
from volatility3 import framework
from volatility3.cli import text_renderer, volargparse
from volatility3.framework import automagic, constants, contexts, exceptions, interfaces, plugins, configuration
from volatility3.framework.automagic import stacker
from volatility3.framework.configuration import requirements
# Make sure we log everything
@@ -71,7 +71,7 @@ class MuteProgress(PrintedProgress):
class CommandLine:
"""Constructs a command-line interface object for users to run plugins."""
CLI_NAME = 'volatility'
CLI_NAME = 'volatility3'
def __init__(self):
self.setup_logging()
@@ -79,7 +79,7 @@ class CommandLine:
@classmethod
def setup_logging(cls):
# Delay the setting of vollog for those that want to import volatility.cli (issue #241)
# Delay the setting of vollog for those that want to import volatility3.cli (issue #241)
vollog.setLevel(1)
vollog.addHandler(console)
@@ -87,7 +87,7 @@ class CommandLine:
"""Executes the command line module, taking the system arguments,
determining the plugin to run and then running it."""
volatility.framework.require_interface_version(2, 0, 0)
volatility3.framework.require_interface_version(2, 0, 0)
renderers = dict([(x.name.lower(), x) for x in framework.class_subclasses(text_renderer.CLIRenderer)])
@@ -172,12 +172,12 @@ class CommandLine:
banner_output.write("Volatility 3 Framework {}\n".format(constants.PACKAGE_VERSION))
if partial_args.plugin_dirs:
volatility.plugins.__path__ = [os.path.abspath(p)
for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH
volatility3.plugins.__path__ = [os.path.abspath(p)
for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH
if partial_args.symbol_dirs:
volatility.symbols.__path__ = [os.path.abspath(p)
for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS
volatility3.symbols.__path__ = [os.path.abspath(p)
for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS
if partial_args.log:
file_logger = logging.FileHandler(partial_args.log)
@@ -192,8 +192,8 @@ class CommandLine:
else:
console.setLevel(10 - (partial_args.verbosity - 2))
vollog.info("Volatility plugins path: {}".format(volatility.plugins.__path__))
vollog.info("Volatility symbols path: {}".format(volatility.symbols.__path__))
vollog.info("Volatility plugins path: {}".format(volatility3.plugins.__path__))
vollog.info("Volatility symbols path: {}".format(volatility3.symbols.__path__))
# Set the PARALLELISM
if partial_args.parallelism == 'processes':
@@ -208,7 +208,7 @@ class CommandLine:
# Do the initialization
ctx = contexts.Context() # Construct a blank context
failures = framework.import_files(volatility.plugins,
failures = framework.import_files(volatility3.plugins,
True) # Will not log as console's default level is WARNING
if failures:
parser.epilog = "The following plugins could not be loaded (use -vv to see why): " + \
@@ -342,7 +342,7 @@ class CommandLine:
caused_by = [
"Memory smear during acquisition (try re-acquiring if possible)",
"An intentionally invalid page lookup (operating system protection)",
"A bug in the plugin/volatility (re-run with -vvv and file a bug)"
"A bug in the plugin/volatility3 (re-run with -vvv and file a bug)"
]
else:
detail = "{} in layer {} ({})".format(hex(excp.invalid_address), excp.layer_name, excp)
@@ -350,7 +350,7 @@ class CommandLine:
"The base memory file being incomplete (try re-acquiring if possible)",
"Memory smear during acquisition (try re-acquiring if possible)",
"An intentionally invalid page lookup (operating system protection)",
"A bug in the plugin/volatility (re-run with -vvv and file a bug)"
"A bug in the plugin/volatility3 (re-run with -vvv and file a bug)"
]
elif isinstance(excp, exceptions.SymbolError):
general = "Volatility experienced a symbol-related issue:"
@@ -414,7 +414,7 @@ class CommandLine:
print("\nA translation layer requirement was not fulfilled. Please verify that:\n"
"\tA file was provided to create this layer (by -f, --single-location or by config)\n"
"\tThe file exists and is readable\n"
"\tThe necessary symbols are present and identified by volatility")
"\tThe necessary symbols are present and identified by volatility3")
def populate_config(self, context: interfaces.context.ContextInterface,
configurables_list: Dict[str, Type[interfaces.configuration.ConfigurableInterface]],
@@ -424,7 +424,7 @@ class CommandLine:
We have already determined these elements must be descended from ConfigurableInterface
Args:
context: The volatility context to operate on
context: The volatility3 context to operate on
configurables_list: A dictionary of configurable items that can be configured on the plugin
args: An object containing the arguments necessary
plugin_config_path: The path within the context's config containing the plugin's configuration
@@ -564,11 +564,11 @@ class CommandLine:
additional["action"] = "store_true"
if "type" in additional:
del additional["type"]
elif isinstance(requirement, volatility.framework.configuration.requirements.ListRequirement):
elif isinstance(requirement, volatility3.framework.configuration.requirements.ListRequirement):
additional["type"] = requirement.element_type
nargs = '*' if requirement.optional else '+'
additional["nargs"] = nargs
elif isinstance(requirement, volatility.framework.configuration.requirements.ChoiceRequirement):
elif isinstance(requirement, volatility3.framework.configuration.requirements.ChoiceRequirement):
additional["type"] = str
additional["choices"] = requirement.choices
else:
volatility/cli/text_renderer.py → volatility3/cli/text_renderer.py
+2 -2
View File
@@ -10,8 +10,8 @@ import sys
from functools import wraps
from typing import Callable, Any, List, Tuple, Dict
from volatility.framework import interfaces, renderers
from volatility.framework.renderers import format_hints
from volatility3.framework import interfaces, renderers
from volatility3.framework.renderers import format_hints
vollog = logging.getLogger(__name__)
volatility/cli/volargparse.py → volatility3/cli/volargparse.py
View File
volatility/cli/volshell/__init__.py → volatility3/cli/volshell/__init__.py
+12 -12
View File
@@ -9,11 +9,11 @@ import os
import sys
from urllib import request
import volatility.plugins
import volatility.symbols
from volatility import cli, framework
from volatility.cli.volshell import generic, windows, linux, mac
from volatility.framework import automagic, constants, contexts, exceptions, interfaces, plugins
import volatility3.plugins
import volatility3.symbols
from volatility3 import cli, framework
from volatility3.cli.volshell import generic, windows, linux, mac
from volatility3.framework import automagic, constants, contexts, exceptions, interfaces, plugins
# Make sure we log everything
vollog = logging.getLogger()
@@ -104,15 +104,15 @@ class VolShell(cli.CommandLine):
known_args = [arg for arg in sys.argv if arg != '--help' and arg != '-h']
partial_args, _ = parser.parse_known_args(known_args)
if partial_args.plugin_dirs:
volatility.plugins.__path__ = [os.path.abspath(p)
for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH
volatility3.plugins.__path__ = [os.path.abspath(p)
for p in partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH
if partial_args.symbol_dirs:
volatility.symbols.__path__ = [os.path.abspath(p)
for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS
volatility3.symbols.__path__ = [os.path.abspath(p)
for p in partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS
vollog.info("Volatility plugins path: {}".format(volatility.plugins.__path__))
vollog.info("Volatility symbols path: {}".format(volatility.symbols.__path__))
vollog.info("Volatility plugins path: {}".format(volatility3.plugins.__path__))
vollog.info("Volatility symbols path: {}".format(volatility3.symbols.__path__))
if partial_args.log:
file_logger = logging.FileHandler(partial_args.log)
@@ -134,7 +134,7 @@ class VolShell(cli.CommandLine):
# Do the initialization
ctx = contexts.Context() # Construct a blank context
failures = framework.import_files(volatility.plugins,
failures = framework.import_files(volatility3.plugins,
True) # Will not log as console's default level is WARNING
if failures:
parser.epilog = "The following plugins could not be loaded (use -vv to see why): " + \
volatility/cli/volshell/generic.py → volatility3/cli/volshell/generic.py
+4 -4
View File
@@ -11,10 +11,10 @@ import sys
from typing import Any, Dict, List, Optional, Tuple, Union, Type
from urllib import request
from volatility.cli import text_renderer
from volatility.framework import renderers, interfaces, objects, plugins, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.layers import intel, physical
from volatility3.cli import text_renderer
from volatility3.framework import renderers, interfaces, objects, plugins, exceptions
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import intel, physical
try:
import capstone
volatility/cli/volshell/linux.py → volatility3/cli/volshell/linux.py
+4 -4
View File
@@ -4,10 +4,10 @@
from typing import Any, List, Tuple, Union
from volatility.cli.volshell import generic
from volatility.framework import interfaces, constants
from volatility.framework.configuration import requirements
from volatility.plugins.linux import pslist
from volatility3.cli.volshell import generic
from volatility3.framework import interfaces, constants
from volatility3.framework.configuration import requirements
from volatility3.plugins.linux import pslist
class Volshell(generic.Volshell):
volatility/cli/volshell/mac.py → volatility3/cli/volshell/mac.py
+4 -4
View File
@@ -4,10 +4,10 @@
from typing import Any, List, Tuple, Union
from volatility.cli.volshell import generic
from volatility.framework import constants, interfaces
from volatility.framework.configuration import requirements
from volatility.plugins.mac import pslist
from volatility3.cli.volshell import generic
from volatility3.framework import constants, interfaces
from volatility3.framework.configuration import requirements
from volatility3.plugins.mac import pslist
class Volshell(generic.Volshell):
volatility/cli/volshell/windows.py → volatility3/cli/volshell/windows.py
+4 -4
View File
@@ -4,10 +4,10 @@
from typing import Any, List, Tuple, Union
from volatility.cli.volshell import generic
from volatility.framework import interfaces, constants
from volatility.framework.configuration import requirements
from volatility.plugins.windows import pslist
from volatility3.cli.volshell import generic
from volatility3.framework import interfaces, constants
from volatility3.framework.configuration import requirements
from volatility3.plugins.windows import pslist
class Volshell(generic.Volshell):
volatility/framework/__init__.py → volatility3/framework/__init__.py
+3 -3
View File
@@ -19,7 +19,7 @@ import logging
import os
from typing import Any, Dict, Generator, List, Tuple, Type, TypeVar
from volatility.framework import constants, interfaces
from volatility3.framework import constants, interfaces
# ##
#
@@ -120,8 +120,8 @@ def list_plugins() -> Dict[str, Type[interfaces.plugins.PluginInterface]]:
plugin_list = {}
for plugin in class_subclasses(interfaces.plugins.PluginInterface):
plugin_name = plugin.__module__ + "." + plugin.__name__
if plugin_name.startswith("volatility.plugins."):
plugin_name = plugin_name[len("volatility.plugins."):]
if plugin_name.startswith("volatility3.plugins."):
plugin_name = plugin_name[len("volatility3.plugins."):]
plugin_list[plugin_name] = plugin
return plugin_list
volatility/framework/automagic/__init__.py → volatility3/framework/automagic/__init__.py
+6 -6
View File
@@ -16,8 +16,8 @@ import sys
import traceback
from typing import List, Type, Union
from volatility.framework import class_subclasses, import_files, interfaces, constants
from volatility.framework.configuration import requirements
from volatility3.framework import class_subclasses, import_files, interfaces, constants
from volatility3.framework.configuration import requirements
vollog = logging.getLogger(__name__)
@@ -30,7 +30,7 @@ mac_automagic = ['ConstructionMagic', 'LayerStacker', 'MacBannerCache', 'MacSymb
def available(context: interfaces.context.ContextInterface) -> List[interfaces.automagic.AutomagicInterface]:
"""Returns an ordered list of all subclasses of
:class:`~volatility.framework.interfaces.automagic.AutomagicInterface`.
:class:`~volatility3.framework.interfaces.automagic.AutomagicInterface`.
The order is based on the priority attributes of the subclasses, in order to ensure the automagics are listed in
an appropriate order.
@@ -90,9 +90,9 @@ def run(automagics: List[interfaces.automagic.AutomagicInterface],
changes to the context.
Args:
automagics: A list of :class:`~volatility.framework.interfaces.automagic.AutomagicInterface` objects
context: The context (that inherits from :class:`~volatility.framework.interfaces.context.ContextInterface`) for modification
configurable: An object that inherits from :class:`~volatility.framework.interfaces.configuration.ConfigurableInterface`
automagics: A list of :class:`~volatility3.framework.interfaces.automagic.AutomagicInterface` objects
context: The context (that inherits from :class:`~volatility3.framework.interfaces.context.ContextInterface`) for modification
configurable: An object that inherits from :class:`~volatility3.framework.interfaces.configuration.ConfigurableInterface`
config_path: The path within the `context.config` for options required by the `configurable`
progress_callback: A function that takes a percentage (and an optional description) that will be called periodically
volatility/framework/automagic/construct_layers.py → volatility3/framework/automagic/construct_layers.py
+7 -7
View File
@@ -2,16 +2,16 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
"""An automagic module to use configuration data to configure and then
construct classes that fulfill the descendants of a :class:`~volatility.framewo
construct classes that fulfill the descendants of a :class:`~volatility3.framewo
rk.interfaces.configuration.ConfigurableInterface`."""
import logging
import sys
from typing import List
from volatility import framework
from volatility.framework import constants
from volatility.framework import interfaces
from volatility3 import framework
from volatility3.framework import constants
from volatility3.framework import interfaces
vollog = logging.getLogger(__name__)
@@ -19,9 +19,9 @@ vollog = logging.getLogger(__name__)
class ConstructionMagic(interfaces.automagic.AutomagicInterface):
"""Constructs underlying layers.
Class to run through the requirement tree of the :class:`~volatility.framework.interfaces.configuration.ConfigurableInterface`
Class to run through the requirement tree of the :class:`~volatility3.framework.interfaces.configuration.ConfigurableInterface`
and from the bottom of the tree upwards, attempt to construct all
:class:`~volatility.framework.interfaces.configuration.ConstructableRequirementInterface` based classes.
:class:`~volatility3.framework.interfaces.configuration.ConstructableRequirementInterface` based classes.
:warning: This `automagic` should run first to allow existing configurations to have been constructed for use by later automagic
"""
@@ -35,7 +35,7 @@ class ConstructionMagic(interfaces.automagic.AutomagicInterface):
optional = False) -> List[str]:
# Make sure we import the layers, so they can reconstructed
framework.import_files(sys.modules['volatility.framework.layers'])
framework.import_files(sys.modules['volatility3.framework.layers'])
result = [] # type: List[str]
if requirement.unsatisfied(context, config_path):
volatility/framework/automagic/linux.py → volatility3/framework/automagic/linux.py
+5 -5
View File
@@ -5,10 +5,10 @@
import logging
from typing import Optional, Tuple, Type
from volatility.framework import interfaces, constants
from volatility.framework.automagic import symbol_cache, symbol_finder
from volatility.framework.layers import intel, scanners
from volatility.framework.symbols import linux
from volatility3.framework import interfaces, constants
from volatility3.framework.automagic import symbol_cache, symbol_finder
from volatility3.framework.layers import intel, scanners
from volatility3.framework.symbols import linux
vollog = logging.getLogger(__name__)
@@ -153,5 +153,5 @@ class LinuxSymbolFinder(symbol_finder.SymbolFinder):
banner_config_key = "kernel_banner"
banner_cache = LinuxBannerCache
symbol_class = "volatility.framework.symbols.linux.LinuxKernelIntermedSymbols"
symbol_class = "volatility3.framework.symbols.linux.LinuxKernelIntermedSymbols"
find_aslr = lambda cls, *args: LinuxIntelStacker.find_aslr(*args)[1]
volatility/framework/automagic/mac.py → volatility3/framework/automagic/mac.py
+5 -5
View File
@@ -6,10 +6,10 @@ import logging
import struct
from typing import Optional
from volatility.framework import interfaces, constants, layers
from volatility.framework.automagic import symbol_cache, symbol_finder
from volatility.framework.layers import intel, scanners
from volatility.framework.symbols import mac
from volatility3.framework import interfaces, constants, layers
from volatility3.framework.automagic import symbol_cache, symbol_finder
from volatility3.framework.layers import intel, scanners
from volatility3.framework.symbols import mac
vollog = logging.getLogger(__name__)
@@ -204,4 +204,4 @@ class MacSymbolFinder(symbol_finder.SymbolFinder):
banner_config_key = 'kernel_banner'
banner_cache = MacBannerCache
find_aslr = MacIntelStacker.find_aslr
symbol_class = "volatility.framework.symbols.mac.MacKernelIntermedSymbols"
symbol_class = "volatility3.framework.symbols.mac.MacKernelIntermedSymbols"
volatility/framework/automagic/pdbscan.py → volatility3/framework/automagic/pdbscan.py
+9 -9
View File
@@ -4,19 +4,19 @@
"""A module for scanning translation layers looking for Windows PDB records
from loaded PE files.
This module contains a standalone scanner, and also a :class:`~volatility.framework.interfaces.layers.ScannerInterface`
based scanner for use within the framework by calling :func:`~volatility.framework.interfaces.layers.DataLayerInterface.scan`.
This module contains a standalone scanner, and also a :class:`~volatility3.framework.interfaces.layers.ScannerInterface`
based scanner for use within the framework by calling :func:`~volatility3.framework.interfaces.layers.DataLayerInterface.scan`.
"""
import logging
import math
import os
from typing import Any, Dict, Iterable, List, Optional, Set, Tuple, Union
from volatility.framework import constants, exceptions, interfaces, layers
from volatility.framework.configuration import requirements
from volatility.framework.layers import intel, scanners
from volatility.framework.symbols import native
from volatility.framework.symbols.windows.pdbutil import PDBUtility
from volatility3.framework import constants, exceptions, interfaces, layers
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import intel, scanners
from volatility3.framework.symbols import native
from volatility3.framework.symbols.windows.pdbutil import PDBUtility
if __name__ == "__main__":
import sys
@@ -55,7 +55,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
Args:
context: The context in which the `requirement` lives
config_path: The path within the `context` for the `requirement`'s configuration variables
requirement: The root of the requirement tree to search for :class:~`volatility.framework.interfaces.layers.TranslationLayerRequirement` objects to scan
requirement: The root of the requirement tree to search for :class:~`volatility3.framework.interfaces.layers.TranslationLayerRequirement` objects to scan
progress_callback: Means of providing the user with feedback during long processes
Returns:
@@ -105,7 +105,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
guid = kernel['GUID'],
age = kernel['age'],
pdb_name = kernel['pdb_name'],
symbol_table_class = "volatility.framework.symbols.windows.WindowsKernelIntermedSymbols",
symbol_table_class = "volatility3.framework.symbols.windows.WindowsKernelIntermedSymbols",
config_path = sub_config_path,
progress_callback = progress_callback)
else:
volatility/framework/automagic/stacker.py → volatility3/framework/automagic/stacker.py
+10 -10
View File
@@ -3,7 +3,7 @@
#
"""This module attempts to automatically stack layers.
This automagic module fulfills :class:`~volatility.framework.interfaces.configuration.TranslationLayerRequirement` that are not already fulfilled, by attempting to
This automagic module fulfills :class:`~volatility3.framework.interfaces.configuration.TranslationLayerRequirement` that are not already fulfilled, by attempting to
stack as many layers on top of each other as possible. The base/lowest layer is derived from the
"automagic.general.single_location" configuration path. Layers are then attempting in likely height order, and
once a layer successfully stacks on top of the existing layers, it is removed from the possible choices list
@@ -15,11 +15,11 @@ import sys
import traceback
from typing import Any, List, Optional, Tuple, Type
from volatility import framework
from volatility.framework import interfaces, constants
from volatility.framework.automagic import construct_layers
from volatility.framework.configuration import requirements
from volatility.framework.layers import physical
from volatility3 import framework
from volatility3.framework import interfaces, constants
from volatility3.framework.automagic import construct_layers
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import physical
vollog = logging.getLogger(__name__)
@@ -28,11 +28,11 @@ class LayerStacker(interfaces.automagic.AutomagicInterface):
"""Builds up layers in a single stack.
This class mimics the volatility 2 style of stacking address spaces. It builds up various layers based on
separate :class:`~volatility.framework.interfaces.automagic.StackerLayerInterface` classes. These classes are
separate :class:`~volatility3.framework.interfaces.automagic.StackerLayerInterface` classes. These classes are
built up based on a `stack_order` class variable each has.
This has a high priority to provide other automagic modules as complete a context/configuration tree as possible.
Upon completion it will re-call the :class:`~volatility.framework.automagic.construct_layers.ConstructionMagic`,
Upon completion it will re-call the :class:`~volatility3.framework.automagic.construct_layers.ConstructionMagic`,
so that any stacked layers are actually constructed and added to the context.
"""
# Most important automagic, must happen first!
@@ -49,7 +49,7 @@ class LayerStacker(interfaces.automagic.AutomagicInterface):
progress_callback: constants.ProgressCallback = None) -> Optional[List[str]]:
"""Runs the automagic over the configurable."""
framework.import_files(sys.modules['volatility.framework.layers'])
framework.import_files(sys.modules['volatility3.framework.layers'])
# Quick exit if we're not needed
if not requirement.unsatisfied(context, config_path):
@@ -250,7 +250,7 @@ def choose_os_stackers(plugin: Type[interfaces.plugins.PluginInterface]) -> List
plugin_first_level = plugin.__module__.split('.')[2]
# Ensure all stackers are loaded
framework.import_files(sys.modules['volatility.framework.layers'])
framework.import_files(sys.modules['volatility3.framework.layers'])
result = []
for stacker in sorted(framework.class_subclasses(interfaces.automagic.StackerLayerInterface),
volatility/framework/automagic/symbol_cache.py → volatility3/framework/automagic/symbol_cache.py
+2 -2
View File
@@ -11,8 +11,8 @@ import urllib.parse
import urllib.request
from typing import Dict, List, Optional
from volatility.framework import constants, exceptions, interfaces
from volatility.framework.symbols import intermed
from volatility3.framework import constants, exceptions, interfaces
from volatility3.framework.symbols import intermed
vollog = logging.getLogger(__name__)
volatility/framework/automagic/symbol_finder.py → volatility3/framework/automagic/symbol_finder.py
+4 -4
View File
@@ -5,10 +5,10 @@
import logging
from typing import Any, Iterable, List, Tuple, Type, Optional, Callable
from volatility.framework import interfaces, constants, layers, exceptions
from volatility.framework.automagic import symbol_cache
from volatility.framework.configuration import requirements
from volatility.framework.layers import scanners
from volatility3.framework import interfaces, constants, layers, exceptions
from volatility3.framework.automagic import symbol_cache
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import scanners
vollog = logging.getLogger(__name__)
volatility/framework/automagic/windows.py → volatility3/framework/automagic/windows.py
+5 -5
View File
@@ -30,9 +30,9 @@ import logging
import struct
from typing import Any, Generator, List, Optional, Tuple, Type
from volatility.framework import interfaces, layers, constants
from volatility.framework.configuration import requirements
from volatility.framework.layers import intel
from volatility3.framework import interfaces, layers, constants
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import intel
vollog = logging.getLogger(__name__)
@@ -231,7 +231,7 @@ class PageMapScanner(interfaces.layers.ScannerInterface):
class WintelHelper(interfaces.automagic.AutomagicInterface):
"""Windows DTB finder based on self-referential pointers.
This class adheres to the :class:`~volatility.framework.interfaces.automagic.AutomagicInterface` interface
This class adheres to the :class:`~volatility3.framework.interfaces.automagic.AutomagicInterface` interface
and both determines the directory table base of an intel layer if one hasn't been specified, and constructs
the intel layer if necessary (for example when reconstructing a pre-existing configuration).
@@ -414,7 +414,7 @@ class WinSwapLayers(interfaces.automagic.AutomagicInterface):
if swap_location:
context.config[current_layer_path] = current_layer_name
context.config[layer_loc_path] = swap_location
context.config[layer_class_path] = 'volatility.framework.layers.physical.FileLayer'
context.config[layer_class_path] = 'volatility3.framework.layers.physical.FileLayer'
# Add the requirement
new_req = requirements.TranslationLayerRequirement(name = current_layer_name,
volatility/framework/configuration/__init__.py → volatility3/framework/configuration/__init__.py
+1 -1
View File
@@ -2,4 +2,4 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
from volatility.framework.configuration import requirements
from volatility3.framework.configuration import requirements
volatility/framework/configuration/requirements.py → volatility3/framework/configuration/requirements.py
+1 -1
View File
@@ -12,7 +12,7 @@ import abc
import logging
from typing import Any, ClassVar, List, Optional, Type, Dict, Tuple
from volatility.framework import constants, interfaces
from volatility3.framework import constants, interfaces
vollog = logging.getLogger(__name__)
volatility/framework/constants/__init__.py → volatility3/framework/constants/__init__.py
+5 -5
View File
@@ -11,20 +11,20 @@ import os.path
import sys
from typing import Optional, Callable
import volatility.framework.constants.linux
import volatility.framework.constants.windows
import volatility3.framework.constants.linux
import volatility3.framework.constants.windows
PLUGINS_PATH = [
os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "plugins")),
os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "plugins"))
]
"""Default list of paths to load plugins from (volatility/plugins and volatility/framework/plugins)"""
"""Default list of paths to load plugins from (volatility3/plugins and volatility3/framework/plugins)"""
SYMBOL_BASEPATHS = [
os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "symbols")),
os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "symbols"))
]
"""Default list of paths to load symbols from (volatility/symbols and volatility/framework/symbols)"""
"""Default list of paths to load symbols from (volatility3/symbols and volatility3/framework/symbols)"""
ISF_EXTENSIONS = ['.json', '.json.xz', '.json.gz', '.json.bz2']
"""List of accepted extensions for ISF files"""
@@ -44,7 +44,7 @@ VERSION_PATCH = 0 # Number of changes that do not change the interface
VERSION_SUFFIX = ""
PACKAGE_VERSION = ".".join([str(x) for x in [VERSION_MAJOR, VERSION_MINOR, VERSION_PATCH]]) + VERSION_SUFFIX
"""The canonical version of the volatility package"""
"""The canonical version of the volatility3 package"""
AUTOMAGIC_CONFIG_PATH = 'automagic'
"""The root section within the context configuration for automagic values"""
volatility/framework/constants/linux/__init__.py → volatility3/framework/constants/linux/__init__.py
View File
volatility/framework/constants/windows/__init__.py → volatility3/framework/constants/windows/__init__.py
View File
volatility/framework/contexts/__init__.py → volatility3/framework/contexts/__init__.py
+4 -4
View File
@@ -12,8 +12,8 @@ import functools
import hashlib
from typing import Callable, Dict, Iterable, List, Optional, Set, Tuple, Union
from volatility.framework import constants, interfaces, symbols, exceptions
from volatility.framework.objects import templates
from volatility3.framework import constants, interfaces, symbols, exceptions
from volatility3.framework.objects import templates
class Context(interfaces.context.ContextInterface):
@@ -25,7 +25,7 @@ class Context(interfaces.context.ContextInterface):
for creating new objects.
Other context objects can be constructed as long as they support the
:class:`~volatility.framework.interfaces.context.ContextInterface`. This is the primary context object to be used
:class:`~volatility3.framework.interfaces.context.ContextInterface`. This is the primary context object to be used
in the volatility framework. It maintains the
"""
@@ -71,7 +71,7 @@ class Context(interfaces.context.ContextInterface):
layer: The layer to be added to the memory
Raises:
volatility.framework.exceptions.LayerException: if the layer is already present, or has
volatility3.framework.exceptions.LayerException: if the layer is already present, or has
unmet dependencies
"""
self._memory.add_layer(layer)
volatility/framework/exceptions.py → volatility3/framework/exceptions.py
+1 -1
View File
@@ -10,7 +10,7 @@ size of the invalid page.
"""
from typing import Dict, Optional
from volatility.framework import interfaces
from volatility3.framework import interfaces
class VolatilityException(Exception):
volatility/framework/interfaces/__init__.py → volatility3/framework/interfaces/__init__.py
+1 -1
View File
@@ -12,5 +12,5 @@ components of volatility to write plugins.
# Import the submodules we want people to be able to use without importing them themselves
# This will also avoid namespace issues, because people can use interfaces.layers to
# avoid clashing with the layers package
from volatility.framework.interfaces import renderers, configuration, context, layers, objects, plugins, symbols, \
from volatility3.framework.interfaces import renderers, configuration, context, layers, objects, plugins, symbols, \
automagic
volatility/framework/interfaces/automagic.py → volatility3/framework/interfaces/automagic.py
+2 -2
View File
@@ -11,8 +11,8 @@ import logging
from abc import ABCMeta
from typing import Any, List, Optional, Tuple, Union, Type
from volatility.framework import interfaces, constants
from volatility.framework.configuration import requirements
from volatility3.framework import interfaces, constants
from volatility3.framework.configuration import requirements
vollog = logging.getLogger(__name__)
volatility/framework/interfaces/configuration.py → volatility3/framework/interfaces/configuration.py
+6 -6
View File
@@ -25,8 +25,8 @@ import sys
from abc import ABCMeta, abstractmethod
from typing import Any, ClassVar, Dict, Generator, Iterator, List, Optional, Type, Union, Tuple
from volatility import classproperty
from volatility.framework import constants, interfaces
from volatility3 import classproperty
from volatility3.framework import constants, interfaces
CONFIG_SEPARATOR = "."
"""Use to specify the separator between configuration hierarchies"""
@@ -292,10 +292,10 @@ class RequirementInterface(metaclass = ABCMeta):
A requirement is a means for plugins and other framework components to request specific configuration data.
Requirements can either be simple types (such as
:class:`~volatility.framework.configuration.requirements.SimpleTypeRequirement`,
:class:`~volatility.framework.configuration.requirements.IntRequirement`,
:class:`~volatility.framework.configuration.requirements.BytesRequirement` and
:class:`~volatility.framework.configuration.requirements.StringRequirement`) or complex types (such
:class:`~volatility3.framework.configuration.requirements.SimpleTypeRequirement`,
:class:`~volatility3.framework.configuration.requirements.IntRequirement`,
:class:`~volatility3.framework.configuration.requirements.BytesRequirement` and
:class:`~volatility3.framework.configuration.requirements.StringRequirement`) or complex types (such
as :class:`TranslationLayerRequirement`, :class:`SymbolTableRequirement` and :class:`ClassRequirement`
"""
volatility/framework/interfaces/context.py → volatility3/framework/interfaces/context.py
+2 -2
View File
@@ -15,7 +15,7 @@ import copy
from abc import ABCMeta, abstractmethod
from typing import Optional, Union
from volatility.framework import interfaces
from volatility3.framework import interfaces
class ContextInterface(metaclass = ABCMeta):
@@ -39,7 +39,7 @@ class ContextInterface(metaclass = ABCMeta):
def symbol_space(self) -> 'interfaces.symbols.SymbolSpaceInterface':
"""Returns the symbol_space for the context.
This object must support the :class:`~volatility.framework.interfaces.symbols.SymbolSpaceInterface`
This object must support the :class:`~volatility3.framework.interfaces.symbols.SymbolSpaceInterface`
"""
# ## Memory Functions
volatility/framework/interfaces/layers.py → volatility3/framework/interfaces/layers.py
+1 -1
View File
@@ -18,7 +18,7 @@ import types
from abc import ABCMeta, abstractmethod
from typing import Any, Callable, Dict, Iterable, List, Mapping, Optional, Tuple, Union
from volatility.framework import constants, exceptions, interfaces
from volatility3.framework import constants, exceptions, interfaces
vollog = logging.getLogger(__name__)
volatility/framework/interfaces/objects.py → volatility3/framework/interfaces/objects.py
+2 -2
View File
@@ -9,7 +9,7 @@ import collections.abc
import logging
from typing import Any, Dict, List, Mapping, Optional
from volatility.framework import constants, interfaces
from volatility3.framework import constants, interfaces
vollog = logging.getLogger(__name__)
@@ -281,7 +281,7 @@ class Template:
@property
def vol(self) -> ReadOnlyMapping:
"""Returns a volatility information object, much like the
:class:`~volatility.framework.interfaces.objects.ObjectInformation`
:class:`~volatility3.framework.interfaces.objects.ObjectInformation`
provides."""
return ReadOnlyMapping(self._vol)
volatility/framework/interfaces/plugins.py → volatility3/framework/interfaces/plugins.py
+2 -2
View File
@@ -14,8 +14,8 @@ import os
from abc import ABCMeta, abstractmethod
from typing import List, Tuple, Type
from volatility import framework
from volatility.framework import exceptions, constants, interfaces
from volatility3 import framework
from volatility3.framework import exceptions, constants, interfaces
vollog = logging.getLogger(__name__)
volatility/framework/interfaces/renderers.py → volatility3/framework/interfaces/renderers.py
View File
volatility/framework/interfaces/symbols.py → volatility3/framework/interfaces/symbols.py
+4 -4
View File
@@ -7,10 +7,10 @@ import collections.abc
from abc import abstractmethod, ABC
from typing import Any, Dict, Iterable, List, Optional, Tuple, Type, Mapping
from volatility.framework import constants, exceptions, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import configuration, objects
from volatility.framework.interfaces.configuration import RequirementInterface
from volatility3.framework import constants, exceptions, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import configuration, objects
from volatility3.framework.interfaces.configuration import RequirementInterface
class SymbolInterface:
volatility/framework/layers/__init__.py → volatility3/framework/layers/__init__.py
View File
volatility/framework/layers/codecs/__init__.py → volatility3/framework/layers/codecs/__init__.py
View File
volatility/framework/layers/crash.py → volatility3/framework/layers/crash.py
+3 -3
View File
@@ -6,9 +6,9 @@ import logging
import struct
from typing import Tuple, Optional
from volatility.framework import constants, exceptions, interfaces
from volatility.framework.layers import segmented
from volatility.framework.symbols import intermed
from volatility3.framework import constants, exceptions, interfaces
from volatility3.framework.layers import segmented
from volatility3.framework.symbols import intermed
vollog = logging.getLogger(__name__)
volatility/framework/layers/elf.py → volatility3/framework/layers/elf.py
+3 -3
View File
@@ -5,9 +5,9 @@ import logging
import struct
from typing import Optional
from volatility.framework import exceptions, interfaces, constants
from volatility.framework.layers import segmented
from volatility.framework.symbols import intermed
from volatility3.framework import exceptions, interfaces, constants
from volatility3.framework.layers import segmented
from volatility3.framework.symbols import intermed
vollog = logging.getLogger(__name__)
volatility/framework/layers/intel.py → volatility3/framework/layers/intel.py
+4 -4
View File
@@ -9,10 +9,10 @@ import math
import struct
from typing import Any, Dict, Iterable, List, Optional, Tuple
from volatility import classproperty
from volatility.framework import exceptions, interfaces, constants
from volatility.framework.configuration import requirements
from volatility.framework.layers import linear
from volatility3 import classproperty
from volatility3.framework import exceptions, interfaces, constants
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import linear
vollog = logging.getLogger(__name__)
volatility/framework/layers/lime.py → volatility3/framework/layers/lime.py
+2 -2
View File
@@ -5,8 +5,8 @@
import struct
from typing import Optional, Tuple
from volatility.framework import exceptions, interfaces, constants
from volatility.framework.layers import segmented
from volatility3.framework import exceptions, interfaces, constants
from volatility3.framework.layers import segmented
class LimeFormatException(exceptions.LayerException):
volatility/framework/layers/linear.py → volatility3/framework/layers/linear.py
+1 -1
View File
@@ -1,7 +1,7 @@
import functools
from typing import List, Optional, Tuple, Iterable
from volatility.framework import exceptions, interfaces
from volatility3.framework import exceptions, interfaces
class LinearlyMappedLayer(interfaces.layers.TranslationLayerInterface):
volatility/framework/layers/msf.py → volatility3/framework/layers/msf.py
+5 -5
View File
@@ -4,11 +4,11 @@
import math
from typing import Optional, Dict, Any, List, Iterable, Tuple
from volatility.framework import interfaces, constants, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.layers import linear
from volatility.framework.objects import utility
from volatility.framework.symbols import intermed
from volatility3.framework import interfaces, constants, exceptions
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import linear
from volatility3.framework.objects import utility
from volatility3.framework.symbols import intermed
class PDBFormatException(exceptions.LayerException):
volatility/framework/layers/physical.py → volatility3/framework/layers/physical.py
+3 -3
View File
@@ -4,9 +4,9 @@
import threading
from typing import Any, Dict, IO, List, Optional, Union
from volatility.framework import exceptions, interfaces, constants
from volatility.framework.configuration import requirements
from volatility.framework.layers import resources
from volatility3.framework import exceptions, interfaces, constants
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import resources
class BufferDataLayer(interfaces.layers.DataLayerInterface):
volatility/framework/layers/qemu.py → volatility3/framework/layers/qemu.py
+3 -3
View File
@@ -6,9 +6,9 @@ import json
import math
from typing import Optional, Dict, Any, Tuple, List, Set
from volatility.framework import interfaces, exceptions, constants
from volatility.framework.layers import segmented
from volatility.framework.symbols import intermed
from volatility3.framework import interfaces, exceptions, constants
from volatility3.framework.layers import segmented
from volatility3.framework.symbols import intermed
class QemuSuspendLayer(segmented.NonLinearlySegmentedLayer):
volatility/framework/layers/registry.py → volatility3/framework/layers/registry.py
+7 -7
View File
@@ -5,13 +5,13 @@
import logging
from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple, Union
from volatility.framework import constants, exceptions, interfaces, objects
from volatility.framework.configuration import requirements
from volatility.framework.configuration.requirements import IntRequirement, TranslationLayerRequirement
from volatility.framework.exceptions import InvalidAddressException
from volatility.framework.layers import linear
from volatility.framework.symbols import intermed
from volatility.plugins.windows import pslist
from volatility3.framework import constants, exceptions, interfaces, objects
from volatility3.framework.configuration import requirements
from volatility3.framework.configuration.requirements import IntRequirement, TranslationLayerRequirement
from volatility3.framework.exceptions import InvalidAddressException
from volatility3.framework.layers import linear
from volatility3.framework.symbols import intermed
from volatility3.plugins.windows import pslist
vollog = logging.getLogger(__name__)
volatility/framework/layers/resources.py → volatility3/framework/layers/resources.py
+2 -2
View File
@@ -16,8 +16,8 @@ import zipfile
from typing import Optional, Any, IO
from urllib import error
from volatility import framework
from volatility.framework import constants
from volatility3 import framework
from volatility3.framework import constants
try:
import magic
volatility/framework/layers/scanners/__init__.py → volatility3/framework/layers/scanners/__init__.py
+2 -2
View File
@@ -5,8 +5,8 @@
import re
from typing import Generator, List, Tuple
from volatility.framework.interfaces import layers
from volatility.framework.layers.scanners import multiregexp
from volatility3.framework.interfaces import layers
from volatility3.framework.layers.scanners import multiregexp
class BytesScanner(layers.ScannerInterface):
volatility/framework/layers/scanners/multiregexp.py → volatility3/framework/layers/scanners/multiregexp.py
View File
volatility/framework/layers/segmented.py → volatility3/framework/layers/segmented.py
+3 -3
View File
@@ -5,9 +5,9 @@ from abc import ABCMeta, abstractmethod
from bisect import bisect_right
from typing import Any, Dict, Iterable, List, Optional, Tuple
from volatility.framework import exceptions, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.layers import linear
from volatility3.framework import exceptions, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import linear
class NonLinearlySegmentedLayer(interfaces.layers.TranslationLayerInterface, metaclass = ABCMeta):
volatility/framework/layers/vmware.py → volatility3/framework/layers/vmware.py
+4 -4
View File
@@ -5,10 +5,10 @@
import struct
from typing import Any, Dict, List, Optional
from volatility.framework import interfaces, constants, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.layers import physical, segmented, resources
from volatility.framework.symbols import native
from volatility3.framework import interfaces, constants, exceptions
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import physical, segmented, resources
from volatility3.framework.symbols import native
class VmwareFormatException(exceptions.LayerException):
volatility/framework/objects/__init__.py → volatility3/framework/objects/__init__.py
+2 -2
View File
@@ -7,8 +7,8 @@ import logging
import struct
from typing import Any, ClassVar, Dict, List, Iterable, Optional, Tuple, Type, Union as TUnion, overload
from volatility.framework import interfaces, constants
from volatility.framework.objects import templates, utility
from volatility3.framework import interfaces, constants
from volatility3.framework.objects import templates, utility
vollog = logging.getLogger(__name__)
volatility/framework/objects/templates.py → volatility3/framework/objects/templates.py
+5 -5
View File
@@ -5,7 +5,7 @@ import functools
import logging
from typing import Any, ClassVar, Dict, List, Type
from volatility.framework import interfaces, exceptions, constants
from volatility3.framework import interfaces, exceptions, constants
vollog = logging.getLogger(__name__)
@@ -44,13 +44,13 @@ class ObjectTemplate(interfaces.objects.Template):
def relative_child_offset(self, child: str) -> int:
"""Returns the relative offset of a child of the templated object (see
:class:`~volatility.framework.interfaces.objects.ObjectInterface.VolTem
:class:`~volatility3.framework.interfaces.objects.ObjectInterface.VolTem
plateProxy`)"""
return self.vol.object_class.VolTemplateProxy.relative_child_offset(self, child)
def replace_child(self, old_child: interfaces.objects.Template, new_child: interfaces.objects.Template) -> None:
"""Replaces `old_child` for `new_child` in the templated object's child
list (see :class:`~volatility.framework.interfaces.objects.ObjectInterf
list (see :class:`~volatility3.framework.interfaces.objects.ObjectInterf
ace.VolTemplateProxy`)"""
return self.vol.object_class.VolTemplateProxy.replace_child(self, old_child, new_child)
@@ -63,7 +63,7 @@ class ObjectTemplate(interfaces.objects.Template):
object_info: interfaces.objects.ObjectInformation) -> interfaces.objects.ObjectInterface:
"""Constructs the object.
Returns: an object adhereing to the :class:`~volatility.framework.interfaces.objects.ObjectInterface`
Returns: an object adhereing to the :class:`~volatility3.framework.interfaces.objects.ObjectInterface`
"""
arguments = {} # type: Dict[str, Any]
for arg in self.vol:
@@ -76,7 +76,7 @@ class ReferenceTemplate(interfaces.objects.Template):
"""Factory class that produces objects based on a delayed reference type.
Attempts to access any standard attributes of a resolved template will result in a
:class:`~volatility.framework.exceptions.SymbolError`.
:class:`~volatility3.framework.exceptions.SymbolError`.
"""
@property
volatility/framework/objects/utility.py → volatility3/framework/objects/utility.py
+1 -1
View File
@@ -4,7 +4,7 @@
from typing import Optional, Union
from volatility.framework import interfaces, objects, constants
from volatility3.framework import interfaces, objects, constants
def array_to_string(array: 'objects.Array',
volatility/framework/plugins/__init__.py → volatility3/framework/plugins/__init__.py
+3 -3
View File
@@ -3,14 +3,14 @@
#
"""All core generic plugins.
These modules should only be imported from volatility.plugins NOT
volatility.framework.plugins
These modules should only be imported from volatility3.plugins NOT
volatility3.framework.plugins
"""
import logging
from typing import List, Type
from volatility.framework import interfaces, automagic, exceptions, constants
from volatility3.framework import interfaces, automagic, exceptions, constants
vollog = logging.getLogger(__name__)
volatility/framework/plugins/banners.py → volatility3/framework/plugins/banners.py
+4 -4
View File
@@ -4,10 +4,10 @@
import logging
from typing import List
from volatility.framework import interfaces, renderers, layers
from volatility.framework.configuration import requirements
from volatility.framework.layers import scanners
from volatility.framework.renderers import format_hints
from volatility3.framework import interfaces, renderers, layers
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import scanners
from volatility3.framework.renderers import format_hints
vollog = logging.getLogger(__name__)
volatility/framework/plugins/configwriter.py → volatility3/framework/plugins/configwriter.py
+3 -3
View File
@@ -6,9 +6,9 @@ import json
import logging
from typing import List
from volatility.framework import renderers, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility3.framework import renderers, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
vollog = logging.getLogger(__name__)
volatility/framework/plugins/frameworkinfo.py → volatility3/framework/plugins/frameworkinfo.py
+3 -3
View File
@@ -1,8 +1,8 @@
from typing import List
from volatility import framework
from volatility.framework import interfaces, renderers
from volatility.framework.interfaces import plugins
from volatility3 import framework
from volatility3.framework import interfaces, renderers
from volatility3.framework.interfaces import plugins
class FrameworkInfo(plugins.PluginInterface):
volatility/framework/plugins/isfinfo.py → volatility3/framework/plugins/isfinfo.py
+6 -6
View File
@@ -9,12 +9,12 @@ import pathlib
import zipfile
from typing import List, Type, Any, Generator
from volatility import schemas, symbols
from volatility.framework import interfaces, renderers, constants
from volatility.framework.automagic import mac, linux, symbol_cache
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.layers import resources
from volatility3 import schemas, symbols
from volatility3.framework import interfaces, renderers, constants
from volatility3.framework.automagic import mac, linux, symbol_cache
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.layers import resources
vollog = logging.getLogger(__name__)
volatility/framework/plugins/layerwriter.py → volatility3/framework/plugins/layerwriter.py
+3 -3
View File
@@ -5,9 +5,9 @@
import logging
from typing import List, Optional, Type
from volatility.framework import renderers, interfaces, constants, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility3.framework import renderers, interfaces, constants, exceptions
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
vollog = logging.getLogger(__name__)
volatility/framework/plugins/linux/__init__.py → volatility3/framework/plugins/linux/__init__.py
+2 -2
View File
@@ -3,6 +3,6 @@
#
"""All core linux plugins.
These modules should only be imported from volatility.plugins NOT
volatility.framework.plugins
These modules should only be imported from volatility3.plugins NOT
volatility3.framework.plugins
"""
volatility/framework/plugins/linux/bash.py → volatility3/framework/plugins/linux/bash.py
+8 -8
View File
@@ -8,14 +8,14 @@ import datetime
import struct
from typing import List
from volatility.framework import constants, renderers, symbols, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.layers import scanners
from volatility.framework.objects import utility
from volatility.framework.symbols.linux.bash import BashIntermedSymbols
from volatility.plugins import timeliner
from volatility.plugins.linux import pslist
from volatility3.framework import constants, renderers, symbols, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.layers import scanners
from volatility3.framework.objects import utility
from volatility3.framework.symbols.linux.bash import BashIntermedSymbols
from volatility3.plugins import timeliner
from volatility3.plugins.linux import pslist
class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
volatility/framework/plugins/linux/check_afinfo.py → volatility3/framework/plugins/linux/check_afinfo.py
+5 -5
View File
@@ -6,11 +6,11 @@ found in Linux's /proc file system."""
import logging
from typing import List
from volatility.framework import exceptions, interfaces, contexts
from volatility.framework import renderers
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.renderers import format_hints
from volatility3.framework import exceptions, interfaces, contexts
from volatility3.framework import renderers
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.renderers import format_hints
vollog = logging.getLogger(__name__)
volatility/framework/plugins/linux/check_creds.py → volatility3/framework/plugins/linux/check_creds.py
+3 -3
View File
@@ -4,9 +4,9 @@
import logging
from volatility.framework import interfaces, renderers, constants
from volatility.framework.configuration import requirements
from volatility.plugins.linux import pslist
from volatility3.framework import interfaces, renderers, constants
from volatility3.framework.configuration import requirements
from volatility3.plugins.linux import pslist
vollog = logging.getLogger(__name__)
volatility/framework/plugins/linux/check_idt.py → volatility3/framework/plugins/linux/check_idt.py
+5 -5
View File
@@ -5,11 +5,11 @@
import logging
from typing import List
from volatility.framework import interfaces, renderers, contexts, symbols
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import linux
from volatility.plugins.linux import lsmod
from volatility3.framework import interfaces, renderers, contexts, symbols
from volatility3.framework.configuration import requirements
from volatility3.framework.renderers import format_hints
from volatility3.framework.symbols import linux
from volatility3.plugins.linux import lsmod
vollog = logging.getLogger(__name__)
volatility/framework/plugins/linux/check_modules.py → volatility3/framework/plugins/linux/check_modules.py
+6 -6
View File
@@ -5,12 +5,12 @@
import logging
from typing import List
from volatility.framework import interfaces, renderers, exceptions, constants, contexts
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.plugins.linux import lsmod
from volatility3.framework import interfaces, renderers, exceptions, constants, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.plugins.linux import lsmod
vollog = logging.getLogger(__name__)
volatility/framework/plugins/linux/check_syscall.py → volatility3/framework/plugins/linux/check_syscall.py
+5 -5
View File
@@ -6,11 +6,11 @@ found in Linux's /proc file system."""
import logging
from typing import List
from volatility.framework import exceptions, interfaces, contexts
from volatility.framework import renderers, constants
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.renderers import format_hints
from volatility3.framework import exceptions, interfaces, contexts
from volatility3.framework import renderers, constants
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.renderers import format_hints
vollog = logging.getLogger(__name__)
volatility/framework/plugins/linux/elfs.py → volatility3/framework/plugins/linux/elfs.py
+6 -6
View File
@@ -6,12 +6,12 @@ found in Linux's /proc file system."""
from typing import List
from volatility.framework import renderers, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.plugins.linux import pslist
from volatility3.framework import renderers, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.plugins.linux import pslist
class Elfs(plugins.PluginInterface):
volatility/framework/plugins/linux/keyboard_notifiers.py → volatility3/framework/plugins/linux/keyboard_notifiers.py
+5 -5
View File
@@ -4,11 +4,11 @@
import logging
from volatility.framework import interfaces, renderers, contexts, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import linux
from volatility.plugins.linux import lsmod
from volatility3.framework import interfaces, renderers, contexts, exceptions
from volatility3.framework.configuration import requirements
from volatility3.framework.renderers import format_hints
from volatility3.framework.symbols import linux
from volatility3.plugins.linux import lsmod
vollog = logging.getLogger(__name__)
volatility/framework/plugins/linux/lsmod.py → volatility3/framework/plugins/linux/lsmod.py
+6 -6
View File
@@ -7,12 +7,12 @@ found in Linux's /proc file system."""
import logging
from typing import List, Iterable
from volatility.framework import contexts
from volatility.framework import exceptions, renderers, constants, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility3.framework import contexts
from volatility3.framework import exceptions, renderers, constants, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
vollog = logging.getLogger(__name__)
volatility/framework/plugins/linux/lsof.py → volatility3/framework/plugins/linux/lsof.py
+6 -6
View File
@@ -6,12 +6,12 @@ found in Linux's /proc file system."""
import logging
from typing import List
from volatility.framework import renderers, interfaces, constants
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.symbols import linux
from volatility.plugins.linux import pslist
from volatility3.framework import renderers, interfaces, constants
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.symbols import linux
from volatility3.plugins.linux import pslist
vollog = logging.getLogger(__name__)
volatility/framework/plugins/linux/malfind.py → volatility3/framework/plugins/linux/malfind.py
+6 -6
View File
@@ -4,12 +4,12 @@
from typing import List
from volatility.framework import constants, interfaces
from volatility.framework import renderers
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.plugins.linux import pslist
from volatility3.framework import constants, interfaces
from volatility3.framework import renderers
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.plugins.linux import pslist
class Malfind(interfaces.plugins.PluginInterface):
volatility/framework/plugins/linux/proc.py → volatility3/framework/plugins/linux/proc.py
+6 -6
View File
@@ -4,12 +4,12 @@
"""A module containing a collection of plugins that produce data typically
found in Linux's /proc file system."""
from volatility.framework import renderers
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.plugins.linux import pslist
from volatility3.framework import renderers
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.plugins.linux import pslist
class Maps(plugins.PluginInterface):
volatility/framework/plugins/linux/pslist.py → volatility3/framework/plugins/linux/pslist.py
+3 -3
View File
@@ -4,9 +4,9 @@
from typing import Callable, Iterable, List, Any
from volatility.framework import renderers, interfaces, contexts
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
from volatility3.framework import renderers, interfaces, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
class PsList(interfaces.plugins.PluginInterface):
volatility/framework/plugins/linux/pstree.py → volatility3/framework/plugins/linux/pstree.py
+2 -2
View File
@@ -2,8 +2,8 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
from volatility.framework.objects import utility
from volatility.plugins.linux import pslist
from volatility3.framework.objects import utility
from volatility3.plugins.linux import pslist
class PsTree(pslist.PsList):
volatility/framework/plugins/linux/tty_check.py → volatility3/framework/plugins/linux/tty_check.py
+7 -7
View File
@@ -5,13 +5,13 @@
import logging
from typing import List
from volatility.framework import interfaces, renderers, exceptions, constants, contexts
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import linux
from volatility.plugins.linux import lsmod
from volatility3.framework import interfaces, renderers, exceptions, constants, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.framework.symbols import linux
from volatility3.plugins.linux import lsmod
vollog = logging.getLogger(__name__)
volatility/framework/plugins/mac/__init__.py → volatility3/framework/plugins/mac/__init__.py
View File
volatility/framework/plugins/mac/bash.py → volatility3/framework/plugins/mac/bash.py
+8 -8
View File
@@ -7,14 +7,14 @@ found in mac's /proc file system."""
import datetime
import struct
from volatility.framework import constants, renderers, symbols
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.layers import scanners
from volatility.framework.objects import utility
from volatility.framework.symbols.linux.bash import BashIntermedSymbols
from volatility.plugins import timeliner
from volatility.plugins.mac import pslist
from volatility3.framework import constants, renderers, symbols
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.layers import scanners
from volatility3.framework.objects import utility
from volatility3.framework.symbols.linux.bash import BashIntermedSymbols
from volatility3.plugins import timeliner
from volatility3.plugins.mac import pslist
class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
volatility/framework/plugins/mac/check_syscall.py → volatility3/framework/plugins/mac/check_syscall.py
+7 -7
View File
@@ -4,13 +4,13 @@
import logging
from typing import List
from volatility.framework import exceptions, interfaces
from volatility.framework import renderers, contexts
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import mac
from volatility.plugins.mac import lsmod
from volatility3.framework import exceptions, interfaces
from volatility3.framework import renderers, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.renderers import format_hints
from volatility3.framework.symbols import mac
from volatility3.plugins.mac import lsmod
vollog = logging.getLogger(__name__)
volatility/framework/plugins/mac/check_sysctl.py → volatility3/framework/plugins/mac/check_sysctl.py
+10 -10
View File
@@ -4,15 +4,15 @@
import logging
from typing import List
import volatility
from volatility.framework import exceptions, interfaces
from volatility.framework import renderers, contexts
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import mac
from volatility.plugins.mac import lsmod
import volatility3
from volatility3.framework import exceptions, interfaces
from volatility3.framework import renderers, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.framework.symbols import mac
from volatility3.plugins.mac import lsmod
vollog = logging.getLogger(__name__)
@@ -55,7 +55,7 @@ class Check_sysctl(plugins.PluginInterface):
return var_str
def _process_sysctl_list(self, kernel, sysctl_list, recursive = 0):
if type(sysctl_list) == volatility.framework.objects.Pointer:
if type(sysctl_list) == volatility3.framework.objects.Pointer:
sysctl_list = sysctl_list.dereference().cast("sysctl_oid_list")
sysctl = sysctl_list.slh_first
volatility/framework/plugins/mac/check_trap_table.py → volatility3/framework/plugins/mac/check_trap_table.py
+7 -7
View File
@@ -5,13 +5,13 @@
import logging
from typing import List
from volatility.framework import exceptions, interfaces
from volatility.framework import renderers, contexts
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import mac
from volatility.plugins.mac import lsmod
from volatility3.framework import exceptions, interfaces
from volatility3.framework import renderers, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.renderers import format_hints
from volatility3.framework.symbols import mac
from volatility3.plugins.mac import lsmod
vollog = logging.getLogger(__name__)
volatility/framework/plugins/mac/ifconfig.py → volatility3/framework/plugins/mac/ifconfig.py
+5 -5
View File
@@ -1,11 +1,11 @@
# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
from volatility.framework import exceptions, renderers, contexts
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.symbols import mac
from volatility3.framework import exceptions, renderers, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.symbols import mac
class Ifconfig(plugins.PluginInterface):
volatility/framework/plugins/mac/kauth_listeners.py → volatility3/framework/plugins/mac/kauth_listeners.py
+6 -6
View File
@@ -2,12 +2,12 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
from volatility.framework import renderers, interfaces, contexts
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import mac
from volatility.plugins.mac import lsmod, kauth_scopes
from volatility3.framework import renderers, interfaces, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.framework.symbols import mac
from volatility3.plugins.mac import lsmod, kauth_scopes
class Kauth_listeners(interfaces.plugins.PluginInterface):
volatility/framework/plugins/mac/kauth_scopes.py → volatility3/framework/plugins/mac/kauth_scopes.py
+6 -6
View File
@@ -4,12 +4,12 @@
from typing import Iterable, Callable, Tuple
from volatility.framework import renderers, interfaces, contexts
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import mac
from volatility.plugins.mac import lsmod
from volatility3.framework import renderers, interfaces, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.framework.symbols import mac
from volatility3.plugins.mac import lsmod
class Kauth_scopes(interfaces.plugins.PluginInterface):
volatility/framework/plugins/mac/kevents.py → volatility3/framework/plugins/mac/kevents.py
+5 -5
View File
@@ -4,11 +4,11 @@
from typing import Iterable, Callable, Tuple
from volatility.framework import renderers, interfaces, exceptions, contexts
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
from volatility.framework.symbols import mac
from volatility.plugins.mac import pslist
from volatility3.framework import renderers, interfaces, exceptions, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
from volatility3.framework.symbols import mac
from volatility3.plugins.mac import pslist
class Kevents(interfaces.plugins.PluginInterface):
volatility/framework/plugins/mac/list_files.py → volatility3/framework/plugins/mac/list_files.py
+7 -7
View File
@@ -4,13 +4,13 @@
import logging
from typing import Iterable, Optional
from volatility.framework import renderers, interfaces, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import mac
from volatility.plugins.mac import mount
from volatility3.framework import renderers, interfaces, exceptions
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.framework.symbols import mac
from volatility3.plugins.mac import mount
vollog = logging.getLogger(__name__)
volatility/framework/plugins/mac/lsmod.py → volatility3/framework/plugins/mac/lsmod.py
+5 -5
View File
@@ -3,11 +3,11 @@
#
"""A module containing a collection of plugins that produce data typically
found in Mac's lsmod command."""
from volatility.framework import renderers, interfaces, contexts
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility3.framework import renderers, interfaces, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
class Lsmod(plugins.PluginInterface):
volatility/framework/plugins/mac/lsof.py → volatility3/framework/plugins/mac/lsof.py
+5 -5
View File
@@ -4,11 +4,11 @@
import logging
from volatility.framework import renderers
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.symbols import mac
from volatility.plugins.mac import pslist
from volatility3.framework import renderers
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.symbols import mac
from volatility3.plugins.mac import pslist
vollog = logging.getLogger(__name__)
volatility/framework/plugins/mac/malfind.py → volatility3/framework/plugins/mac/malfind.py
+7 -7
View File
@@ -2,13 +2,13 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
from volatility.framework import constants
from volatility.framework import interfaces
from volatility.framework import renderers
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.plugins.mac import pslist
from volatility3.framework import constants
from volatility3.framework import interfaces
from volatility3.framework import renderers
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.plugins.mac import pslist
class Malfind(interfaces.plugins.PluginInterface):
volatility/framework/plugins/mac/mount.py → volatility3/framework/plugins/mac/mount.py
+5 -5
View File
@@ -3,11 +3,11 @@
#
"""A module containing a collection of plugins that produce data typically
found in Mac's mount command."""
from volatility.framework import renderers, interfaces, contexts
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.symbols import mac
from volatility3.framework import renderers, interfaces, contexts
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.symbols import mac
class Mount(plugins.PluginInterface):
volatility/framework/plugins/mac/netstat.py → volatility3/framework/plugins/mac/netstat.py
+7 -7
View File
@@ -5,13 +5,13 @@
import logging
from typing import Iterable, Callable, Tuple
from volatility.framework import exceptions, renderers, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.framework.symbols import mac
from volatility.plugins.mac import pslist
from volatility3.framework import exceptions, renderers, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.framework.symbols import mac
from volatility3.plugins.mac import pslist
vollog = logging.getLogger(__name__)
volatility/framework/plugins/mac/proc_maps.py → volatility3/framework/plugins/mac/proc_maps.py
+5 -5
View File
@@ -2,11 +2,11 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
from volatility.framework import renderers, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.plugins.mac import pslist
from volatility3.framework import renderers, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
from volatility3.framework.renderers import format_hints
from volatility3.plugins.mac import pslist
class Maps(interfaces.plugins.PluginInterface):
volatility/framework/plugins/mac/psaux.py → volatility3/framework/plugins/mac/psaux.py
+5 -5
View File
@@ -4,11 +4,11 @@
"""In-memory artifacts from OSX systems."""
from typing import Iterator, Tuple, Any, Generator, List
from volatility.framework import exceptions, renderers, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.plugins.mac import pslist
from volatility3.framework import exceptions, renderers, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.interfaces import plugins
from volatility3.framework.objects import utility
from volatility3.plugins.mac import pslist
class Psaux(plugins.PluginInterface):
volatility/framework/plugins/mac/pslist.py → volatility3/framework/plugins/mac/pslist.py
+4 -4
View File
@@ -5,10 +5,10 @@
import logging
from typing import Callable, Iterable, List, Dict
from volatility.framework import renderers, interfaces, contexts, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
from volatility.framework.symbols import mac
from volatility3.framework import renderers, interfaces, contexts, exceptions
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
from volatility3.framework.symbols import mac
vollog = logging.getLogger(__name__)

Some files were not shown because too many files have changed in this diff Show More