diff --git a/doc/source/simple-plugin.rst b/doc/source/simple-plugin.rst index 52dabfd4f..4e499b186 100644 --- a/doc/source/simple-plugin.rst +++ b/doc/source/simple-plugin.rst @@ -147,7 +147,7 @@ it does not. The :py:func:`~volatility3.plugins.windows.pslist.PsList.create_pi identifiers that are included in the list. If the list is empty, all processes are returned. The next line specifies the columns by their name and type. The types are simple types (int, str, bytes, float, and bool) -but can also provide hints as to how the output should be displayed (such as a hexidecimal number, using +but can also provide hints as to how the output should be displayed (such as a hexadecimal number, using :py:class:`volatility3.framework.renderers.format_hints.Hex`). This indicates to user interfaces that the value should be displayed in a particular way, but does not guarantee that the value will be displayed that way (for example, if it doesn't make sense to do so in a particular interface). diff --git a/doc/source/vol-cli.rst b/doc/source/vol-cli.rst index 069906873..9db29c818 100644 --- a/doc/source/vol-cli.rst +++ b/doc/source/vol-cli.rst @@ -116,7 +116,7 @@ Options **** The name of the plugin to execute (these are usually categorized by - the operating system, such as `windows.pslist.PsList`). Any subtring + the operating system, such as `windows.pslist.PsList`). Any substring that uniquely matches the desired plugin name can be used. As such `hivescan` would match `windows.registry.hivescan.HiveScan`, but `pslist` is ambiguous because it could match `windows.pslist` or diff --git a/doc/source/vol2to3.rst b/doc/source/vol2to3.rst index bc1733dcf..eb33b6618 100644 --- a/doc/source/vol2to3.rst +++ b/doc/source/vol2to3.rst @@ -24,7 +24,7 @@ Object Model changes -------------------- The object model has changed as well, objects now inherit directly from their Python counterparts, meaning an integer -object is actually a Python integer (and has all the associated methods, and can be used whereever a normal int could). +object is actually a Python integer (and has all the associated methods, and can be used wherever a normal int could). In Volatility 2, a complex proxy object was constructed which tried to emulate all the methods of the host object, but ultimately it was a different type and could not be used in the same places (critically, it could make the ordering of operations important, since a + b might not work, but b + a might work fine). diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index 19c6e4ddd..608fdf79c 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -478,7 +478,7 @@ class CommandLine: if not scheme or len(scheme) <= 1: if not os.path.exists(value): raise FileNotFoundError( - f"Non-existant file {value} passed to URIRequirement") + f"Non-existent file {value} passed to URIRequirement") value = f"file://{request.pathname2url(os.path.abspath(value))}" if isinstance(requirement, requirements.ListRequirement): if not isinstance(value, list): diff --git a/volatility3/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py index b2c227228..7b6adf9b4 100644 --- a/volatility3/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -94,7 +94,7 @@ class SymbolBannerCache(interfaces.automagic.AutomagicInterface): banner_list = banners.get(new_banner, []) banners[new_banner] = list(set(banner_list + new_banners[new_banner])) - # Do remote banners *after* the JSON loading, so that it doen't pull down all the remote JSON + # Do remote banners *after* the JSON loading, so that it doesn't pull down all the remote JSON self.remote_banners(banners, self.os) # Rewrite the cached banners each run, since writing is faster than the banner_cache validation portion diff --git a/volatility3/framework/contexts/__init__.py b/volatility3/framework/contexts/__init__.py index f7532cc5d..518215ab4 100644 --- a/volatility3/framework/contexts/__init__.py +++ b/volatility3/framework/contexts/__init__.py @@ -6,7 +6,7 @@ framework functions. This has been made an object to allow quick swapping and changing of contexts, to allow a plugin to act on multiple different contexts -without them interfering eith each other. +without them interfering with each other. """ import functools import hashlib diff --git a/volatility3/framework/interfaces/automagic.py b/volatility3/framework/interfaces/automagic.py index 04f495894..c310f5b4a 100644 --- a/volatility3/framework/interfaces/automagic.py +++ b/volatility3/framework/interfaces/automagic.py @@ -26,7 +26,7 @@ class AutomagicInterface(interfaces.configuration.ConfigurableInterface, metacla Args: context: The context in which to store configuration data that the automagic might populate config_path: Configuration path where the configurable's data under the context's config lives - configurable: The top level configurable whose requirements may need statisfying + configurable: The top level configurable whose requirements may need satisfying progress_callback: An optional function accepting a percentage and optional description to indicate progress during long calculations diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index 11040c503..811327094 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -212,7 +212,7 @@ class ObjectInterface(metaclass = abc.ABCMeta): takes a template since the templates may contain the necessary data about the yet-to-be-constructed object. It allows objects to control how their templates respond without needing to write - new templates for each and every potental object type. + new templates for each and every potential object type. """ _methods: List[str] = [] diff --git a/volatility3/framework/interfaces/renderers.py b/volatility3/framework/interfaces/renderers.py index dd53a96b3..7f80425a4 100644 --- a/volatility3/framework/interfaces/renderers.py +++ b/volatility3/framework/interfaces/renderers.py @@ -215,6 +215,6 @@ class TreeGrid(object, metaclass = ABCMeta): Args: node: The initial node to be visited function: The visitor to apply to the nodes under the initial node - initial_accumulator: An accumulator that allows data to be transfered between one visitor call to the next + initial_accumulator: An accumulator that allows data to be transferred between one visitor call to the next sort_key: Information about the sort order of columns in order to determine the ordering of results """ diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index 4a582f1fb..7569aa0b8 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -361,7 +361,7 @@ class WindowsIntelPAE(WindowsMixin, IntelPAE): class WindowsIntel32e(WindowsMixin, Intel32e): # TODO: Fix appropriately in a future release. - # Currently just a temprorary workaround to deal with custom bit flag + # Currently just a temporary workaround to deal with custom bit flag # in the PFN field for pages in transition state. # See https://github.com/volatilityfoundation/volatility3/pull/475 _maxphyaddr = 45 diff --git a/volatility3/framework/layers/resources.py b/volatility3/framework/layers/resources.py index 35182a86b..b6ef1b6ba 100644 --- a/volatility3/framework/layers/resources.py +++ b/volatility3/framework/layers/resources.py @@ -56,7 +56,7 @@ def cascadeCloseFile(new_fp: IO[bytes], original_fp: IO[bytes]) -> IO[bytes]: class ResourceAccessor(object): - """Object for openning URLs as files (downloading locally first if + """Object for opening URLs as files (downloading locally first if necessary)""" list_handlers = True diff --git a/volatility3/framework/objects/__init__.py b/volatility3/framework/objects/__init__.py index 05d594b2f..fb8975ebb 100644 --- a/volatility3/framework/objects/__init__.py +++ b/volatility3/framework/objects/__init__.py @@ -111,7 +111,7 @@ class PrimitiveObject(interfaces.objects.ObjectInterface): """Creates the appropriate class and returns it so that the native type is inherited. - The only reason the kwargs is added, is so that the inherriting types can override __init__ + The only reason the kwargs is added, is so that the inheriting types can override __init__ without needing to override __new__ We also sneak in new_value, so that we don't have to do expensive (read: impossible) context reads @@ -128,7 +128,7 @@ class PrimitiveObject(interfaces.objects.ObjectInterface): return result def __getnewargs_ex__(self): - """Make sure that when pickling, all appropiate parameters for new are + """Make sure that when pickling, all appropriate parameters for new are provided.""" kwargs = {} for k, v in self._vol.maps[-1].items(): @@ -205,7 +205,7 @@ class Bytes(PrimitiveObject, bytes): is inherritted. The only reason the kwargs is added, is so that the - inherriting types can override __init__ without needing to + inheriting types can override __init__ without needing to override __new__ """ return cls._struct_type.__new__( @@ -255,7 +255,7 @@ class String(PrimitiveObject, str): is inherited. The only reason the kwargs is added, is so that the - inherriting types can override __init__ without needing to + inheriting types can override __init__ without needing to override __new__ """ params = {} @@ -634,7 +634,7 @@ class Array(interfaces.objects.ObjectInterface, collections.abc.Sequence): def write(self, value) -> None: if not isinstance(value, collections.Sequence): - raise TypeError("Only Sequences can be writen to arrays") + raise TypeError("Only Sequences can be written to arrays") self.count = len(value) for index in range(len(value)): self[index].write(value[index]) @@ -769,7 +769,7 @@ class AggregateType(interfaces.objects.ObjectInterface): # Disable messing around with setattr until the consequences have been considered properly # For example pdbutil constructs objects and then sets values for them - # Some don't always match the type (for example, the data read is encoded and interpretted) + # Some don't always match the type (for example, the data read is encoded and interpreted) # # def __setattr__(self, name, value): # """Method for writing specific members of a structure""" diff --git a/volatility3/framework/plugins/linux/kmsg.py b/volatility3/framework/plugins/linux/kmsg.py index 4f5fb2924..a729c1695 100644 --- a/volatility3/framework/plugins/linux/kmsg.py +++ b/volatility3/framework/plugins/linux/kmsg.py @@ -108,7 +108,7 @@ class ABCKmsg(ABC): def symtab_checks(cls, vmlinux: interfaces.context.ModuleInterface) -> bool: """This method on each sublasss will be called to evaluate if the kernel being analyzed fulfill the type & symbols requirements for the implementation. - The first class returning True will be instanciated and called via the + The first class returning True will be instantiated and called via the run() method. :return: True is the kernel being analysed fulfill the class requirements. @@ -173,7 +173,7 @@ class KmsgLegacy(ABCKmsg): """Linux kernels prior to v5.10, the ringbuffer is initially kept in __log_buf, and log_buf is a pointer to the former. __log_buf is declared as a char array but it actually contains an array of printk_log structs. - The lenght of this array is defined in the kernel KConfig configuration via + The length of this array is defined in the kernel KConfig configuration via the CONFIG_LOG_BUF_SHIFT value as a power of 2. This can also be modified by the log_buf_len kernel boot parameter. In SMP systems with more than 64 CPUs this ringbuffer size is dynamically diff --git a/volatility3/framework/plugins/mac/kevents.py b/volatility3/framework/plugins/mac/kevents.py index c433a39ee..16fa51fa4 100644 --- a/volatility3/framework/plugins/mac/kevents.py +++ b/volatility3/framework/plugins/mac/kevents.py @@ -98,7 +98,7 @@ class Kevents(interfaces.plugins.PluginInterface): """ Enumerates event filters per task. Uses smear-safe APIs throughout as these data structures - see a signifcant amount of smear + see a significant amount of smear """ fdp = task.p_fd diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 66fd94f08..ab11d30d6 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -169,7 +169,7 @@ class Handles(interfaces.plugins.PluginInterface): symbol_table: The name of the table containing the kernel symbols Returns: - A mapping of type indicies to type names + A mapping of type indices to type names """ type_map: Dict[int, str] = {} diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index 76480399f..e71683c10 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -74,7 +74,7 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): @classmethod def parse_bitmap(cls, context: interfaces.context.ContextInterface, layer_name: str, bitmap_offset: int, bitmap_size_in_byte: int) -> list: - """Parses a given bitmap and looks for each occurence of a 1. + """Parses a given bitmap and looks for each occurrence of a 1. Args: context: The context to retrieve required elements (layers, symbol tables) from diff --git a/volatility3/framework/renderers/conversion.py b/volatility3/framework/renderers/conversion.py index 5737abef5..996cf03a5 100644 --- a/volatility3/framework/renderers/conversion.py +++ b/volatility3/framework/renderers/conversion.py @@ -96,7 +96,7 @@ def convert_network_four_tuple(family, four_tuple): dest port) into their string equivalents. IP addresses are expected as a tuple - of unsigned shorts Ports are converted to proper endianess as well + of unsigned shorts Ports are converted to proper endianness as well """ if family == socket.AF_INET: diff --git a/volatility3/framework/renderers/format_hints.py b/volatility3/framework/renderers/format_hints.py index 486e164b3..f386d8e9d 100644 --- a/volatility3/framework/renderers/format_hints.py +++ b/volatility3/framework/renderers/format_hints.py @@ -18,7 +18,7 @@ class Bin(int): class Hex(int): """A class to indicate that the integer value should be represented as a - hexidecimal value.""" + hexadecimal value.""" class HexBytes(bytes): diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 25e48f78c..ae7c45d04 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -973,7 +973,7 @@ class CONTROL_AREA(objects.StructType): # If the entry is not a valid physical address then see if it is in transition. elif mmpte.u.Trans.Transition == 1: # TODO: Fix appropriately in a future release. - # Currently just a temprorary workaround to deal with custom bit flag + # Currently just a temporary workaround to deal with custom bit flag # in the PFN field for pages in transition state. # See https://github.com/volatilityfoundation/volatility3/pull/475 physoffset = (mmpte.u.Trans.PageFrameNumber & (( 1 << 33 ) - 1 ) ) << 12 @@ -1102,7 +1102,7 @@ class SHARED_CACHE_MAP(objects.StructType): if vacb_obj.SharedCacheMap == self.vol.offset: self.save_vacb(vacb_obj, vacb_list) - # If the file is larger than 1 MB, a seperate VACB index array needs to be allocated. + # If the file is larger than 1 MB, a separate VACB index array needs to be allocated. # This is based on how many 256 KB blocks would be required for the size of the file. # This newly allocated VACB index array is found through the Vacbs member of SHARED_CACHE_MAP. vacb_obj = self.Vacbs diff --git a/volatility3/framework/symbols/windows/pdbconv.py b/volatility3/framework/symbols/windows/pdbconv.py index f0b97f9ee..da8254ffd 100644 --- a/volatility3/framework/symbols/windows/pdbconv.py +++ b/volatility3/framework/symbols/windows/pdbconv.py @@ -18,7 +18,7 @@ from volatility3.framework.layers import physical, msf, resources vollog = logging.getLogger(__name__) -primatives = { +primitives = { 0x03: ("void", { "endian": "little", "kind": "void", @@ -584,7 +584,7 @@ class PdbReader: def get_type_from_index(self, index: int) -> Union[List[Any], Dict[str, Any]]: """Takes a type index and returns appropriate dictionary.""" if index < 0x1000: - base_name, base = primatives[index & 0xff] + base_name, base = primitives[index & 0xff] self.bases[base_name] = base result: Union[List[Dict[str, Any]], Dict[str, Any]] = {"kind": "base", "name": base_name} indirection = (index & 0xf00) @@ -644,7 +644,7 @@ class PdbReader: if (index & 0xf00): _, base = indirections[index & 0xf00] else: - _, base = primatives[index & 0xff] + _, base = primitives[index & 0xff] result = base['size'] else: leaf_type, name, value = self.types[index - 0x1000] diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index 4e90e4834..4c3788a56 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -68,7 +68,7 @@ class PDBUtility(interfaces.configuration.VersionableInterface): symbol_table_class: str, config_path: str = 'pdbutility', progress_callback: constants.ProgressCallback = None): - """Loads (downlading if necessary) a windows symbol table""" + """Loads (downloading if necessary) a windows symbol table""" filter_string = os.path.join(pdb_name.strip('\x00'), guid.upper() + "-" + str(age)) diff --git a/volatility3/schemas/__init__.py b/volatility3/schemas/__init__.py index 5fbed7e09..65329a4f5 100644 --- a/volatility3/schemas/__init__.py +++ b/volatility3/schemas/__init__.py @@ -53,7 +53,7 @@ def validate(input: Dict[str, Any], use_cache: bool = True) -> bool: def create_json_hash(input: Dict[str, Any], schema: Dict[str, Any]) -> str: """Constructs the hash of the input and schema to create a unique - indentifier for a particular JSON file.""" + identifier for a particular JSON file.""" return hashlib.sha1(bytes(json.dumps((input, schema), sort_keys = True), 'utf-8')).hexdigest()