WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-28 12:34:53 +02:00
Code Issues Packages Projects Releases Wiki Activity

Yapf: Clean-up the whole codebase.

Browse Source
This commit is contained in:
Mike Auty
2020-01-14 15:44:07 +00:00
parent b7ba877727
commit 3f5b96f3c7
12 changed files with 57 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/linux/lsmod.py
+5 -2
View File
@@ -18,6 +18,7 @@ from volatility.framework.renderers import format_hints
vollog = logging.getLogger(__name__)
class Lsmod(plugins.PluginInterface):
"""Lists loaded kernel modules."""
@@ -65,9 +66,11 @@ class Lsmod(plugins.PluginInterface):
mod_name = utility.array_to_string(module.name)
yield 0, (format_hints.Hex(module.vol.offset), mod_name, mod_size)
except exceptions.SymbolError:
vollog.debug("The required symbol 'module' is not present in symbol table. Please check that kernel modules are enabled for the system under analysis.")
vollog.debug(
"The required symbol 'module' is not present in symbol table. Please check that kernel modules are enabled for the system under analysis."
)
def run(self):
return renderers.TreeGrid([("Offset", format_hints.Hex), ("Name", str), ("Size", int)], self._generator())
volatility/framework/plugins/mac/ifconfig.py
+8 -9
View File
@@ -9,14 +9,16 @@ from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
class Ifconfig(plugins.PluginInterface):
"""Lists loaded kernel modules"""
@classmethod
def get_requirements(cls):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Linux kernel symbols")
]
@@ -33,11 +35,11 @@ class Ifconfig(plugins.PluginInterface):
for ifnet in mac.MacUtilities.walk_tailq(list_head, "if_link"):
name = utility.pointer_to_string(ifnet.if_name, 32)
unit = ifnet.if_unit
prom = ifnet.if_flags & 0x100 == 0x100 # IFF_PROMISC
prom = ifnet.if_flags & 0x100 == 0x100 # IFF_PROMISC
sock_addr_dl = ifnet.sockaddr_dl()
if sock_addr_dl is None:
mac_addr = renderers.UnreadableValue()
mac_addr = renderers.UnreadableValue()
else:
mac_addr = str(sock_addr_dl)
@@ -47,8 +49,5 @@ class Ifconfig(plugins.PluginInterface):
yield (0, ("{0}{1}".format(name, unit), ip, mac_addr, prom))
def run(self):
return renderers.TreeGrid([("Interface", str), ("IP Address", str), ("Mac Address", str), ("Promiscuous", bool)], self._generator())
return renderers.TreeGrid([("Interface", str), ("IP Address", str), ("Mac Address", str),
("Promiscuous", bool)], self._generator())
volatility/framework/plugins/mac/lsof.py
+3 -3
View File
@@ -40,6 +40,6 @@ class lsof(plugins.PluginInterface):
return renderers.TreeGrid([("PID", int), ("File Descriptor", int), ("File Path", str)],
self._generator(
tasks.Tasks.list_tasks(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
volatility/framework/plugins/mac/netstat.py
+3 -3
View File
@@ -80,6 +80,6 @@ class Netstat(plugins.PluginInterface):
("Remote IP", str), ("Remote Port", int), ("State", str), ("Process", str)],
self._generator(
tasks.Tasks.list_tasks(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
volatility/framework/plugins/mac/pstree.py
+1
View File
@@ -8,6 +8,7 @@ from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.plugins.mac import tasks
class PsTree(plugins.PluginInterface):
"""Plugin for listing processes in a tree based on their parent process
ID."""
volatility/framework/plugins/mac/tasks.py
+1 -1
View File
@@ -37,7 +37,7 @@ class Tasks(pslist.PsList):
mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
kernel_as = context.layers[layer_name]
queue_entry = kernel.object_from_symbol(symbol_name = "tasks")
volatility/framework/plugins/windows/procdump.py
+11 -11
View File
@@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__)
class ProcDump(interfaces.plugins.PluginInterface):
"""Dumps process executable images."""
_version = (1,1,0)
_version = (1, 1, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -35,7 +35,8 @@ class ProcDump(interfaces.plugins.PluginInterface):
]
@classmethod
def process_dump(cls, context: interfaces.context.ContextInterface, kernel_table_name: str, pe_table_name: str, proc: interfaces.objects.ObjectInterface) -> interfaces.plugins.FileInterface:
def process_dump(cls, context: interfaces.context.ContextInterface, kernel_table_name: str, pe_table_name: str,
proc: interfaces.objects.ObjectInterface) -> interfaces.plugins.FileInterface:
"""Extracts the complete data for a process as a FileInterface
Args:
@@ -52,21 +53,21 @@ class ProcDump(interfaces.plugins.PluginInterface):
proc_id = proc.UniqueProcessId
proc_layer_name = proc.add_process_layer()
peb = context.object(kernel_table_name + constants.BANG + "_PEB",
layer_name = proc_layer_name,
offset = proc.Peb)
layer_name = proc_layer_name,
offset = proc.Peb)
dos_header = context.object(pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER",
offset = peb.ImageBaseAddress,
layer_name = proc_layer_name)
filedata = interfaces.plugins.FileInterface("pid.{0}.{1:#x}.dmp".format(
proc.UniqueProcessId, peb.ImageBaseAddress))
offset = peb.ImageBaseAddress,
layer_name = proc_layer_name)
filedata = interfaces.plugins.FileInterface("pid.{0}.{1:#x}.dmp".format(proc.UniqueProcessId,
peb.ImageBaseAddress))
for offset, data in dos_header.reconstruct():
filedata.data.seek(offset)
filedata.data.write(data)
return filedata
def _generator(self, procs):
pe_table_name = intermed.IntermediateSymbolTable.create(self.context,
self.config_path,
"windows",
@@ -94,7 +95,6 @@ class ProcDump(interfaces.plugins.PluginInterface):
result_text = "Process {}: Required memory at {:#x} is not valid (incomplete layer {}?)".format(
proc_id, exp.invalid_address, exp.layer_name)
yield (0, (proc.UniqueProcessId, process_name, result_text))
def run(self):
volatility/framework/plugins/windows/svcscan.py
+2 -1
View File
@@ -36,7 +36,8 @@ class SvcScan(interfaces.plugins.PluginInterface):
fallback_checks = [("ObHeaderCookie", None, True),
("_HANDLE_TABLE", "HandleCount", False),
("ObHeaderCookie", None, True),
("_EPROCESS", "ControlFlowGuardEnabled", True)])
("_EPROCESS", "ControlFlowGuardEnabled",
True)])
is_win10_16299_or_later = poolscanner.os_distinguisher(version_check = lambda x: x >= (10, 0, 16299),
fallback_checks = [("ObHeaderCookie", None, True),
volatility/framework/plugins/windows/vaddump.py
+3 -2
View File
@@ -15,7 +15,7 @@ vollog = logging.getLogger(__name__)
class VadDump(interfaces.plugins.PluginInterface):
"""Dumps process memory ranges."""
_version = (1,1,0)
_version = (1, 1, 0)
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -38,7 +38,8 @@ class VadDump(interfaces.plugins.PluginInterface):
]
@classmethod
def vad_dump(cls, context: interfaces.context.ContextInterface, layer_name: str, vad: interfaces.objects.ObjectInterface) -> bytes:
def vad_dump(cls, context: interfaces.context.ContextInterface, layer_name: str,
vad: interfaces.objects.ObjectInterface) -> bytes:
"""
Returns VAD content
"""
volatility/framework/symbols/intermed.py
+4 -1
View File
@@ -369,7 +369,10 @@ class Version1Format(ISFormatTable):
elif type_name == 'enum':
update = self._lookup_enum(dictionary['name'])
elif type_name == 'bitfield':
update = {'start_bit': dictionary['bit_position'], 'end_bit': dictionary['bit_position'] + dictionary['bit_length']}
update = {
'start_bit': dictionary['bit_position'],
'end_bit': dictionary['bit_position'] + dictionary['bit_length']
}
update['base_type'] = self._interdict_to_template(dictionary['type'])
# We do *not* call native_template.clone(), since it slows everything down a lot
# We require that the native.get_type method always returns a newly constructed python object
volatility/framework/symbols/linux/__init__.py
+1 -1
View File
@@ -25,7 +25,7 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable):
self.set_type_class('fs_struct', extensions.fs_struct)
self.set_type_class('files_struct', extensions.files_struct)
self.set_type_class('vfsmount', extensions.vfsmount)
if 'module' in self.types:
self.set_type_class('module', extensions.module)
volatility/framework/symbols/mac/extensions/__init__.py
+15 -6
View File
@@ -383,7 +383,11 @@ class inpcb(objects.StructType):
class queue_entry(objects.StructType):
def walk_list(self, list_head: interfaces.objects.ObjectInterface, member_name: str, type_name: str, max_size: int = 4096) -> Iterable[interfaces.objects.ObjectInterface]:
def walk_list(self,
list_head: interfaces.objects.ObjectInterface,
member_name: str,
type_name: str,
max_size: int = 4096) -> Iterable[interfaces.objects.ObjectInterface]:
yielded = 0
try:
@@ -396,7 +400,7 @@ class queue_entry(objects.StructType):
if yielded == max_size:
return
n = n.member(attr = member_name).next.dereference().cast(type_name)
try:
p = self.prev.dereference().cast(type_name)
except exceptions.PagedInvalidAddressException:
@@ -408,7 +412,9 @@ class queue_entry(objects.StructType):
return
p = p.member(attr = member_name).prev.dereference().cast(type_name)
class ifnet(objects.StructType):
def sockaddr_dl(self):
if self.has_member("if_lladdr"):
try:
@@ -423,8 +429,10 @@ class ifnet(objects.StructType):
return val
# this is used for MAC addresses
class sockaddr_dl(objects.StructType):
def __str__(self):
ret = ""
@@ -446,22 +454,23 @@ class sockaddr_dl(objects.StructType):
return ret
class sockaddr(objects.StructType):
def get_address(self):
ip = ""
family = self.sa_family
if family == 2: # AF_INET
if family == 2: # AF_INET
addr_in = self.cast("sockaddr_in")
ip = conversion.convert_ipv4(addr_in.sin_addr.s_addr)
elif family == 30: # AF_INET6
elif family == 30: # AF_INET6
addr_in6 = self.cast("sockaddr_in6")
ip = conversion.convert_ipv6(addr_in6.sin6_addr.member(attr = "__u6_addr").member(attr = "__u6_addr32"))
elif family == 18: # AF_LINK
elif family == 18: # AF_LINK
addr_dl = self.cast("sockaddr_dl")
ip = str(addr_dl)
return ip