Add additional docstrings and refactor/rearrange the entire codebase.

test_rig.py

@@ -5,10 +5,12 @@ Created on 10 Mar 2013
 """
 
 import pdb
+
 from volatility import framework
 from volatility.framework import xp_sp2_x86_vtypes, layers
 from volatility.framework.symbols import vtypes, native
 
+
 def test_symbols():
     native_list = native.x86NativeTable
 
@@ -27,6 +29,7 @@ def test_symbols():
         _ = symbol(ctx, layer_name = '', offset = 0)
     symbol = ctx.symbol_space.get_structure('ntkrnlmp!_EPROCESS')
 
+
 def utils_load_as():
     nativelst = native.x86NativeTable
 
@@ -39,6 +42,7 @@ def utils_load_as():
     ctx.symbol_space.append(ntkrnlmp)
     return ctx
 
+
 def test_memory():
     nativelst = native.x86NativeTable
     virtual_types = xp_sp2_x86_vtypes.ntkrnlmp_types
@@ -54,6 +58,7 @@ def test_memory():
     val = ctx.object('ntkrnlmp!TEST_POINTER', 'data', 0)
     print(hex(val.point1.test1), val.point1.test2)
 
+
 def test_kdbgfind(ctx):
     ctx = utils_load_as()
     base = layers.physical.FileLayer(ctx, 'data', filename = '/home/mike/memory/xp-laptop-2005-06-25.img')
@@ -74,6 +79,7 @@ def intel32(ctx):
          0x822148f0, 0x81ed84e8]
     return intel, x
 
+
 def intelpae(ctx):
     base = layers.physical.FileLayer(ctx, 'data', filename = '/home/mike/memory/private/jon-fres.dmp')
     ctx.memory.add_layer(base)
@@ -83,6 +89,7 @@ def intelpae(ctx):
          0x817ff460, 0x817eb020, 0x817e9020, 0x817a62a8, 0x817a4b28, 0x81865020, 0x817972c0]
     return intel, x
 
+
 def intel32e(ctx):
     base = layers.physical.FileLayer(ctx, 'data', filename = '/home/mike/memory/private/ikelos-winxpsp2-x64.dmp')
     ctx.memory.add_layer(base)
@@ -104,8 +111,8 @@ def test_translation():
     for val in x:
         a, b = intel._translate(val)
         print(hex(val), hex(a), hex(b))
-    #print(bin(0x39000), bin(0xffab8020))
-    #print(hex(intel.translate(0xffab8020)))
+        # print(bin(0x39000), bin(0xffab8020))
+        #print(hex(intel.translate(0xffab8020)))
 
 
 # TODO: