From 444376cbbad407bbe00cb4ed3cb51b6ae07ec489 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 9 Feb 2025 15:39:49 +0000 Subject: [PATCH] Fix typos and try setting back requirement change --- volatility3/framework/configuration/requirements.py | 2 +- volatility3/framework/plugins/windows/bigpools.py | 2 +- volatility3/framework/plugins/windows/callbacks.py | 12 ++++++------ volatility3/framework/plugins/windows/handles.py | 4 ++-- volatility3/framework/plugins/windows/modules.py | 2 +- volatility3/framework/plugins/windows/pslist.py | 2 +- volatility3/framework/plugins/windows/psscan.py | 2 +- .../framework/plugins/windows/registry/hivelist.py | 2 +- .../framework/plugins/windows/unloadedmodules.py | 2 +- volatility3/framework/plugins/windows/vadinfo.py | 2 +- .../framework/symbols/windows/extensions/__init__.py | 6 +++--- 11 files changed, 19 insertions(+), 19 deletions(-) diff --git a/volatility3/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py index aa16c6090..3e3608000 100644 --- a/volatility3/framework/configuration/requirements.py +++ b/volatility3/framework/configuration/requirements.py @@ -638,12 +638,12 @@ class ModuleRequirement( self.add_requirement( TranslationLayerRequirement(name="layer_name", architectures=architectures) ) + self.add_requirement(SymbolTableRequirement(name="symbol_table_name")) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ IntRequirement(name="offset"), - SymbolTableRequirement(name="symbol_table_name"), ] def unsatisfied( diff --git a/volatility3/framework/plugins/windows/bigpools.py b/volatility3/framework/plugins/windows/bigpools.py index f6217ac50..9da702ae0 100644 --- a/volatility3/framework/plugins/windows/bigpools.py +++ b/volatility3/framework/plugins/windows/bigpools.py @@ -69,7 +69,7 @@ class BigPools(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py index 9d54f4331..7bb90863d 100644 --- a/volatility3/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -364,7 +364,7 @@ class Callbacks(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) @@ -425,7 +425,7 @@ class Callbacks(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) full_type_name = ( @@ -476,7 +476,7 @@ class Callbacks(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) full_type_name = callback_table_name + constants.BANG + "_CM_CALLBACK_ENTRY" @@ -521,7 +521,7 @@ class Callbacks(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) @@ -581,7 +581,7 @@ class Callbacks(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) @@ -649,7 +649,7 @@ class Callbacks(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 384528f0a..276ce5d51 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -147,7 +147,7 @@ class Handles(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) @@ -209,7 +209,7 @@ class Handles(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) return context.object( symbol_table + constants.BANG + "unsigned int", diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 0dfa5a7e8..62a622491 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -250,7 +250,7 @@ class Modules(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index 3e8be08a4..3d3f12869 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -229,7 +229,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) diff --git a/volatility3/framework/plugins/windows/psscan.py b/volatility3/framework/plugins/windows/psscan.py index 21671eb9b..81e5fb792 100644 --- a/volatility3/framework/plugins/windows/psscan.py +++ b/volatility3/framework/plugins/windows/psscan.py @@ -197,7 +197,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) tleoffset = ntkrnlmp.get_type("_ETHREAD").relative_child_offset( diff --git a/volatility3/framework/plugins/windows/registry/hivelist.py b/volatility3/framework/plugins/windows/registry/hivelist.py index 2963a7b8b..36be35a68 100644 --- a/volatility3/framework/plugins/windows/registry/hivelist.py +++ b/volatility3/framework/plugins/windows/registry/hivelist.py @@ -218,7 +218,7 @@ class HiveList(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) diff --git a/volatility3/framework/plugins/windows/unloadedmodules.py b/volatility3/framework/plugins/windows/unloadedmodules.py index 855f0730b..4359199c1 100644 --- a/volatility3/framework/plugins/windows/unloadedmodules.py +++ b/volatility3/framework/plugins/windows/unloadedmodules.py @@ -91,7 +91,7 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) unloadedmodules_offset = ntkrnlmp.get_symbol("MmUnloadedDrivers").address diff --git a/volatility3/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py index f309aa3fd..35bf54d98 100644 --- a/volatility3/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -102,7 +102,7 @@ class VadInfo(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) addr = ntkrnlmp.get_symbol("MmProtectToValue").address diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 595b63256..4e7d6d920 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -843,7 +843,7 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): ) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = self._context.module( @@ -1040,7 +1040,7 @@ class TOKEN(objects.StructType): ) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) symbol_table = self.get_symbol_table_name() ntkrnlmp = self._context.module( @@ -1148,7 +1148,7 @@ class KTIMER(objects.StructType): ) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = self._context.module( symbol_table_name,