mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-03 08:18:52 +02:00
fix some typo
This commit is contained in:
garanews
@@ -147,7 +147,7 @@ it does not. The :py:func:`~volatility3.plugins.windows.pslist.PsList.create_pi
|
||||
identifiers that are included in the list. If the list is empty, all processes are returned.
|
||||
|
||||
The next line specifies the columns by their name and type. The types are simple types (int, str, bytes, float, and bool)
|
||||
but can also provide hints as to how the output should be displayed (such as a hexidecimal number, using
|
||||
but can also provide hints as to how the output should be displayed (such as a hexadecimal number, using
|
||||
:py:class:`volatility3.framework.renderers.format_hints.Hex`).
|
||||
This indicates to user interfaces that the value should be displayed in a particular way, but does not guarantee that the value
|
||||
will be displayed that way (for example, if it doesn't make sense to do so in a particular interface).
|
||||
|
||||
@@ -116,7 +116,7 @@ Options
|
||||
|
||||
**<plugin>**
|
||||
The name of the plugin to execute (these are usually categorized by
|
||||
the operating system, such as `windows.pslist.PsList`). Any subtring
|
||||
the operating system, such as `windows.pslist.PsList`). Any substring
|
||||
that uniquely matches the desired plugin name can be used. As such
|
||||
`hivescan` would match `windows.registry.hivescan.HiveScan`, but
|
||||
`pslist` is ambiguous because it could match `windows.pslist` or
|
||||
|
||||
@@ -24,7 +24,7 @@ Object Model changes
|
||||
--------------------
|
||||
|
||||
The object model has changed as well, objects now inherit directly from their Python counterparts, meaning an integer
|
||||
object is actually a Python integer (and has all the associated methods, and can be used whereever a normal int could).
|
||||
object is actually a Python integer (and has all the associated methods, and can be used wherever a normal int could).
|
||||
In Volatility 2, a complex proxy object was constructed which tried to emulate all the methods of the host object, but
|
||||
ultimately it was a different type and could not be used in the same places (critically, it could make the ordering of
|
||||
operations important, since a + b might not work, but b + a might work fine).
|
||||
|
||||
@@ -478,7 +478,7 @@ class CommandLine:
|
||||
if not scheme or len(scheme) <= 1:
|
||||
if not os.path.exists(value):
|
||||
raise FileNotFoundError(
|
||||
f"Non-existant file {value} passed to URIRequirement")
|
||||
f"Non-existent file {value} passed to URIRequirement")
|
||||
value = f"file://{request.pathname2url(os.path.abspath(value))}"
|
||||
if isinstance(requirement, requirements.ListRequirement):
|
||||
if not isinstance(value, list):
|
||||
|
||||
@@ -94,7 +94,7 @@ class SymbolBannerCache(interfaces.automagic.AutomagicInterface):
|
||||
banner_list = banners.get(new_banner, [])
|
||||
banners[new_banner] = list(set(banner_list + new_banners[new_banner]))
|
||||
|
||||
# Do remote banners *after* the JSON loading, so that it doen't pull down all the remote JSON
|
||||
# Do remote banners *after* the JSON loading, so that it doesn't pull down all the remote JSON
|
||||
self.remote_banners(banners, self.os)
|
||||
|
||||
# Rewrite the cached banners each run, since writing is faster than the banner_cache validation portion
|
||||
|
||||
@@ -6,7 +6,7 @@ framework functions.
|
||||
|
||||
This has been made an object to allow quick swapping and changing of
|
||||
contexts, to allow a plugin to act on multiple different contexts
|
||||
without them interfering eith each other.
|
||||
without them interfering with each other.
|
||||
"""
|
||||
import functools
|
||||
import hashlib
|
||||
|
||||
@@ -26,7 +26,7 @@ class AutomagicInterface(interfaces.configuration.ConfigurableInterface, metacla
|
||||
Args:
|
||||
context: The context in which to store configuration data that the automagic might populate
|
||||
config_path: Configuration path where the configurable's data under the context's config lives
|
||||
configurable: The top level configurable whose requirements may need statisfying
|
||||
configurable: The top level configurable whose requirements may need satisfying
|
||||
progress_callback: An optional function accepting a percentage and optional description to indicate
|
||||
progress during long calculations
|
||||
|
||||
|
||||
@@ -212,7 +212,7 @@ class ObjectInterface(metaclass = abc.ABCMeta):
|
||||
takes a template since the templates may contain the necessary
|
||||
data about the yet-to-be-constructed object. It allows objects
|
||||
to control how their templates respond without needing to write
|
||||
new templates for each and every potental object type.
|
||||
new templates for each and every potential object type.
|
||||
"""
|
||||
_methods: List[str] = []
|
||||
|
||||
|
||||
@@ -215,6 +215,6 @@ class TreeGrid(object, metaclass = ABCMeta):
|
||||
Args:
|
||||
node: The initial node to be visited
|
||||
function: The visitor to apply to the nodes under the initial node
|
||||
initial_accumulator: An accumulator that allows data to be transfered between one visitor call to the next
|
||||
initial_accumulator: An accumulator that allows data to be transferred between one visitor call to the next
|
||||
sort_key: Information about the sort order of columns in order to determine the ordering of results
|
||||
"""
|
||||
|
||||
@@ -361,7 +361,7 @@ class WindowsIntelPAE(WindowsMixin, IntelPAE):
|
||||
|
||||
class WindowsIntel32e(WindowsMixin, Intel32e):
|
||||
# TODO: Fix appropriately in a future release.
|
||||
# Currently just a temprorary workaround to deal with custom bit flag
|
||||
# Currently just a temporary workaround to deal with custom bit flag
|
||||
# in the PFN field for pages in transition state.
|
||||
# See https://github.com/volatilityfoundation/volatility3/pull/475
|
||||
_maxphyaddr = 45
|
||||
|
||||
@@ -56,7 +56,7 @@ def cascadeCloseFile(new_fp: IO[bytes], original_fp: IO[bytes]) -> IO[bytes]:
|
||||
|
||||
|
||||
class ResourceAccessor(object):
|
||||
"""Object for openning URLs as files (downloading locally first if
|
||||
"""Object for opening URLs as files (downloading locally first if
|
||||
necessary)"""
|
||||
|
||||
list_handlers = True
|
||||
|
||||
@@ -111,7 +111,7 @@ class PrimitiveObject(interfaces.objects.ObjectInterface):
|
||||
"""Creates the appropriate class and returns it so that the native type
|
||||
is inherited.
|
||||
|
||||
The only reason the kwargs is added, is so that the inherriting types can override __init__
|
||||
The only reason the kwargs is added, is so that the inheriting types can override __init__
|
||||
without needing to override __new__
|
||||
|
||||
We also sneak in new_value, so that we don't have to do expensive (read: impossible) context reads
|
||||
@@ -128,7 +128,7 @@ class PrimitiveObject(interfaces.objects.ObjectInterface):
|
||||
return result
|
||||
|
||||
def __getnewargs_ex__(self):
|
||||
"""Make sure that when pickling, all appropiate parameters for new are
|
||||
"""Make sure that when pickling, all appropriate parameters for new are
|
||||
provided."""
|
||||
kwargs = {}
|
||||
for k, v in self._vol.maps[-1].items():
|
||||
@@ -205,7 +205,7 @@ class Bytes(PrimitiveObject, bytes):
|
||||
is inherritted.
|
||||
|
||||
The only reason the kwargs is added, is so that the
|
||||
inherriting types can override __init__ without needing to
|
||||
inheriting types can override __init__ without needing to
|
||||
override __new__
|
||||
"""
|
||||
return cls._struct_type.__new__(
|
||||
@@ -255,7 +255,7 @@ class String(PrimitiveObject, str):
|
||||
is inherited.
|
||||
|
||||
The only reason the kwargs is added, is so that the
|
||||
inherriting types can override __init__ without needing to
|
||||
inheriting types can override __init__ without needing to
|
||||
override __new__
|
||||
"""
|
||||
params = {}
|
||||
@@ -634,7 +634,7 @@ class Array(interfaces.objects.ObjectInterface, collections.abc.Sequence):
|
||||
|
||||
def write(self, value) -> None:
|
||||
if not isinstance(value, collections.Sequence):
|
||||
raise TypeError("Only Sequences can be writen to arrays")
|
||||
raise TypeError("Only Sequences can be written to arrays")
|
||||
self.count = len(value)
|
||||
for index in range(len(value)):
|
||||
self[index].write(value[index])
|
||||
@@ -769,7 +769,7 @@ class AggregateType(interfaces.objects.ObjectInterface):
|
||||
|
||||
# Disable messing around with setattr until the consequences have been considered properly
|
||||
# For example pdbutil constructs objects and then sets values for them
|
||||
# Some don't always match the type (for example, the data read is encoded and interpretted)
|
||||
# Some don't always match the type (for example, the data read is encoded and interpreted)
|
||||
#
|
||||
# def __setattr__(self, name, value):
|
||||
# """Method for writing specific members of a structure"""
|
||||
|
||||
@@ -108,7 +108,7 @@ class ABCKmsg(ABC):
|
||||
def symtab_checks(cls, vmlinux: interfaces.context.ModuleInterface) -> bool:
|
||||
"""This method on each sublasss will be called to evaluate if the kernel
|
||||
being analyzed fulfill the type & symbols requirements for the implementation.
|
||||
The first class returning True will be instanciated and called via the
|
||||
The first class returning True will be instantiated and called via the
|
||||
run() method.
|
||||
|
||||
:return: True is the kernel being analysed fulfill the class requirements.
|
||||
@@ -173,7 +173,7 @@ class KmsgLegacy(ABCKmsg):
|
||||
"""Linux kernels prior to v5.10, the ringbuffer is initially kept in
|
||||
__log_buf, and log_buf is a pointer to the former. __log_buf is declared as
|
||||
a char array but it actually contains an array of printk_log structs.
|
||||
The lenght of this array is defined in the kernel KConfig configuration via
|
||||
The length of this array is defined in the kernel KConfig configuration via
|
||||
the CONFIG_LOG_BUF_SHIFT value as a power of 2.
|
||||
This can also be modified by the log_buf_len kernel boot parameter.
|
||||
In SMP systems with more than 64 CPUs this ringbuffer size is dynamically
|
||||
|
||||
@@ -98,7 +98,7 @@ class Kevents(interfaces.plugins.PluginInterface):
|
||||
"""
|
||||
Enumerates event filters per task.
|
||||
Uses smear-safe APIs throughout as these data structures
|
||||
see a signifcant amount of smear
|
||||
see a significant amount of smear
|
||||
"""
|
||||
fdp = task.p_fd
|
||||
|
||||
|
||||
@@ -169,7 +169,7 @@ class Handles(interfaces.plugins.PluginInterface):
|
||||
symbol_table: The name of the table containing the kernel symbols
|
||||
|
||||
Returns:
|
||||
A mapping of type indicies to type names
|
||||
A mapping of type indices to type names
|
||||
"""
|
||||
|
||||
type_map: Dict[int, str] = {}
|
||||
|
||||
@@ -74,7 +74,7 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
|
||||
@classmethod
|
||||
def parse_bitmap(cls, context: interfaces.context.ContextInterface, layer_name: str, bitmap_offset: int,
|
||||
bitmap_size_in_byte: int) -> list:
|
||||
"""Parses a given bitmap and looks for each occurence of a 1.
|
||||
"""Parses a given bitmap and looks for each occurrence of a 1.
|
||||
|
||||
Args:
|
||||
context: The context to retrieve required elements (layers, symbol tables) from
|
||||
|
||||
@@ -96,7 +96,7 @@ def convert_network_four_tuple(family, four_tuple):
|
||||
dest port)
|
||||
|
||||
into their string equivalents. IP addresses are expected as a tuple
|
||||
of unsigned shorts Ports are converted to proper endianess as well
|
||||
of unsigned shorts Ports are converted to proper endianness as well
|
||||
"""
|
||||
|
||||
if family == socket.AF_INET:
|
||||
|
||||
@@ -18,7 +18,7 @@ class Bin(int):
|
||||
|
||||
class Hex(int):
|
||||
"""A class to indicate that the integer value should be represented as a
|
||||
hexidecimal value."""
|
||||
hexadecimal value."""
|
||||
|
||||
|
||||
class HexBytes(bytes):
|
||||
|
||||
@@ -973,7 +973,7 @@ class CONTROL_AREA(objects.StructType):
|
||||
# If the entry is not a valid physical address then see if it is in transition.
|
||||
elif mmpte.u.Trans.Transition == 1:
|
||||
# TODO: Fix appropriately in a future release.
|
||||
# Currently just a temprorary workaround to deal with custom bit flag
|
||||
# Currently just a temporary workaround to deal with custom bit flag
|
||||
# in the PFN field for pages in transition state.
|
||||
# See https://github.com/volatilityfoundation/volatility3/pull/475
|
||||
physoffset = (mmpte.u.Trans.PageFrameNumber & (( 1 << 33 ) - 1 ) ) << 12
|
||||
@@ -1102,7 +1102,7 @@ class SHARED_CACHE_MAP(objects.StructType):
|
||||
if vacb_obj.SharedCacheMap == self.vol.offset:
|
||||
self.save_vacb(vacb_obj, vacb_list)
|
||||
|
||||
# If the file is larger than 1 MB, a seperate VACB index array needs to be allocated.
|
||||
# If the file is larger than 1 MB, a separate VACB index array needs to be allocated.
|
||||
# This is based on how many 256 KB blocks would be required for the size of the file.
|
||||
# This newly allocated VACB index array is found through the Vacbs member of SHARED_CACHE_MAP.
|
||||
vacb_obj = self.Vacbs
|
||||
|
||||
@@ -18,7 +18,7 @@ from volatility3.framework.layers import physical, msf, resources
|
||||
|
||||
vollog = logging.getLogger(__name__)
|
||||
|
||||
primatives = {
|
||||
primitives = {
|
||||
0x03: ("void", {
|
||||
"endian": "little",
|
||||
"kind": "void",
|
||||
@@ -584,7 +584,7 @@ class PdbReader:
|
||||
def get_type_from_index(self, index: int) -> Union[List[Any], Dict[str, Any]]:
|
||||
"""Takes a type index and returns appropriate dictionary."""
|
||||
if index < 0x1000:
|
||||
base_name, base = primatives[index & 0xff]
|
||||
base_name, base = primitives[index & 0xff]
|
||||
self.bases[base_name] = base
|
||||
result: Union[List[Dict[str, Any]], Dict[str, Any]] = {"kind": "base", "name": base_name}
|
||||
indirection = (index & 0xf00)
|
||||
@@ -644,7 +644,7 @@ class PdbReader:
|
||||
if (index & 0xf00):
|
||||
_, base = indirections[index & 0xf00]
|
||||
else:
|
||||
_, base = primatives[index & 0xff]
|
||||
_, base = primitives[index & 0xff]
|
||||
result = base['size']
|
||||
else:
|
||||
leaf_type, name, value = self.types[index - 0x1000]
|
||||
|
||||
@@ -68,7 +68,7 @@ class PDBUtility(interfaces.configuration.VersionableInterface):
|
||||
symbol_table_class: str,
|
||||
config_path: str = 'pdbutility',
|
||||
progress_callback: constants.ProgressCallback = None):
|
||||
"""Loads (downlading if necessary) a windows symbol table"""
|
||||
"""Loads (downloading if necessary) a windows symbol table"""
|
||||
|
||||
filter_string = os.path.join(pdb_name.strip('\x00'), guid.upper() + "-" + str(age))
|
||||
|
||||
|
||||
@@ -53,7 +53,7 @@ def validate(input: Dict[str, Any], use_cache: bool = True) -> bool:
|
||||
|
||||
def create_json_hash(input: Dict[str, Any], schema: Dict[str, Any]) -> str:
|
||||
"""Constructs the hash of the input and schema to create a unique
|
||||
indentifier for a particular JSON file."""
|
||||
identifier for a particular JSON file."""
|
||||
return hashlib.sha1(bytes(json.dumps((input, schema), sort_keys = True), 'utf-8')).hexdigest()
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user