From 47646c12d431707c2fb148a637289d79840998fa Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 28 Mar 2025 16:53:55 -0500 Subject: [PATCH] Framework: Fix all direct non-module imports This fixes all import from statements in the codebase that were importing things other than modules into module namespaces from other volatility3 modules. This should prevent accidental re-exporting. --- volatility3/framework/exceptions.py | 5 +- .../framework/interfaces/configuration.py | 5 +- volatility3/framework/interfaces/symbols.py | 3 +- volatility3/framework/layers/elf.py | 4 +- volatility3/framework/layers/intel.py | 16 +++--- volatility3/framework/layers/registry.py | 11 ++-- volatility3/framework/layers/xen.py | 4 +- volatility3/framework/plugins/linux/bash.py | 4 +- volatility3/framework/plugins/linux/elfs.py | 4 +- .../framework/plugins/linux/modxview.py | 10 ++-- .../framework/plugins/linux/sockstat.py | 23 ++++---- .../framework/plugins/linux/tracing/ftrace.py | 14 ++--- .../plugins/linux/tracing/tracepoints.py | 18 +++---- volatility3/framework/plugins/mac/bash.py | 4 +- .../framework/plugins/windows/dumpfiles.py | 13 +++-- volatility3/framework/plugins/windows/info.py | 9 ++-- .../framework/plugins/windows/pe_symbols.py | 4 +- .../framework/plugins/windows/psxview.py | 6 +-- .../plugins/windows/registry/hashdump.py | 28 +++++----- .../plugins/windows/registry/lsadump.py | 23 ++++---- .../plugins/windows/registry/printkey.py | 53 ++++++++++--------- .../windows/registry/scheduled_tasks.py | 2 +- .../plugins/windows/registry/userassist.py | 17 +++--- .../framework/plugins/windows/truecrypt.py | 29 +++++----- .../framework/symbols/linux/network.py | 4 +- .../symbols/windows/extensions/__init__.py | 7 +-- .../symbols/windows/extensions/network.py | 8 ++- .../symbols/windows/extensions/pool.py | 4 +- .../symbols/windows/extensions/registry.py | 38 +++++++------ .../symbols/windows/extensions/services.py | 4 +- .../framework/symbols/windows/pdbutil.py | 3 +- .../plugins/windows/registry/certificates.py | 3 +- 32 files changed, 190 insertions(+), 190 deletions(-) diff --git a/volatility3/framework/exceptions.py b/volatility3/framework/exceptions.py index a3d660444..34b41727a 100644 --- a/volatility3/framework/exceptions.py +++ b/volatility3/framework/exceptions.py @@ -11,7 +11,6 @@ size of the invalid page. from typing import Callable, Dict, Optional, Tuple from volatility3.framework import interfaces -from volatility3.framework.interfaces.configuration import VersionableInterface class VolatilityException(Exception): @@ -143,7 +142,7 @@ class VersionMismatchException(VolatilityException): def __init__( self, source_component: Callable, - target_component: VersionableInterface, + target_component: interfaces.configuration.VersionableInterface, target_version: Tuple[int, int, int], failure_reason: str = None, *args, @@ -151,7 +150,7 @@ class VersionMismatchException(VolatilityException): """ Args: source_component: The component that required the target component - target_component: The component that is required. Must inherit from VersionableInterface + target_component: The component that is required. Must inherit from interfaces.configuration.VersionableInterface target_version: The version of the target component that was required, and ultimately was not satisfied failure_reason: A detailed failure reason to enhance debugging and bug tracking """ diff --git a/volatility3/framework/interfaces/configuration.py b/volatility3/framework/interfaces/configuration.py index b6f4f889c..33d15d05e 100644 --- a/volatility3/framework/interfaces/configuration.py +++ b/volatility3/framework/interfaces/configuration.py @@ -37,7 +37,8 @@ from typing import ( Set, ) -from volatility3 import classproperty, framework +import volatility3 +from volatility3 import framework from volatility3.framework import constants, interfaces CONFIG_SEPARATOR = "." @@ -805,7 +806,7 @@ class VersionableInterface: framework.require_interface_version(*self._required_framework_version) super().__init__(*args, **kwargs) - @classproperty + @volatility3.classproperty def version(cls) -> Tuple[int, int, int]: """The version of the current interface (classmethods available on the component). diff --git a/volatility3/framework/interfaces/symbols.py b/volatility3/framework/interfaces/symbols.py index 2d142de9a..925be72c9 100644 --- a/volatility3/framework/interfaces/symbols.py +++ b/volatility3/framework/interfaces/symbols.py @@ -10,7 +10,6 @@ from typing import Any, Dict, Iterable, List, Mapping, Optional, Tuple, Type from volatility3.framework import constants, exceptions, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import configuration, objects -from volatility3.framework.interfaces.configuration import RequirementInterface class SymbolInterface: @@ -347,7 +346,7 @@ class SymbolTableInterface( return config @classmethod - def get_requirements(cls) -> List[RequirementInterface]: + def get_requirements(cls) -> List[configuration.RequirementInterface]: return super().get_requirements() + [ requirements.IntRequirement( name="symbol_mask", diff --git a/volatility3/framework/layers/elf.py b/volatility3/framework/layers/elf.py index 81f3c3634..5777981cb 100644 --- a/volatility3/framework/layers/elf.py +++ b/volatility3/framework/layers/elf.py @@ -6,7 +6,7 @@ import struct from typing import Optional from volatility3.framework import exceptions, interfaces, constants -from volatility3.framework.constants.linux import ELF_CLASS +from volatility3.framework.constants import linux as linux_constants from volatility3.framework.layers import segmented from volatility3.framework.symbols import intermed @@ -23,7 +23,7 @@ class Elf64Layer(segmented.SegmentedLayer): _header_struct = struct.Struct(" int: """Page shift for the intel memory layers.""" return cls._page_size_in_bits - @classproperty + @volatility3.classproperty @functools.lru_cache def page_size(cls) -> int: """Page size for the intel memory layers. @@ -90,30 +90,30 @@ class Intel(linear.LinearlyMappedLayer): """ return 1 << cls._page_size_in_bits - @classproperty + @volatility3.classproperty @functools.lru_cache def page_mask(cls) -> int: """Page mask for the intel memory layers.""" return ~(cls.page_size - 1) - @classproperty + @volatility3.classproperty @functools.lru_cache def bits_per_register(cls) -> int: """Returns the bits_per_register to determine the range of an IntelTranslationLayer.""" return cls._bits_per_register - @classproperty + @volatility3.classproperty @functools.lru_cache def minimum_address(cls) -> int: return 0 - @classproperty + @volatility3.classproperty @functools.lru_cache def maximum_address(cls) -> int: return (1 << cls._maxvirtaddr) - 1 - @classproperty + @volatility3.classproperty def structure(cls) -> List[Tuple[str, int, bool]]: return cls._structure diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index f324e24a0..e8b1246d3 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -7,11 +7,6 @@ from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple, Union from volatility3.framework import constants, exceptions, interfaces, objects from volatility3.framework.configuration import requirements -from volatility3.framework.configuration.requirements import ( - IntRequirement, - TranslationLayerRequirement, -) -from volatility3.framework.exceptions import InvalidAddressException from volatility3.framework.layers import linear from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows import extensions @@ -154,7 +149,7 @@ class RegistryHive(linear.LinearlyMappedLayer): @property def root_cell_offset(self) -> int: """Returns the offset for the root cell in this hive.""" - with contextlib.suppress(InvalidAddressException): + with contextlib.suppress(exceptions.InvalidAddressException): if ( self._base_block.Signature.cast( "string", max_length=4, encoding="latin-1" @@ -271,7 +266,7 @@ class RegistryHive(linear.LinearlyMappedLayer): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - IntRequirement( + requirements.IntRequirement( name="hive_offset", description="Offset within the base layer at which the hive lives", default=0, @@ -280,7 +275,7 @@ class RegistryHive(linear.LinearlyMappedLayer): requirements.SymbolTableRequirement( name="nt_symbols", description="Windows kernel symbols" ), - TranslationLayerRequirement( + requirements.TranslationLayerRequirement( name="base_layer", description="Layer in which the registry hive lives", optional=False, diff --git a/volatility3/framework/layers/xen.py b/volatility3/framework/layers/xen.py index c0a5e1a7d..7f42eb662 100644 --- a/volatility3/framework/layers/xen.py +++ b/volatility3/framework/layers/xen.py @@ -5,7 +5,7 @@ from typing import Optional from volatility3.framework import constants, interfaces, exceptions from volatility3.framework.layers import elf from volatility3.framework.symbols import intermed -from volatility3.framework.constants.linux import ELF_CLASS +from volatility3.framework.constants import linux as linux_constants vollog = logging.getLogger(__name__) @@ -15,7 +15,7 @@ class XenCoreDumpLayer(elf.Elf64Layer): _header_struct = struct.Struct(" ELF_MAX_EXTRACTION_SIZE: + if real_size < 0 or real_size > linux_constants.ELF_MAX_EXTRACTION_SIZE: raise ValueError(f"The claimed size of the ELF is invalid: {real_size}") sections[start] = real_size diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index ed21acfd1..c1707d26f 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -6,9 +6,9 @@ from typing import List, Dict, Iterator import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import interfaces, deprecation +from volatility3.framework import interfaces, deprecation, renderers from volatility3.framework.configuration import requirements -from volatility3.framework.renderers import format_hints, TreeGrid, NotAvailableValue +from volatility3.framework.renderers import format_hints from volatility3.framework.symbols.linux import extensions from volatility3.framework.constants import architectures from volatility3.framework.symbols.linux.utilities import tainting @@ -156,12 +156,12 @@ spot modules presence and taints.""" yield ( 0, ( - module.get_name() or NotAvailableValue(), + module.get_name() or renderers.NotAvailableValue(), format_hints.Hex(module_offset), linux_utilities_modules.ModuleGathererLsmod.name in gatherers, linux_utilities_modules.ModuleGathererSysFs.name in gatherers, linux_utilities_modules.ModuleGathererScanner.name in gatherers, - taints or NotAvailableValue(), + taints or renderers.NotAvailableValue(), ), ) @@ -175,7 +175,7 @@ spot modules presence and taints.""" ("Taints", str), ] - return TreeGrid( + return renderers.TreeGrid( columns, self._generator(), ) diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index da5d8cb8c..a6acf825b 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -5,8 +5,8 @@ import logging from typing import Callable, Tuple, List, Dict -from volatility3.framework import interfaces, exceptions, constants, objects -from volatility3.framework.renderers import TreeGrid, NotAvailableValue, format_hints +from volatility3.framework import interfaces, exceptions, constants, objects, renderers +from volatility3.framework.renderers import format_hints from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility @@ -44,7 +44,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface): try: netns_id = task.nsproxy.net_ns.get_inode() except AttributeError: - netns_id = NotAvailableValue() + netns_id = renderers.NotAvailableValue() self._netdevices = self._build_network_devices_map(netns_id) @@ -79,7 +79,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface): ) for net_dev in net.dev_base_head.to_list(net_device_symname, "dev_list"): if ( - isinstance(netns_id, NotAvailableValue) + isinstance(netns_id, renderers.NotAvailableValue) or net.get_inode() != netns_id ): continue @@ -263,7 +263,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface): # Kernel >= 3.7.10 src_port = netlink_sock.get_portid() except AttributeError: - src_port = NotAvailableValue() + src_port = renderers.NotAvailableValue() dst_addr = f"group:0x{netlink_sock.dst_group:08x}" module = netlink_sock.module @@ -273,7 +273,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface): try: dst_port = netlink_sock.get_dst_portid() except AttributeError: - dst_port = NotAvailableValue() + dst_port = renderers.NotAvailableValue() state = netlink_sock.get_state() @@ -571,7 +571,7 @@ class Sockstat(plugins.PluginInterface): try: netns_id = net.get_inode() except AttributeError: - netns_id = NotAvailableValue() + netns_id = renderers.NotAvailableValue() yield task, netns_id, fd_num, family, sock_type, protocol, sock_fields @@ -586,10 +586,11 @@ class Sockstat(plugins.PluginInterface): `sock_stat` and `protocol` formatted. """ sock_stat = [ - NotAvailableValue() if field is None else str(field) for field in sock_stat + renderers.NotAvailableValue() if field is None else str(field) + for field in sock_stat ] if protocol is None: - protocol = NotAvailableValue() + protocol = renderers.NotAvailableValue() return tuple(sock_stat), protocol @@ -641,7 +642,7 @@ class Sockstat(plugins.PluginInterface): socket_filter_str = ( ",".join(f"{k}={v}" for k, v in extended.items()) if extended - else NotAvailableValue() + else renderers.NotAvailableValue() ) task_comm = utility.array_to_string(task.comm) @@ -685,6 +686,6 @@ class Sockstat(plugins.PluginInterface): ("Filter", str), ] - return TreeGrid( + return renderers.TreeGrid( tree_grid_args, self._generator(pids, netns_id, kernel_module_name) ) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index c5e4f9ef8..afcc71784 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -10,9 +10,9 @@ from enum import Enum from dataclasses import dataclass import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements -from volatility3.framework.renderers import format_hints, TreeGrid, NotAvailableValue +from volatility3.framework.renderers import format_hints from volatility3.framework.constants import architectures vollog = logging.getLogger(__name__) @@ -239,14 +239,14 @@ class CheckFtrace(interfaces.plugins.PluginInterface): ): formatted_results = ( format_hints.Hex(ftrace_ops_parsed.ftrace_ops_offset), - ftrace_ops_parsed.callback_symbol or NotAvailableValue(), + ftrace_ops_parsed.callback_symbol or renderers.NotAvailableValue(), format_hints.Hex(ftrace_ops_parsed.callback_address), - ftrace_ops_parsed.hooked_symbols or NotAvailableValue(), - ftrace_ops_parsed.module_name or NotAvailableValue(), + ftrace_ops_parsed.hooked_symbols or renderers.NotAvailableValue(), + ftrace_ops_parsed.module_name or renderers.NotAvailableValue(), ( format_hints.Hex(ftrace_ops_parsed.module_address) if ftrace_ops_parsed.module_address is not None - else NotAvailableValue() + else renderers.NotAvailableValue() ), ) if self.config["show_ftrace_flags"]: @@ -266,7 +266,7 @@ class CheckFtrace(interfaces.plugins.PluginInterface): if self.config.get("show_ftrace_flags"): columns.append(("Flags", str)) - return TreeGrid( + return renderers.TreeGrid( columns, self._generator(), ) diff --git a/volatility3/framework/plugins/linux/tracing/tracepoints.py b/volatility3/framework/plugins/linux/tracing/tracepoints.py index 9d4a4a2e3..25c87b664 100644 --- a/volatility3/framework/plugins/linux/tracing/tracepoints.py +++ b/volatility3/framework/plugins/linux/tracing/tracepoints.py @@ -5,15 +5,15 @@ # Public researches: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Fixing-A-Memory-Forensics-Blind-Spot-Linux-Kernel-Tracing-wp.pdf import logging -from typing import Iterable, List, Optional from dataclasses import dataclass +from typing import Iterable, List, Optional import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements -from volatility3.framework.renderers import format_hints, NotAvailableValue, TreeGrid -from volatility3.framework.objects import utility from volatility3.framework.constants import architectures +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) @@ -250,14 +250,14 @@ class CheckTracepoints(interfaces.plugins.PluginInterface): formatted_results = ( tracepoint_parsed.tracepoint_name, format_hints.Hex(tracepoint_parsed.tracepoint_address), - tracepoint_parsed.probe_name or NotAvailableValue(), + tracepoint_parsed.probe_name or renderers.NotAvailableValue(), format_hints.Hex(tracepoint_parsed.probe_address), - tracepoint_parsed.probe_priority or NotAvailableValue(), - tracepoint_parsed.module_name or NotAvailableValue(), + tracepoint_parsed.probe_priority or renderers.NotAvailableValue(), + tracepoint_parsed.module_name or renderers.NotAvailableValue(), ( format_hints.Hex(tracepoint_parsed.module_address) if tracepoint_parsed.module_address is not None - else NotAvailableValue() + else renderers.NotAvailableValue() ), ) yield ( @@ -276,7 +276,7 @@ class CheckTracepoints(interfaces.plugins.PluginInterface): ("Module address", format_hints.Hex), ] - return TreeGrid( + return renderers.TreeGrid( columns, self._generator(), ) diff --git a/volatility3/framework/plugins/mac/bash.py b/volatility3/framework/plugins/mac/bash.py index 5ad6facd0..ac10d4f4a 100644 --- a/volatility3/framework/plugins/mac/bash.py +++ b/volatility3/framework/plugins/mac/bash.py @@ -12,7 +12,7 @@ from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.layers import scanners from volatility3.framework.objects import utility -from volatility3.framework.symbols.linux.bash import BashIntermedSymbols +from volatility3.framework.symbols.linux import bash from volatility3.plugins import timeliner from volatility3.plugins.mac import pslist @@ -68,7 +68,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): pack_format = "Q" bash_json_file = "bash64" - bash_table_name = BashIntermedSymbols.create( + bash_table_name = bash.BashIntermedSymbols.create( self.context, self.config_path, "linux", bash_json_file ) diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py index e0adad2b1..e23b8ec3a 100755 --- a/volatility3/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -7,9 +7,14 @@ import ntpath import re from typing import List, Tuple, Type, Optional, Generator -from volatility3.framework import interfaces, renderers, exceptions, constants +from volatility3.framework import ( + interfaces, + exceptions, + constants, + renderers, +) from volatility3.framework.configuration import requirements -from volatility3.framework.renderers import format_hints, UnreadableValue +from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import handles from volatility3.plugins.windows import pslist @@ -258,7 +263,7 @@ class DumpFiles(interfaces.plugins.PluginInterface): if file_re: name = file_obj.file_name_with_device() - if isinstance(name, UnreadableValue): + if isinstance(name, renderers.UnreadableValue): continue if not file_re.search(name): continue @@ -298,7 +303,7 @@ class DumpFiles(interfaces.plugins.PluginInterface): if file_re: name = file_obj.file_name_with_device() - if isinstance(name, UnreadableValue): + if isinstance(name, renderers.UnreadableValue): continue if not file_re.search(name): continue diff --git a/volatility3/framework/plugins/windows/info.py b/volatility3/framework/plugins/windows/info.py index a2e438c3f..3ff224c68 100644 --- a/volatility3/framework/plugins/windows/info.py +++ b/volatility3/framework/plugins/windows/info.py @@ -3,12 +3,11 @@ # import time -from typing import List, Tuple, Iterable +from typing import Iterable, List, Tuple -from volatility3.framework import constants, interfaces, layers, symbols +from volatility3.framework import constants, interfaces, layers, renderers, symbols from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins -from volatility3.framework.renderers import TreeGrid from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows.extensions import kdbg, pe @@ -294,4 +293,6 @@ class Info(plugins.PluginInterface): ) def run(self): - return TreeGrid([("Variable", str), ("Value", str)], self._generator()) + return renderers.TreeGrid( + [("Variable", str), ("Value", str)], self._generator() + ) diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py index 3a08a1002..e3af0c28a 100644 --- a/volatility3/framework/plugins/windows/pe_symbols.py +++ b/volatility3/framework/plugins/windows/pe_symbols.py @@ -17,7 +17,7 @@ from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows import pdbutil from volatility3.framework.symbols.windows.extensions import pe from volatility3.plugins.windows import pslist, modules -from volatility3.framework.constants.windows import KERNEL_MODULE_NAMES +from volatility3.framework.constants import windows vollog = logging.getLogger(__name__) @@ -533,7 +533,7 @@ class PESymbols(interfaces.plugins.PluginInterface): # a `ntoskrnl.exe` can have an internal PDB name of any of the ones in the following list # The code attempts to find all possible PDBs to ensure the best chance of recovery if mod_name == PESymbols.os_module_name: - pdb_names = [fn + ".pdb" for fn in KERNEL_MODULE_NAMES] + pdb_names = [fn + ".pdb" for fn in windows.KERNEL_MODULE_NAMES] # for non-kernel files, replace the exe, sys, or dll extension with pdb else: diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index 7c3444f70..142987c3e 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -4,10 +4,10 @@ import string from itertools import chain from typing import Dict, Iterable, List -from volatility3.framework import constants, exceptions +from volatility3.framework import constants, exceptions, renderers from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins -from volatility3.framework.renderers import TreeGrid, format_hints +from volatility3.framework.renderers import format_hints from volatility3.framework.symbols.windows import extensions from volatility3.plugins.windows import ( handles, @@ -231,7 +231,7 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter offset_type = "(Physical)" if self.config["physical-offsets"] else "(Virtual)" offset_str = "Offset" + offset_type - return TreeGrid( + return renderers.TreeGrid( [ (offset_str, format_hints.Hex), ("Name", str), diff --git a/volatility3/framework/plugins/windows/registry/hashdump.py b/volatility3/framework/plugins/windows/registry/hashdump.py index 630aa1cfd..1883d4530 100644 --- a/volatility3/framework/plugins/windows/registry/hashdump.py +++ b/volatility3/framework/plugins/windows/registry/hashdump.py @@ -11,8 +11,7 @@ from Crypto.Cipher import AES, ARC4, DES from volatility3.framework import interfaces, renderers, exceptions, constants from volatility3.framework.configuration import requirements -from volatility3.framework.exceptions import InvalidAddressException -from volatility3.framework.layers import registry as registrylayer +from volatility3.framework.layers import registry as registry_layer from volatility3.framework.symbols.windows.extensions import registry from volatility3.plugins.windows.registry import hivelist @@ -329,13 +328,13 @@ class Hashdump(interfaces.plugins.PluginInterface): @classmethod def get_hive_key( - cls, hive: registry.RegistryHive, key: str + cls, hive: registry_layer.RegistryHive, key: str ) -> Optional["registry.CM_KEY_NODE"]: result = None try: if hive: result = hive.get_key(key) - except (KeyError, registrylayer.RegistryException): + except (KeyError, registry_layer.RegistryException): vollog.info( f"Unable to load the required registry key {hive.get_name()}\\{key} from this memory image" ) @@ -343,7 +342,7 @@ class Hashdump(interfaces.plugins.PluginInterface): @classmethod def get_user_keys( - cls, samhive: registry.RegistryHive + cls, samhive: registry_layer.RegistryHive ) -> List[interfaces.objects.ObjectInterface]: user_key_path = "SAM\\Domains\\Account\\Users" @@ -354,7 +353,7 @@ class Hashdump(interfaces.plugins.PluginInterface): return [k for k in user_key.get_subkeys() if k.Name != "Names"] @classmethod - def get_bootkey(cls, syshive: registry.RegistryHive) -> Optional[bytes]: + def get_bootkey(cls, syshive: registry_layer.RegistryHive) -> Optional[bytes]: """ Returns the scrambled bootkey necesary to decrypt hashes """ @@ -382,8 +381,8 @@ class Hashdump(interfaces.plugins.PluginInterface): return None bootkey += class_data.decode("utf-16-le") except ( - InvalidAddressException, - registrylayer.RegistryException, + exceptions.InvalidAddressException, + registry_layer.RegistryException, ) as excp: vollog.log( constants.LOGLEVEL_VVV, f"Unable to read Lsa key {lk}: {excp}" @@ -398,7 +397,7 @@ class Hashdump(interfaces.plugins.PluginInterface): @classmethod def get_hbootkey( - cls, samhive: registry.RegistryHive, bootkey: bytes + cls, samhive: registry_layer.RegistryHive, bootkey: bytes ) -> Optional[bytes]: sam_account_path = "SAM\\Domains\\Account" @@ -456,7 +455,10 @@ class Hashdump(interfaces.plugins.PluginInterface): @classmethod def get_user_hashes( - cls, user: registry.CM_KEY_NODE, samhive: registry.RegistryHive, hbootkey: bytes + cls, + user: registry.CM_KEY_NODE, + samhive: registry_layer.RegistryHive, + hbootkey: bytes, ) -> Optional[Tuple[bytes, bytes]]: ## Will sometimes find extra user with rid = NAMES, returns empty strings right now try: @@ -470,7 +472,7 @@ class Hashdump(interfaces.plugins.PluginInterface): sam_data = samhive.read(v.Data + 4, v.DataLength) except ( exceptions.InvalidAddressException, - registrylayer.RegistryException, + registry_layer.RegistryException, ): return None @@ -570,7 +572,7 @@ class Hashdump(interfaces.plugins.PluginInterface): @classmethod def get_user_name( - cls, user: registry.CM_KEY_NODE, samhive: registry.RegistryHive + cls, user: registry.CM_KEY_NODE, samhive: registry_layer.RegistryHive ) -> Optional[bytes]: value = None for v in user.get_values(): @@ -593,7 +595,7 @@ class Hashdump(interfaces.plugins.PluginInterface): # replaces the dump_hashes method in vol2 def _generator( - self, syshive: registry.RegistryHive, samhive: registry.RegistryHive + self, syshive: registry_layer.RegistryHive, samhive: registry_layer.RegistryHive ): if syshive is None: vollog.debug("SYSTEM address is None: No system hive found") diff --git a/volatility3/framework/plugins/windows/registry/lsadump.py b/volatility3/framework/plugins/windows/registry/lsadump.py index 2154923ec..e394822d6 100644 --- a/volatility3/framework/plugins/windows/registry/lsadump.py +++ b/volatility3/framework/plugins/windows/registry/lsadump.py @@ -10,9 +10,8 @@ from Crypto.Cipher import ARC4, DES, AES from volatility3.framework import interfaces, renderers, exceptions from volatility3.framework.configuration import requirements -from volatility3.framework.exceptions import InvalidAddressException -from volatility3.framework.layers import registry +from volatility3.framework.layers import registry as registry_layers from volatility3.framework.symbols.windows import versions from volatility3.plugins.windows.registry import hashdump, hivelist from volatility3.framework.renderers import format_hints @@ -65,7 +64,7 @@ class Lsadump(interfaces.plugins.PluginInterface): @classmethod def get_lsa_key( - cls, sechive: registry.RegistryHive, bootkey: bytes, vista_or_later: bool + cls, sechive: registry_layers.RegistryHive, bootkey: bytes, vista_or_later: bool ) -> Optional[bytes]: if not bootkey: return None @@ -109,7 +108,7 @@ class Lsadump(interfaces.plugins.PluginInterface): @classmethod def get_secret_by_name( cls, - sechive: registry.RegistryHive, + sechive: registry_layers.RegistryHive, name: str, lsakey: bytes, is_vista_or_later: bool, @@ -123,8 +122,8 @@ class Lsadump(interfaces.plugins.PluginInterface): try: enc_secret_value = next(enc_secret_key.get_values(), None) except ( - InvalidAddressException, - registry.RegistryException, + exceptions.InvalidAddressException, + registry_layers.RegistryException, ): enc_secret_value = None @@ -171,7 +170,9 @@ class Lsadump(interfaces.plugins.PluginInterface): return decrypted_data[8 : 8 + dec_data_len] def _generator( - self, syshive: registry.RegistryHive, sechive: registry.RegistryHive + self, + syshive: registry_layers.RegistryHive, + sechive: registry_layers.RegistryHive, ): kernel = self.context.modules[self.config["kernel"]] @@ -206,8 +207,8 @@ class Lsadump(interfaces.plugins.PluginInterface): enc_secret_value = next(sec_val_key.get_values(), None) except ( StopIteration, - InvalidAddressException, - registry.RegistryException, + exceptions.InvalidAddressException, + registry_layers.RegistryException, ): enc_secret_value = None @@ -229,8 +230,8 @@ class Lsadump(interfaces.plugins.PluginInterface): try: key_name = key.get_name() except ( - InvalidAddressException, - registry.RegistryException, + exceptions.InvalidAddressException, + registry_layers.RegistryException, ): key_name = renderers.UnreadableValue() diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index 6ca56b1bb..ab9a0392d 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -4,18 +4,13 @@ import datetime import logging -from typing import List, Optional, Sequence, Iterable, Tuple, Union +from typing import Iterable, List, Optional, Sequence, Tuple, Union -from volatility3.framework import objects, renderers, exceptions, interfaces, constants +from volatility3.framework import constants, exceptions, interfaces, objects, renderers from volatility3.framework.configuration import requirements -from volatility3.framework.layers.registry import ( - RegistryHive, - RegistryFormatException, - InvalidAddressException, - RegistryException, -) -from volatility3.framework.renderers import TreeGrid, conversion, format_hints -from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes +from volatility3.framework.layers import registry as registry_layer +from volatility3.framework.renderers import conversion, format_hints +from volatility3.framework.symbols.windows.extensions import registry from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) @@ -55,7 +50,7 @@ class PrintKey(interfaces.plugins.PluginInterface): @classmethod def key_iterator( cls, - hive: RegistryHive, + hive: registry_layer.RegistryHive, node_path: Optional[Sequence[objects.StructType]] = None, recurse: bool = False, ) -> Iterable[ @@ -87,14 +82,14 @@ class PrintKey(interfaces.plugins.PluginInterface): try: key_path_names.append(k.get_name()) except ( - InvalidAddressException, - RegistryException, + registry_layer.InvalidAddressException, + registry_layer.RegistryException, ): key_path_names.append("-") key_path = "\\".join([k for k in key_path_names]) if node.vol.type_name.endswith(constants.BANG + "_CELL_DATA"): - raise RegistryFormatException( + raise registry_layer.RegistryFormatException( hive.name, "Encountered _CELL_DATA instead of _CM_KEY_NODE" ) last_write_time = conversion.wintime_to_datetime(node.LastWriteTime.QuadPart) @@ -116,7 +111,7 @@ class PrintKey(interfaces.plugins.PluginInterface): key_node.get_name() except ( exceptions.InvalidAddressException, - RegistryException, + registry_layer.RegistryException, ) as excp: vollog.debug(excp) continue @@ -138,7 +133,7 @@ class PrintKey(interfaces.plugins.PluginInterface): def _printkey_iterator( self, - hive: RegistryHive, + hive: registry_layer.RegistryHive, node_path: Optional[Sequence[objects.StructType]] = None, recurse: bool = False, ): @@ -166,7 +161,7 @@ class PrintKey(interfaces.plugins.PluginInterface): key_node_name = node.get_name() except ( exceptions.InvalidAddressException, - RegistryException, + registry_layer.RegistryException, ) as excp: vollog.debug(excp) key_node_name = renderers.UnreadableValue() @@ -193,16 +188,16 @@ class PrintKey(interfaces.plugins.PluginInterface): value_node_name = node.get_name() or "(Default)" except ( exceptions.InvalidAddressException, - RegistryException, + registry_layer.RegistryException, ) as excp: vollog.debug(excp) value_node_name = renderers.UnreadableValue() try: - value_type = RegValueTypes(node.Type).name + value_type = registry.RegValueTypes(node.Type).name except ( exceptions.InvalidAddressException, - RegistryException, + registry_layer.RegistryException, ) as excp: vollog.debug(excp) value_type = renderers.UnreadableValue() @@ -222,11 +217,17 @@ class PrintKey(interfaces.plugins.PluginInterface): value_data = format_hints.MultiTypeData( value_data, encoding="utf-8" ) - elif RegValueTypes(node.Type) == RegValueTypes.REG_BINARY: + elif ( + registry.RegValueTypes(node.Type) + == registry.RegValueTypes.REG_BINARY + ): value_data = format_hints.MultiTypeData( value_data, show_hex=True ) - elif RegValueTypes(node.Type) == RegValueTypes.REG_MULTI_SZ: + elif ( + registry.RegValueTypes(node.Type) + == registry.RegValueTypes.REG_MULTI_SZ + ): value_data = format_hints.MultiTypeData( value_data, encoding="utf-16-le", split_nulls=True ) @@ -237,7 +238,7 @@ class PrintKey(interfaces.plugins.PluginInterface): except ( ValueError, exceptions.InvalidAddressException, - RegistryException, + registry_layer.RegistryException, ) as excp: vollog.debug(excp) value_data = renderers.UnreadableValue() @@ -279,13 +280,13 @@ class PrintKey(interfaces.plugins.PluginInterface): except ( exceptions.InvalidAddressException, KeyError, - RegistryException, + registry_layer.RegistryException, ) as excp: if isinstance(excp, KeyError): vollog.debug( f"Key '{key}' not found in Hive at offset {hex(hive.hive_offset)}." ) - elif isinstance(excp, RegistryException): + elif isinstance(excp, registry_layer.RegistryException): vollog.debug(excp) elif isinstance(excp, exceptions.InvalidAddressException): vollog.debug( @@ -308,7 +309,7 @@ class PrintKey(interfaces.plugins.PluginInterface): def run(self): offset = self.config.get("offset", None) - return TreeGrid( + return renderers.TreeGrid( columns=[ ("Last Write Time", datetime.datetime), ("Hive Offset", format_hints.Hex), diff --git a/volatility3/framework/plugins/windows/registry/scheduled_tasks.py b/volatility3/framework/plugins/windows/registry/scheduled_tasks.py index 09ebed7b9..a2789e5df 100644 --- a/volatility3/framework/plugins/windows/registry/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/registry/scheduled_tasks.py @@ -1216,7 +1216,7 @@ class ScheduledTasks(interfaces.plugins.PluginInterface, timeliner.TimeLinerInte @classmethod def _get_task_keys( - cls, software_hive: reg_extensions.RegistryHive + cls, software_hive: registry.RegistryHive ) -> Tuple[ Optional[reg_extensions.CM_KEY_NODE], Optional[reg_extensions.CM_KEY_NODE] ]: diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index 809d0b2b3..3272b241c 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -12,11 +12,8 @@ from typing import Any, Generator, List, Tuple from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements -from volatility3.framework.layers.physical import BufferDataLayer -from volatility3.framework.layers.registry import ( - RegistryHive, - RegistryException, -) +from volatility3.framework.layers import physical +from volatility3.framework.layers import registry as registry_layers from volatility3.framework.renderers import conversion, format_hints from volatility3.framework.symbols import intermed from volatility3.plugins.windows.registry import hivelist @@ -94,7 +91,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac return item userassist_layer_name = self.context.layers.free_layer_name("userassist_buffer") - buffer = BufferDataLayer( + buffer = physical.BufferDataLayer( self.context, self._config_path, userassist_layer_name, userassist_data ) self.context.add_layer(buffer) @@ -158,7 +155,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac ).has_member("CookiePad") def list_userassist( - self, hive: RegistryHive + self, hive: registry_layers.RegistryHive ) -> Generator[Tuple[int, Tuple], None, None]: """Generate userassist data for a registry hive.""" @@ -180,7 +177,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac "software\\microsoft\\windows\\currentversion\\explorer\\userassist", return_list=True, ) - except RegistryException as e: + except registry_layers.RegistryException as e: vollog.warning( f"Error accessing UserAssist key in {hive_name} at {hive.hive_offset:#x}: {e}" ) @@ -250,7 +247,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac subkey_name = subkey.get_name() except ( exceptions.InvalidAddressException, - RegistryException, + registry_layers.RegistryException, ): subkey_name = renderers.UnreadableValue() @@ -279,7 +276,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac value_name = value.get_name() except ( exceptions.InvalidAddressException, - RegistryException, + registry_layers.RegistryException, ): value_name = renderers.UnreadableValue() diff --git a/volatility3/framework/plugins/windows/truecrypt.py b/volatility3/framework/plugins/windows/truecrypt.py index aaab49d20..0478e37a5 100644 --- a/volatility3/framework/plugins/windows/truecrypt.py +++ b/volatility3/framework/plugins/windows/truecrypt.py @@ -3,20 +3,15 @@ # import logging +from typing import Generator, Iterable, List, Tuple -from typing import Iterable, Generator, List, Tuple - -from volatility3.framework import constants, interfaces, renderers +from volatility3.framework import constants, interfaces, objects, renderers from volatility3.framework.configuration import requirements -from volatility3.framework.interfaces.configuration import RequirementInterface -from volatility3.framework.interfaces.objects import ObjectInterface -from volatility3.framework.objects import Bytes, DataFormatInfo, Integer, StructType -from volatility3.framework.objects.templates import ObjectTemplate +from volatility3.framework.interfaces import configuration from volatility3.framework.objects.utility import array_to_string from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows.extensions import pe - from volatility3.plugins.windows import modules vollog = logging.getLogger(__name__) @@ -29,7 +24,7 @@ class Passphrase(interfaces.plugins.PluginInterface): _required_framework_version = (2, 5, 2) @classmethod - def get_requirements(cls) -> List[RequirementInterface]: + def get_requirements(cls) -> List[configuration.RequirementInterface]: return [ requirements.ModuleRequirement( "kernel", @@ -67,7 +62,7 @@ class Passphrase(interfaces.plugins.PluginInterface): layer_name, module_base, ) - data_section: StructType = next( + data_section: objects.StructType = next( sec for sec in dos_header.get_nt_header().get_sections() if array_to_string(sec.Name) == ".data" @@ -76,11 +71,11 @@ class Passphrase(interfaces.plugins.PluginInterface): size: int = data_section.Misc.VirtualSize # Looking at `Length` in TrueCrypt/Common/Password.h::Password struct DWORD_SIZE_BYTES: int = 4 - format = DataFormatInfo( + format = objects.DataFormatInfo( length=DWORD_SIZE_BYTES, byteorder="little", signed=True ) - int32 = ObjectTemplate( - Integer, pe_table_name + constants.BANG + "int", data_format=format + int32 = objects.templates.ObjectTemplate( + objects.Integer, pe_table_name + constants.BANG + "int", data_format=format ) count, not_aligned = divmod(size, DWORD_SIZE_BYTES) if not_aligned: @@ -99,7 +94,7 @@ class Passphrase(interfaces.plugins.PluginInterface): if not min_length <= length <= 64: continue offset = length.vol["offset"] + DWORD_SIZE_BYTES - passphrase: Bytes = self.context.object( + passphrase: objects.Bytes = self.context.object( pe_table_name + constants.BANG + "bytes", layer_name, offset, @@ -111,7 +106,7 @@ class Passphrase(interfaces.plugins.PluginInterface): continue # TrueCrypt/Common/Password.h::Password struct is padded with # 3 zero bytes to keep 64-byte alignment. - buf: Bytes = self.context.object( + buf: objects.Bytes = self.context.object( pe_table_name + constants.BANG + "bytes", layer_name, offset + length + 1, # +1 for '\0'-terminated password string @@ -124,8 +119,8 @@ class Passphrase(interfaces.plugins.PluginInterface): def _generator(self): kernel = self.context.modules[self.config["kernel"]] - mods: Iterable[ObjectInterface] = modules.Modules.list_modules( - self.context, self.config["kernel"] + mods: Iterable[interfaces.objects.ObjectInterface] = ( + modules.Modules.list_modules(self.context, self.config["kernel"]) ) try: truecrypt_module_base = next( diff --git a/volatility3/framework/symbols/linux/network.py b/volatility3/framework/symbols/linux/network.py index c88e6fc69..72ffe8047 100644 --- a/volatility3/framework/symbols/linux/network.py +++ b/volatility3/framework/symbols/linux/network.py @@ -1,9 +1,9 @@ from volatility3.framework.symbols import intermed from volatility3.framework.symbols.linux.extensions import network -from volatility3.framework.interfaces.configuration import VersionableInterface +from volatility3.framework.interfaces import configuration -class NetSymbols(VersionableInterface): +class NetSymbols(configuration.VersionableInterface): _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 75608cfc6..9fe250ba5 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -18,7 +18,6 @@ from volatility3.framework import ( renderers, symbols, ) -from volatility3.framework.interfaces.objects import ObjectInterface from volatility3.framework.layers import intel from volatility3.framework.objects import utility from volatility3.framework.renderers import conversion @@ -413,7 +412,9 @@ class DEVICE_OBJECT(objects.StructType, pool.ExecutiveObject): header = self.get_object_header() return header.NameInfo.Name.String # type: ignore - def get_attached_devices(self) -> Generator[ObjectInterface, None, None]: + def get_attached_devices( + self, + ) -> Generator[interfaces.objects.ObjectInterface, None, None]: """Enumerate the attached device's objects""" seen = set() @@ -443,7 +444,7 @@ class DRIVER_OBJECT(objects.StructType, pool.ExecutiveObject): header = self.get_object_header() return header.NameInfo.Name.String # type: ignore - def get_devices(self) -> Generator[ObjectInterface, None, None]: + def get_devices(self) -> Generator[interfaces.objects.ObjectInterface, None, None]: """Enumerate the driver's device objects""" seen = set() diff --git a/volatility3/framework/symbols/windows/extensions/network.py b/volatility3/framework/symbols/windows/extensions/network.py index e41ac6a05..62cb4fba4 100644 --- a/volatility3/framework/symbols/windows/extensions/network.py +++ b/volatility3/framework/symbols/windows/extensions/network.py @@ -4,17 +4,15 @@ import logging import socket -from typing import Dict, Tuple, List, Union, Optional +from typing import Dict, List, Optional, Tuple, Union -from volatility3.framework import exceptions -from volatility3.framework import objects, interfaces -from volatility3.framework.objects import Array +from volatility3.framework import exceptions, interfaces, objects from volatility3.framework.renderers import conversion vollog = logging.getLogger(__name__) -def inet_ntop(address_family: int, packed_ip: Union[List[int], Array]) -> str: +def inet_ntop(address_family: int, packed_ip: Union[List[int], objects.Array]) -> str: if address_family in [socket.AF_INET6, socket.AF_INET]: try: return socket.inet_ntop(address_family, bytes(packed_ip)) diff --git a/volatility3/framework/symbols/windows/extensions/pool.py b/volatility3/framework/symbols/windows/extensions/pool.py index b0c480d19..f12182fa7 100644 --- a/volatility3/framework/symbols/windows/extensions/pool.py +++ b/volatility3/framework/symbols/windows/extensions/pool.py @@ -4,7 +4,7 @@ import logging import struct from typing import Dict, List, Optional, Tuple, Union -from volatility3.plugins.windows.poolscanner import PoolConstraint +from volatility3.plugins.windows import poolscanner from volatility3.framework import ( constants, @@ -28,7 +28,7 @@ class POOL_HEADER(objects.StructType): def get_object( self, - constraint: PoolConstraint, + constraint: poolscanner.PoolConstraint, use_top_down: bool, kernel_symbol_table: Optional[str] = None, native_layer_name: Optional[str] = None, diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py index 987f01ac1..e3419fab0 100644 --- a/volatility3/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -8,10 +8,7 @@ import struct from typing import Iterator, Optional, Union, cast from volatility3.framework import constants, exceptions, interfaces, objects -from volatility3.framework.layers.registry import ( - RegistryException, - RegistryHive, -) +from volatility3.framework.layers import registry vollog = logging.getLogger(__name__) @@ -102,7 +99,9 @@ class CMHIVE(objects.StructType): for attr in ["FileFullPath", "FileUserName", "HiveRootPath"]: with contextlib.suppress( - AttributeError, exceptions.InvalidAddressException, RegistryException + AttributeError, + exceptions.InvalidAddressException, + registry.RegistryException, ): name = getattr(self, attr) if name.Length > 0: @@ -172,7 +171,9 @@ class CM_KEY_NODE(objects.StructType): Raises TypeError if the key was not instantiated on a RegistryHive layer """ - if not isinstance(self._context.layers[self.vol.layer_name], RegistryHive): + if not isinstance( + self._context.layers[self.vol.layer_name], registry.RegistryHive + ): raise TypeError("CM_KEY_NODE was not instantiated on a RegistryHive layer") return bool(self.vol.offset & 0x80000000) @@ -182,7 +183,7 @@ class CM_KEY_NODE(objects.StructType): Raises TypeError if the key was not instantiated on a RegistryHive layer """ hive = self._context.layers[self.vol.layer_name] - if not isinstance(hive, RegistryHive): + if not isinstance(hive, registry.RegistryHive): raise TypeError("CM_KEY_NODE was not instantiated on a RegistryHive layer") for index in range(2): # Use get_cell because it should *always* be a KeyIndex @@ -190,7 +191,7 @@ class CM_KEY_NODE(objects.StructType): yield from self._get_subkeys_recursive(hive, subkey_node) def _get_subkeys_recursive( - self, hive: RegistryHive, node: interfaces.objects.ObjectInterface + self, hive: registry.RegistryHive, node: interfaces.objects.ObjectInterface ) -> Iterator["CM_KEY_NODE"]: """Recursively descend a node returning subkeys.""" # The keylist appears to include 4 bytes of key name after each value @@ -200,7 +201,7 @@ class CM_KEY_NODE(objects.StructType): signature = node.cast("string", max_length=2, encoding="latin-1") except ( exceptions.InvalidAddressException, - RegistryException, + registry.RegistryException, ): return None @@ -229,7 +230,7 @@ class CM_KEY_NODE(objects.StructType): subnode = hive.get_node(subnode_offset) except ( exceptions.InvalidAddressException, - RegistryException, + registry.RegistryException, ): vollog.log( constants.LOGLEVEL_VVV, @@ -244,7 +245,7 @@ class CM_KEY_NODE(objects.StructType): Raises TypeError if the key was not instantiated on a RegistryHive layer """ hive = self._context.layers[self.vol.layer_name] - if not isinstance(hive, RegistryHive): + if not isinstance(hive, registry.RegistryHive): raise TypeError("CM_KEY_NODE was not instantiated on a RegistryHive layer") try: @@ -255,7 +256,7 @@ class CM_KEY_NODE(objects.StructType): if v != 0: try: node = hive.get_node(v) - except (RegistryException,) as excp: + except (registry.RegistryException,) as excp: vollog.debug(f"Invalid address {excp}") continue if isinstance(node, CM_KEY_VALUE): @@ -263,7 +264,7 @@ class CM_KEY_NODE(objects.StructType): except ( exceptions.InvalidAddressException, - RegistryException, + registry.RegistryException, ) as excp: vollog.debug(f"Invalid address in get_values iteration: {excp}") return None @@ -281,7 +282,7 @@ class CM_KEY_NODE(objects.StructType): Raises TypeError if the key was not instantiated on a RegistryHive layer """ reg = self._context.layers[self.vol.layer_name] - if not isinstance(reg, RegistryHive): + if not isinstance(reg, registry.RegistryHive): raise TypeError("Key was not instantiated on a RegistryHive layer") # Using the offset adds a significant delay (since it cannot be cached easily) # if self.vol.offset == reg.get_node(reg.root_cell_offset).vol.offset: @@ -320,7 +321,7 @@ class CM_KEY_VALUE(objects.StructType): data = b"" # Check if the data is stored inline layer = self._context.layers[self.vol.layer_name] - if not isinstance(layer, RegistryHive): + if not isinstance(layer, registry.RegistryHive): raise TypeError("Key value was not instantiated on a RegistryHive layer") # If the high-bit is set @@ -353,7 +354,10 @@ class CM_KEY_VALUE(objects.StructType): offset=layer.get_cell(block_offset).vol.offset, length=amount, ) - except (exceptions.InvalidAddressException, RegistryException): + except ( + exceptions.InvalidAddressException, + registry.RegistryException, + ): vollog.debug( f"Failed to read {amount:x} bytes of data, padding with {amount:x}" ) @@ -363,7 +367,7 @@ class CM_KEY_VALUE(objects.StructType): # but the length at the start could be negative so just adding 4 to jump past it try: data = layer.read(self.Data + 4, datalen) - except (exceptions.InvalidAddressException, RegistryException): + except (exceptions.InvalidAddressException, registry.RegistryException): vollog.debug( f"Failed to read {datalen:x} bytes of data, returning {datalen:x} null bytes" ) diff --git a/volatility3/framework/symbols/windows/extensions/services.py b/volatility3/framework/symbols/windows/extensions/services.py index 0a2194e07..9f36a1b9c 100644 --- a/volatility3/framework/symbols/windows/extensions/services.py +++ b/volatility3/framework/symbols/windows/extensions/services.py @@ -4,7 +4,7 @@ from volatility3.framework import objects, interfaces from volatility3.framework import exceptions -from volatility3.framework.symbols.wrappers import Flags +from volatility3.framework.symbols import wrappers from volatility3.framework import renderers from typing import Union @@ -91,7 +91,7 @@ class SERVICE_RECORD(objects.StructType): "SERVICE_INTERACTIVE_PROCESS": 256, } - type_flags = Flags(choices=SERVICE_TYPE_FLAGS) + type_flags = wrappers.Flags(choices=SERVICE_TYPE_FLAGS) return "|".join(type_flags(self.Type)) def traverse(self): diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index 3c23eddb8..5f5c8cac8 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -16,7 +16,6 @@ from volatility3 import symbols from volatility3.framework import constants, contexts, exceptions, interfaces from volatility3.framework.automagic import symbol_cache from volatility3.framework.configuration import requirements -from volatility3.framework.configuration.requirements import SymbolTableRequirement from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows import pdbconv @@ -140,7 +139,7 @@ class PDBUtility(interfaces.configuration.VersionableInterface): requirement_name = interfaces.configuration.path_head(config_path) # Construct the appropriate symbol table - requirement = SymbolTableRequirement( + requirement = requirements.SymbolTableRequirement( name=requirement_name, description="PDBUtility generated symbol table" ) requirement.construct(context, parent_config_path) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index caf244f95..d96284036 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -4,6 +4,7 @@ import struct from typing import Iterator, List, Optional, Tuple, Type from volatility3.framework import exceptions, interfaces, renderers +from volatility3.framework.layers import registry as registry_layer from volatility3.framework.configuration import requirements from volatility3.framework.symbols.windows.extensions import registry from volatility3.plugins.windows.registry import hivelist, printkey @@ -80,7 +81,7 @@ class Certificates(interfaces.plugins.PluginInterface): ]: with contextlib.suppress( KeyError, - registry.RegistryException, + registry_layer.RegistryException, exceptions.InvalidAddressException, ): # Walk it