diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index 5a512b748..b39283680 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -181,11 +181,11 @@ class CommandLine(interfaces.plugins.FileConsumerInterface): # Set the PARALLELISM if partial_args.parallelism == 'processes': - constants.PARALLELISM = constants.PARALLELISM_MULTIPROCESSING + constants.PARALLELISM = constants.Parallelism.Multiprocessing elif partial_args.parallelism == 'threading': - constants.PARALLELISM = constants.PARALLELISM_THREADING + constants.PARALLELISM = constants.Parallelism.Threading else: - constants.PARALLELISM = constants.PARALLELISM_OFF + constants.PARALLELISM = constants.Parallelism.Off # Do the initialization ctx = contexts.Context() # Construct a blank context diff --git a/volatility/framework/constants/__init__.py b/volatility/framework/constants/__init__.py index 3ce11b671..219a14a41 100644 --- a/volatility/framework/constants/__init__.py +++ b/volatility/framework/constants/__init__.py @@ -21,6 +21,7 @@ Stores all the constant values that are generally fixed throughout volatility This includes default scanning block sizes, etc.""" +import enum import os.path import sys from typing import Optional, Callable @@ -32,32 +33,55 @@ PLUGINS_PATH = [ os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "plugins")), os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "plugins")) ] +"""Default list of paths to load plugins from (volatility/plugins and volatility/framework/plugins)""" + SYMBOL_BASEPATHS = [ os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "symbols")), os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "symbols")) ] +"""Default list of paths to load symbols from (volatility/symbols and volatility/framework/symbols)""" + BANG = "!" +"""Constant used to delimit table names from type names when referring to a symbol""" + PACKAGE_VERSION = "3.0.0_alpha1" +"""The canonical version of the volatility package""" + AUTOMAGIC_CONFIG_PATH = 'automagic' +"""The root section within the context configuration for automagic values""" LOGLEVEL_V = 9 +"""Logging level for a single -v""" LOGLEVEL_VV = 8 +"""Logging level for -vv""" LOGLEVEL_VVV = 7 +"""Logging level for -vvv""" LOGLEVEL_VVVV = 6 +"""Logging level for -vvvv""" + +CACHE_PATH = os.path.join(os.path.expanduser("~"), ".cache", "volatility3") +"""Default path to store cached data""" if sys.platform == 'windows': CACHE_PATH = os.path.join(os.environ.get("APPDATA", os.path.expanduser("~")), "volatility3") -else: - CACHE_PATH = os.path.join(os.path.expanduser("~"), ".cache", "volatility3") os.makedirs(CACHE_PATH, exist_ok = True) LINUX_BANNERS_PATH = os.path.join(CACHE_PATH, "linux_banners.cache") +""""Default location to record information about available linux banners""" + MAC_BANNERS_PATH = os.path.join(CACHE_PATH, "mac_banners.cache") +""""Default location to record information about available mac banners""" ProgressCallback = Optional[Callable[[float, str], None]] +"""Type information for ProgressCallback objects""" -PARALLELISM_OFF = 0 -PARALLELISM_THREADING = 1 -PARALLELISM_MULTIPROCESSING = 2 -PARALLELISM = PARALLELISM_OFF +class Parallelism(enum.IntEnum): + """An enumeration listing the different types of parallelism applied to volatility""" + Off = 0 + Threading = 1 + Multiprocessing = 2 + + +PARALLELISM = Parallelism.Off +"""Default value to the parallelism setting used throughout volatility""" diff --git a/volatility/framework/constants/linux/__init__.py b/volatility/framework/constants/linux/__init__.py index 93ac327bb..0459999a3 100644 --- a/volatility/framework/constants/linux/__init__.py +++ b/volatility/framework/constants/linux/__init__.py @@ -23,3 +23,4 @@ Linux-specific values that aren't found in debug symbols""" # arch/x86/include/asm/page_types.h PAGE_SHIFT = 12 +"""The value hard coded from the Linux Kernel (hence not extracted from the layer itself)""" diff --git a/volatility/framework/constants/windows/__init__.py b/volatility/framework/constants/windows/__init__.py index 56c8646d9..aa9ae0311 100644 --- a/volatility/framework/constants/windows/__init__.py +++ b/volatility/framework/constants/windows/__init__.py @@ -22,3 +22,4 @@ Windows-specific values that aren't found in debug symbols""" KERNEL_MODULE_NAMES = ["ntkrnlmp", "ntkrnlpa", "ntkrpamp", "ntoskrnl"] +"""The list of names that kernel modules can have within the windows OS""" diff --git a/volatility/framework/layers/physical.py b/volatility/framework/layers/physical.py index 4c6efb0eb..6d5005d4c 100644 --- a/volatility/framework/layers/physical.py +++ b/volatility/framework/layers/physical.py @@ -104,7 +104,7 @@ class FileLayer(interfaces.layers.DataLayerInterface): self._size = None # type: Optional[int] # Construct the lock now (shared if made before threading) in case we ever need it self._lock = DummyLock() # type: Union[DummyLock, threading.Lock] - if constants.PARALLELISM == constants.PARALLELISM_THREADING: + if constants.PARALLELISM == constants.Parallelism.Threading: self._lock = threading.Lock() # Instantiate the file to throw exceptions if the file doesn't open _ = self._file