From 53b3bd7d47ca855a770be8be0119a6a86439a49b Mon Sep 17 00:00:00 2001
From: tvanegro <tvanegro@cisco.com>
Date: Tue, 17 Jun 2025 12:51:59 +0200
Subject: [PATCH] black

---
 .../framework/plugins/linux/malware/malfind.py       |  8 ++++++--
 .../framework/symbols/linux/extensions/__init__.py   | 12 +++++++-----
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/volatility3/framework/plugins/linux/malware/malfind.py b/volatility3/framework/plugins/linux/malware/malfind.py
index 577c6c1e8..4aaaf9bf8 100644
--- a/volatility3/framework/plugins/linux/malware/malfind.py
+++ b/volatility3/framework/plugins/linux/malware/malfind.py
@@ -62,7 +62,11 @@ class Malfind(interfaces.plugins.PluginInterface):
         proc_layer = self.context.layers[proc_layer_name]
 
         # Allowing a dump_size of 0 (no dump)
-        dump_size = self.config.get("dump-size") if self.config.get("dump-size") is not None else 64
+        dump_size = (
+            self.config.get("dump-size")
+            if self.config.get("dump-size") is not None
+            else 64
+        )
 
         # Dumping page defaults to off, as in case a whole r-xp region is dirty
         # this would likely dump 1000's of pages which might not always be wise nor necessary
@@ -88,7 +92,7 @@ class Malfind(interfaces.plugins.PluginInterface):
                         yield vma, f"{vma_name}, page address: {page_addr:#x}, offset: {page_addr-vma.vm_start:#x}", data
                 else:
                     # Original behaviour - Dump the start of the region (not necessarily matching the dirty page)
-                    data = proc_layer.read(vma.vm_start,dump_size,pad=True)
+                    data = proc_layer.read(vma.vm_start, dump_size, pad=True)
                     yield vma, vma_name, data
 
     def _generator(self, tasks):
diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index 94dfb0576..99b2c989c 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -1273,20 +1273,22 @@ class vm_area_struct(objects.StructType):
         except exceptions.InvalidAddressException:
             return None
 
-    def get_malicious_pages(self,proclayer=None):
+    def get_malicious_pages(self, proclayer=None):
         """
         This function will return a list of all malicious pages inside a given dirty region
         """
         malicious_pages = []
         flags_str = self.get_protection()
 
-        if proclayer and "r-x" in flags_str and self.vm_file.dereference().vol.offset !=0:
+        if (
+            proclayer
+            and "r-x" in flags_str
+            and self.vm_file.dereference().vol.offset != 0
+        ):
             for i in range(self.vm_start, self.vm_end, proclayer.page_size):
                 try:
                     if proclayer.is_dirty(i):
-                        vollog.debug(
-                            f"Found malicious (dirty+exec) page at {hex(i)} !"
-                        )
+                        vollog.debug(f"Found malicious (dirty+exec) page at {hex(i)} !")
                         malicious_pages.append(i)
                 except (
                     exceptions.PagedInvalidAddressException,