diff --git a/volatility/framework/plugins/linux/bash.py b/volatility/framework/plugins/linux/bash.py index b09ac51ba..309845fda 100644 --- a/volatility/framework/plugins/linux/bash.py +++ b/volatility/framework/plugins/linux/bash.py @@ -43,7 +43,8 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols") + requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), ] def _generator(self, tasks): diff --git a/volatility/framework/plugins/linux/elfs.py b/volatility/framework/plugins/linux/elfs.py index b366a93c3..1b5f5aeb6 100644 --- a/volatility/framework/plugins/linux/elfs.py +++ b/volatility/framework/plugins/linux/elfs.py @@ -39,7 +39,8 @@ class Elfs(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols") + requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)) ] def _generator(self, tasks): diff --git a/volatility/framework/plugins/linux/lsof.py b/volatility/framework/plugins/linux/lsof.py index aec1c1b99..642d3200c 100644 --- a/volatility/framework/plugins/linux/lsof.py +++ b/volatility/framework/plugins/linux/lsof.py @@ -41,7 +41,8 @@ class Lsof(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols") + requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)) ] def _generator(self, tasks): diff --git a/volatility/framework/plugins/linux/proc.py b/volatility/framework/plugins/linux/proc.py index c5279553d..0d3776f49 100644 --- a/volatility/framework/plugins/linux/proc.py +++ b/volatility/framework/plugins/linux/proc.py @@ -38,7 +38,8 @@ class Maps(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols") + requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)) ] def _generator(self, tasks): diff --git a/volatility/framework/plugins/linux/pslist.py b/volatility/framework/plugins/linux/pslist.py index b3c749e56..034e1505f 100644 --- a/volatility/framework/plugins/linux/pslist.py +++ b/volatility/framework/plugins/linux/pslist.py @@ -18,10 +18,11 @@ # specific language governing rights and limitations under the License. # -from typing import Callable, Iterable, List +from typing import Callable, Iterable, List, Any import volatility.framework.interfaces.plugins as interfaces_plugins -from volatility.framework import renderers, interfaces, contexts, constants +from volatility import classproperty +from volatility.framework import renderers, interfaces, contexts from volatility.framework.automagic import linux from volatility.framework.configuration import requirements from volatility.framework.objects import utility @@ -30,6 +31,10 @@ from volatility.framework.objects import utility class PsList(interfaces_plugins.PluginInterface): """Lists the processes present in a particular linux memory image""" + @classproperty + def version(cls): + return (1, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ @@ -39,7 +44,7 @@ class PsList(interfaces_plugins.PluginInterface): ] @classmethod - def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]: + def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[Any], bool]: # FIXME: mypy #4973 or #2608 pid_list = pid_list or [] filter_list = [x for x in pid_list if x is not None] diff --git a/volatility/framework/plugins/mac/bash.py b/volatility/framework/plugins/mac/bash.py index 18594cbae..196e38abf 100644 --- a/volatility/framework/plugins/mac/bash.py +++ b/volatility/framework/plugins/mac/bash.py @@ -43,7 +43,8 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols") + requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)) ] def _generator(self, tasks): diff --git a/volatility/framework/plugins/mac/lsmod.py b/volatility/framework/plugins/mac/lsmod.py index d6024b979..110b18a45 100644 --- a/volatility/framework/plugins/mac/lsmod.py +++ b/volatility/framework/plugins/mac/lsmod.py @@ -20,8 +20,8 @@ """A module containing a collection of plugins that produce data typically found in Mac's lsmod command. """ - -from volatility.framework import renderers, interfaces, contexts, constants +from volatility import classproperty +from volatility.framework import renderers, interfaces, contexts from volatility.framework.automagic import mac from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins @@ -32,6 +32,10 @@ from volatility.framework.renderers import format_hints class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules""" + @classproperty + def version(cls): + return (1, 0, 0) + @classmethod def get_requirements(cls): return [ diff --git a/volatility/framework/plugins/mac/lsof.py b/volatility/framework/plugins/mac/lsof.py index c17c4d0e8..289a901d9 100644 --- a/volatility/framework/plugins/mac/lsof.py +++ b/volatility/framework/plugins/mac/lsof.py @@ -10,6 +10,7 @@ from volatility.plugins.mac import pslist vollog = logging.getLogger(__name__) + class lsof(plugins.PluginInterface): """Lists all open file descriptors for all processes""" @@ -18,7 +19,8 @@ class lsof(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel") + requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel"), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)) ] def _generator(self, tasks): @@ -32,11 +34,10 @@ class lsof(plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) - return renderers.TreeGrid([("PID", int), ("File Descriptor", int), ("File Path", str)], + return renderers.TreeGrid([("PID", int), ("File Descriptor", int), ("File Path", str)], self._generator( - pslist.PsList.list_tasks( + pslist.PsList.list_tasks( self.context, self.config['primary'], self.config['darwin'], - filter_func = filter_func))) - + filter_func = filter_func))) diff --git a/volatility/framework/plugins/mac/netstat.py b/volatility/framework/plugins/mac/netstat.py index 56539e3d2..8d5eab438 100644 --- a/volatility/framework/plugins/mac/netstat.py +++ b/volatility/framework/plugins/mac/netstat.py @@ -19,7 +19,8 @@ class Netstat(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel") + requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel"), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)) ] def _generator(self, tasks): diff --git a/volatility/framework/plugins/mac/psaux.py b/volatility/framework/plugins/mac/psaux.py index f4ceed952..e42269a8b 100644 --- a/volatility/framework/plugins/mac/psaux.py +++ b/volatility/framework/plugins/mac/psaux.py @@ -35,7 +35,8 @@ class Psaux(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols") + requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)) ] def _generator(self, tasks: Iterator[Any]) -> Generator[Tuple[int, Tuple[int, str, int, str]], None, None]: diff --git a/volatility/framework/plugins/mac/pslist.py b/volatility/framework/plugins/mac/pslist.py index d1d39f088..e4cc2434d 100644 --- a/volatility/framework/plugins/mac/pslist.py +++ b/volatility/framework/plugins/mac/pslist.py @@ -21,8 +21,8 @@ import logging from typing import Callable, Iterable, List -import volatility.framework.interfaces.plugins as interfaces_plugins -from volatility.framework import renderers, interfaces, contexts, constants +from volatility import classproperty +from volatility.framework import renderers, interfaces, contexts from volatility.framework.automagic import mac from volatility.framework.configuration import requirements from volatility.framework.objects import utility @@ -30,9 +30,13 @@ from volatility.framework.objects import utility vollog = logging.getLogger(__name__) -class PsList(interfaces_plugins.PluginInterface): +class PsList(interfaces.plugins.PluginInterface): """Lists the processes present in a particular mac memory image""" + @classproperty + def version(cls): + return (1, 0, 0) + @classmethod def get_requirements(cls): return [ diff --git a/volatility/framework/plugins/mac/pstree.py b/volatility/framework/plugins/mac/pstree.py index 396ba2d69..959917cd7 100644 --- a/volatility/framework/plugins/mac/pstree.py +++ b/volatility/framework/plugins/mac/pstree.py @@ -19,10 +19,10 @@ # from volatility.framework import renderers +from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins from volatility.framework.objects import utility from volatility.plugins.mac import pslist -from volatility.framework.configuration import requirements class PsTree(plugins.PluginInterface): @@ -39,7 +39,8 @@ class PsTree(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols") + requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)) ] def _find_level(self, pid): diff --git a/volatility/framework/plugins/mac/trustedbsd.py b/volatility/framework/plugins/mac/trustedbsd.py index de32dc161..3f9b09d9c 100644 --- a/volatility/framework/plugins/mac/trustedbsd.py +++ b/volatility/framework/plugins/mac/trustedbsd.py @@ -41,7 +41,8 @@ class Check_syscall(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols") + requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), + requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] def _generator(self, mods: Iterator[Any]): diff --git a/volatility/framework/plugins/windows/cmdline.py b/volatility/framework/plugins/windows/cmdline.py index 994856cf9..c714baa44 100644 --- a/volatility/framework/plugins/windows/cmdline.py +++ b/volatility/framework/plugins/windows/cmdline.py @@ -37,9 +37,7 @@ class CmdLine(interfaces_plugins.PluginInterface): requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), - requirements.PluginRequirement( - name = 'pslist', description = 'PsList plugin requirement', plugin = pslist.PsList, version = (1, 0, - 0)), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), requirements.IntRequirement( name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True) ] diff --git a/volatility/framework/plugins/windows/moddump.py b/volatility/framework/plugins/windows/moddump.py index 82b6de401..2c59c11fc 100644 --- a/volatility/framework/plugins/windows/moddump.py +++ b/volatility/framework/plugins/windows/moddump.py @@ -41,6 +41,7 @@ class ModDump(interfaces.plugins.PluginInterface): # Reuse the requirements from the plugins we use return [ requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), + requirements.PluginRequirement(name = 'modules', plugin = modules.Modules, version = (1, 0, 0)), requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") diff --git a/volatility/framework/plugins/windows/modules.py b/volatility/framework/plugins/windows/modules.py index a8c93d321..7a90dcdad 100644 --- a/volatility/framework/plugins/windows/modules.py +++ b/volatility/framework/plugins/windows/modules.py @@ -20,6 +20,7 @@ from typing import List +from volatility import classproperty from volatility.framework import constants from volatility.framework import exceptions, interfaces from volatility.framework import renderers @@ -30,6 +31,10 @@ from volatility.framework.renderers import format_hints class Modules(interfaces.plugins.PluginInterface): """Lists the loaded kernel modules""" + @classproperty + def version(cls): + return (1, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ diff --git a/volatility/framework/plugins/windows/poolscanner.py b/volatility/framework/plugins/windows/poolscanner.py index b96143690..37696085a 100644 --- a/volatility/framework/plugins/windows/poolscanner.py +++ b/volatility/framework/plugins/windows/poolscanner.py @@ -25,6 +25,7 @@ from typing import Dict, Generator, List, Optional, Tuple, Callable import volatility.plugins.windows.handles as handles +from volatility import classproperty from volatility.framework import constants, interfaces, renderers, exceptions, symbols from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins, configuration @@ -178,6 +179,10 @@ def os_distinguisher(version_check: Callable[[Tuple[int, ...]], bool], class PoolScanner(plugins.PluginInterface): """A generic pool scanner plugin""" + @classproperty + def version(cls): + return (1, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ diff --git a/volatility/framework/plugins/windows/ssdt.py b/volatility/framework/plugins/windows/ssdt.py index 49523e7ee..39b889d34 100644 --- a/volatility/framework/plugins/windows/ssdt.py +++ b/volatility/framework/plugins/windows/ssdt.py @@ -41,7 +41,8 @@ class SSDT(plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.PluginRequirement(name = 'modules', plugin = modules.Modules, version = (1, 0, 0)), ] @classmethod diff --git a/volatility/framework/plugins/windows/svcscan.py b/volatility/framework/plugins/windows/svcscan.py index 14b88a7a9..d15a315a5 100644 --- a/volatility/framework/plugins/windows/svcscan.py +++ b/volatility/framework/plugins/windows/svcscan.py @@ -20,39 +20,41 @@ import logging from typing import List + from volatility.framework import interfaces, renderers, constants, symbols -from volatility.framework.layers import scanners from volatility.framework.configuration import requirements +from volatility.framework.layers import scanners from volatility.framework.renderers import format_hints -from volatility.plugins.windows import poolscanner, vadyarascan, pslist -from volatility.framework.symbols.windows.extensions import services from volatility.framework.symbols import intermed +from volatility.framework.symbols.windows.extensions import services +from volatility.plugins.windows import poolscanner, vadyarascan, pslist vollog = logging.getLogger(__name__) + class SvcScan(interfaces.plugins.PluginInterface): """Scans for windows services""" is_vista_or_later = poolscanner.os_distinguisher( - version_check=lambda x: x >= (6, 0), fallback_checks=[("KdCopyDataBlock", None, True)]) + version_check = lambda x: x >= (6, 0), fallback_checks = [("KdCopyDataBlock", None, True)]) is_windows_xp = poolscanner.os_distinguisher( - version_check=lambda x: (5, 1) <= x < (5, 2), fallback_checks=[("KdCopyDataBlock", None, False), - ("_HANDLE_TABLE", "HandleCount", True)]) + version_check = lambda x: (5, 1) <= x < (5, 2), + fallback_checks = [("KdCopyDataBlock", None, False), ("_HANDLE_TABLE", "HandleCount", True)]) is_xp_or_2003 = poolscanner.os_distinguisher( - version_check=lambda x: (5, 1) <= x < (6, 0), fallback_checks=[("KdCopyDataBlock", None, False), - ("_HANDLE_TABLE", "HandleCount", True)]) + version_check = lambda x: (5, 1) <= x < (6, 0), + fallback_checks = [("KdCopyDataBlock", None, False), ("_HANDLE_TABLE", "HandleCount", True)]) is_win10_up_to_15063 = poolscanner.os_distinguisher( - version_check=lambda x: (10, 0) <= x < (10, 0, 16299), fallback_checks=[("ObHeaderCookie", None, True), - ("_HANDLE_TABLE", "HandleCount", False), - ("ObHeaderCookie", None, True)]) + version_check = lambda x: (10, 0) <= x < (10, 0, 16299), + fallback_checks = [("ObHeaderCookie", None, True), ("_HANDLE_TABLE", "HandleCount", False), + ("ObHeaderCookie", None, True)]) is_win10_16299_or_later = poolscanner.os_distinguisher( - version_check=lambda x: x >= (10, 0, 16299), fallback_checks=[("ObHeaderCookie", None, True), - ("_HANDLE_TABLE", "HandleCount", False), - ("ObHeaderCookie", None, True)]) + version_check = lambda x: x >= (10, 0, 16299), + fallback_checks = [("ObHeaderCookie", None, True), ("_HANDLE_TABLE", "HandleCount", False), + ("ObHeaderCookie", None, True)]) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -60,25 +62,20 @@ class SvcScan(interfaces.plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols") + requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), + requirements.PluginRequirement(name = 'poolscanner', plugin = poolscanner.PoolScanner, version = (1, 0, 0)), + requirements.PluginRequirement(name = 'vadyarascan', plugin = vadyarascan.VadYaraScan, version = (1, 0, 0)) ] @staticmethod def get_record_tuple(service_record: interfaces.objects.ObjectInterface): - return (format_hints.Hex(service_record.vol.offset), - service_record.Order, - service_record.get_pid(), - service_record.Start.description, - service_record.State.description, - service_record.get_type(), - service_record.get_name(), - service_record.get_display(), - service_record.get_binary()) + return (format_hints.Hex(service_record.vol.offset), service_record.Order, service_record.get_pid(), + service_record.Start.description, service_record.State.description, service_record.get_type(), + service_record.get_name(), service_record.get_display(), service_record.get_binary()) @staticmethod - def create_service_table(context: interfaces.context.ContextInterface, - symbol_table: str, - config_path: str) -> str: + def create_service_table(context: interfaces.context.ContextInterface, symbol_table: str, config_path: str) -> str: native_types = context.symbol_space[symbol_table].natives is_64bit = symbols.symbol_table_is_64bit(context, symbol_table) @@ -89,7 +86,8 @@ class SvcScan(interfaces.plugins.PluginInterface): symbol_filename = "services-xp-2003-x64" elif poolscanner.PoolScanner.is_windows_8_or_later(context = context, symbol_table = symbol_table) and is_64bit: symbol_filename = "services-win8-x64" - elif poolscanner.PoolScanner.is_windows_8_or_later(context = context, symbol_table = symbol_table) and not is_64bit: + elif poolscanner.PoolScanner.is_windows_8_or_later( + context = context, symbol_table = symbol_table) and not is_64bit: symbol_filename = "services-win8-x86" elif SvcScan.is_win10_up_to_15063(context = context, symbol_table = symbol_table) and is_64bit: symbol_filename = "services-win10-15063-x64" @@ -106,26 +104,24 @@ class SvcScan(interfaces.plugins.PluginInterface): else: raise NotImplementedError("This version of Windows is not supported!") - return intermed.IntermediateSymbolTable.create(context, - config_path, - "windows", - symbol_filename, - class_types = services.class_types, - native_types = native_types) + return intermed.IntermediateSymbolTable.create( + context, + config_path, + "windows", + symbol_filename, + class_types = services.class_types, + native_types = native_types) def _generator(self): - service_table_name = self.create_service_table(self.context, - self.config["nt_symbols"], - self.config_path) + service_table_name = self.create_service_table(self.context, self.config["nt_symbols"], self.config_path) - relative_tag_offset = self.context.symbol_space.get_type( - service_table_name + constants.BANG + "_SERVICE_RECORD").relative_child_offset("Tag") + relative_tag_offset = self.context.symbol_space.get_type(service_table_name + constants.BANG + + "_SERVICE_RECORD").relative_child_offset("Tag") filter_func = pslist.PsList.create_name_filter(["services.exe"]) - is_vista_or_later = SvcScan.is_vista_or_later(context = self.context, - symbol_table = self.config["nt_symbols"]) + is_vista_or_later = SvcScan.is_vista_or_later(context = self.context, symbol_table = self.config["nt_symbols"]) if is_vista_or_later: service_tag = b"serH" @@ -134,31 +130,35 @@ class SvcScan(interfaces.plugins.PluginInterface): seen = [] - for task in pslist.PsList.list_processes(context = self.context, - layer_name = self.config['primary'], - symbol_table = self.config['nt_symbols'], - filter_func = filter_func): + for task in pslist.PsList.list_processes( + context = self.context, + layer_name = self.config['primary'], + symbol_table = self.config['nt_symbols'], + filter_func = filter_func): proc_layer_name = task.add_process_layer() layer = self.context.layers[proc_layer_name] - for offset in layer.scan(context = self.context, - scanner = scanners.BytesScanner(needle = service_tag), - sections = vadyarascan.VadYaraScan.get_vad_maps(task)): + for offset in layer.scan( + context = self.context, + scanner = scanners.BytesScanner(needle = service_tag), + sections = vadyarascan.VadYaraScan.get_vad_maps(task)): if not is_vista_or_later: - service_record = self.context.object(service_table_name + constants.BANG + "_SERVICE_RECORD", - offset = offset - relative_tag_offset, - layer_name = proc_layer_name) + service_record = self.context.object( + service_table_name + constants.BANG + "_SERVICE_RECORD", + offset = offset - relative_tag_offset, + layer_name = proc_layer_name) if not service_record.is_valid(): continue yield (0, self.get_record_tuple(service_record)) else: - service_header = self.context.object(service_table_name + constants.BANG + "_SERVICE_HEADER", - offset = offset, - layer_name = proc_layer_name) + service_header = self.context.object( + service_table_name + constants.BANG + "_SERVICE_HEADER", + offset = offset, + layer_name = proc_layer_name) if not service_header.is_valid(): continue @@ -173,13 +173,14 @@ class SvcScan(interfaces.plugins.PluginInterface): yield (0, self.get_record_tuple(service_record)) def run(self): - return renderers.TreeGrid([('Offset', format_hints.Hex), - ('Order', int), - ('Pid', int), - ('Start', str), - ('State', str), - ('Type', str), - ('Name', str), - ('Display', str), - ('Binary', str), - ], self._generator()) + return renderers.TreeGrid([ + ('Offset', format_hints.Hex), + ('Order', int), + ('Pid', int), + ('Start', str), + ('State', str), + ('Type', str), + ('Name', str), + ('Display', str), + ('Binary', str), + ], self._generator()) diff --git a/volatility/framework/plugins/windows/vadyarascan.py b/volatility/framework/plugins/windows/vadyarascan.py index 6339f2807..676acd8ad 100644 --- a/volatility/framework/plugins/windows/vadyarascan.py +++ b/volatility/framework/plugins/windows/vadyarascan.py @@ -21,6 +21,7 @@ import logging from typing import Iterable, List, Tuple +from volatility import classproperty from volatility.framework import interfaces, renderers from volatility.framework.configuration import requirements from volatility.framework.layers import resources @@ -38,6 +39,10 @@ except ImportError: class VadYaraScan(interfaces.plugins.PluginInterface): + @classproperty + def version(cls): + return (1, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [