WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 21:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Stop overriding the builtin filter method, and ensure suitable parameter names.

Browse Source
This commit is contained in:
Mike Auty
2018-08-30 11:41:19 +01:00
parent 26a4eb66d9
commit 5791cfaab7
16 changed files with 88 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/source/simple-plugin.rst
+1 -1
View File
@@ -109,7 +109,7 @@ that will be output as part of the `TreeGrid`.
self._generator(pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = filter)))
filter_func = filter_func)))
In this instance, the plugin constructs a filter (using the PsList plugin's `classmethod` for creating filters).
It passes checks the plugin's configuration for the `pid` value, and passes it in as a list if it finds it, or None if
volatility/framework/automagic/pdbscan.py
+4 -4
View File
@@ -191,14 +191,14 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
kernel = None
for virtual_layer in self.valid_kernels:
_kvo, kernel = self.valid_kernels[virtual_layer]
filter = os.path.join(kernel['pdb_name'], kernel['GUID'] + "-" + str(kernel['age']))
filter_string = os.path.join(kernel['pdb_name'], kernel['GUID'] + "-" + str(kernel['age']))
# Take the first result of search for the intermediate file
try:
isf_path = intermed.IntermediateSymbolTable.file_symbol_url("windows", filter).__next__()
isf_path = intermed.IntermediateSymbolTable.file_symbol_url("windows", filter_string).__next__()
except StopIteration:
isf_path = ''
if isf_path:
vollog.debug("Using symbol library: {}".format(filter))
vollog.debug("Using symbol library: {}".format(filter_string))
clazz = "volatility.framework.symbols.windows.WindowsKernelIntermedSymbols"
# Set the discovered options
context.config[join(sub_config_path, "class")] = clazz
@@ -207,7 +207,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
requirement.construct(context, config_path)
break
else:
vollog.debug("Required symbol library path not found: {}".format(filter))
vollog.debug("Required symbol library path not found: {}".format(filter_string))
else:
vollog.debug("No suitable kernel pdb signature found")
volatility/plugins/windows/cmdline.py
+5 -5
View File
@@ -43,12 +43,12 @@ class CmdLine(interfaces_plugins.PluginInterface):
def run(self):
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int),
("Process", str),
("Args", str)],
self._generator(pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = filter)))
self._generator(pslist.PsList.list_processes(context = self.context,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
filter_func = filter_func)))
volatility/plugins/windows/dlldump.py
+8 -8
View File
@@ -37,16 +37,16 @@ class DllDump(interfaces_plugins.PluginInterface):
"windows",
"pe")
filter = lambda _: False
filter_func = lambda _: False
if self.config.get('address', None) is not None:
filter = lambda x: x.get_start() not in [self.config['address']]
filter_func = lambda x: x.get_start() not in [self.config['address']]
for proc in procs:
process_name = utility.array_to_string(proc.ImageFileName)
# TODO: what kind of exceptions could this raise and what should we do?
proc_layer_name = proc.add_process_layer()
for vad in vadinfo.VadInfo.list_vads(proc, filter = filter):
for vad in vadinfo.VadInfo.list_vads(proc, filter_func = filter_func):
# this parameter is inherited from the VadInfo plugin. if a user specifies
# an address, then it bypasses the DLL identification heuristics
@@ -92,12 +92,12 @@ class DllDump(interfaces_plugins.PluginInterface):
result_text))
def run(self):
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int),
("Process", str),
("Result", str)],
self._generator(pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = filter)))
self._generator(pslist.PsList.list_processes(context = self.context,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
filter_func = filter_func)))
volatility/plugins/windows/dlllist.py
+5 -5
View File
@@ -38,7 +38,7 @@ class DllList(interfaces_plugins.PluginInterface):
def run(self):
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int),
("Process", str),
@@ -46,7 +46,7 @@ class DllList(interfaces_plugins.PluginInterface):
("Size", format_hints.Hex),
("Name", str),
("Path", str)],
self._generator(pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = filter)))
self._generator(pslist.PsList.list_processes(context = self.context,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
filter_func = filter_func)))
volatility/plugins/windows/handles.py
+2 -2
View File
@@ -308,7 +308,7 @@ class Handles(interfaces_plugins.PluginInterface):
def run(self):
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int),
("Process", str),
@@ -319,4 +319,4 @@ class Handles(interfaces_plugins.PluginInterface):
self._generator(pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = filter)))
filter_func = filter_func)))
volatility/plugins/windows/hivelist.py
+6 -6
View File
@@ -19,16 +19,16 @@ class HiveList(plugins.PluginInterface):
default = None)]
def _generator(self):
for hive in self.list_hives(self.context,
self.config["primary"],
self.config["nt_symbols"],
self.config.get('filter', None)):
for hive in self.list_hives(context = self.context,
layer_name = self.config["primary"],
symbol_table = self.config["nt_symbols"],
filter_string = self.config.get('filter', None)):
yield (0, (format_hints.Hex(hive.vol.offset),
hive.get_name() or ""))
@classmethod
def list_hives(cls, context, layer_name, symbol_table, filter = None):
def list_hives(cls, context, layer_name, symbol_table, filter_string = None):
"""Lists all the hives in the primary layer"""
# We only use the object factory to demonstrate how to use one
@@ -41,7 +41,7 @@ class HiveList(plugins.PluginInterface):
cmhive = ntkrnlmp.object(type_name = "_CMHIVE", offset = list_entry.vol.offset - reloff)
for hive in cmhive.HiveList:
if filter is None or filter.lower() in str(hive.get_name() or "").lower():
if filter_string is None or filter_string.lower() in str(hive.get_name() or "").lower():
yield hive
def run(self):
volatility/plugins/windows/malfind.py
+5 -5
View File
@@ -116,7 +116,7 @@ class Malfind(interfaces_plugins.PluginInterface):
disasm))
def run(self):
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int),
("Process", str),
@@ -128,7 +128,7 @@ class Malfind(interfaces_plugins.PluginInterface):
("PrivateMemory", int),
("Hexdump", format_hints.HexBytes),
("Disasm", interfaces_renderers.Disassembly)],
self._generator(pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = filter)))
self._generator(pslist.PsList.list_processes(context = self.context,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
filter_func = filter_func)))
volatility/plugins/windows/moddump.py
+9 -7
View File
@@ -39,11 +39,12 @@ class ModDump(interfaces_plugins.PluginInterface):
layers = [layer_name]
seen_ids = []
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
for proc in pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols']):
for proc in pslist.PsList.list_processes(context = self.context,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
filter_func = filter_func):
proc_layer_name = proc.add_process_layer()
try:
@@ -136,6 +137,7 @@ class ModDump(interfaces_plugins.PluginInterface):
return renderers.TreeGrid([("Base", format_hints.Hex),
("Name", str),
("Result", str)],
self._generator(modules.Modules.list_modules(self.context,
self.config['primary'],
self.config['nt_symbols'])))
self._generator(
modules.Modules.list_modules(context = self.context,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'])))
volatility/plugins/windows/modules.py
+2 -2
View File
@@ -40,11 +40,11 @@ class Modules(plugins.PluginInterface):
def list_modules(cls,
context: interfaces.context.ContextInterface,
layer_name: str,
nt_symbols: str):
symbol_table: str):
"""Lists all the modules in the primary layer"""
kvo = context.memory[layer_name].config['kernel_virtual_offset']
ntkrnlmp = context.module(nt_symbols, layer_name = layer_name, offset = kvo)
ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo)
try:
# use this type if its available (starting with windows 10)
volatility/plugins/windows/procdump.py
+5 -5
View File
@@ -68,12 +68,12 @@ class ProcDump(interfaces_plugins.PluginInterface):
result_text))
def run(self):
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int),
("Process", str),
("Result", str)],
self._generator(pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = filter)))
self._generator(pslist.PsList.list_processes(context = self.context,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
filter_func = filter_func)))
volatility/plugins/windows/pslist.py
+8 -8
View File
@@ -30,26 +30,26 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
@classmethod
def create_filter(cls, pid_list: typing.List[int] = None) -> typing.Callable[[int], bool]:
filter = lambda _: False
filter_func = lambda _: False
# FIXME: mypy #4973 or #2608
pid_list = pid_list or []
filter_list = [x for x in pid_list if x is not None]
if filter_list:
filter = lambda x: x not in filter_list
return filter
filter_func = lambda x: x not in filter_list
return filter_func
@classmethod
def list_processes(cls,
context: interfaces.context.ContextInterface,
layer_name: str,
nt_symbols: str,
filter: typing.Callable[[int], bool] = lambda _: False) -> \
symbol_table: str,
filter_func: typing.Callable[[int], bool] = lambda _: False) -> \
typing.Iterable[interfaces.objects.ObjectInterface]:
"""Lists all the processes in the primary layer that are in the pid config option"""
# We only use the object factory to demonstrate how to use one
kvo = context.memory[layer_name].config['kernel_virtual_offset']
ntkrnlmp = context.module(nt_symbols, layer_name = layer_name, offset = kvo)
ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo)
ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address
list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + ps_aph_offset)
@@ -69,7 +69,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
eproc = ntkrnlmp.object(type_name = "_EPROCESS", offset = list_entry.vol.offset - reloff)
for proc in eproc.ActiveProcessLinks:
if not filter(proc):
if not filter_func(proc):
yield proc
def _generator(self):
@@ -77,7 +77,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
for proc in self.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = self.create_filter([self.config.get('pid', None)])):
filter_func = self.create_filter([self.config.get('pid', None)])):
if not self.config.get('physical', self.PHYSICAL_DEFAULT):
offset = proc.vol.offset
volatility/plugins/windows/userassist.py
+5 -4
View File
@@ -211,10 +211,11 @@ class UserAssist(interfaces_plugins.PluginInterface):
if self.config.get('offset', None) is None:
try:
import volatility.plugins.windows.hivelist as hivelist
hive_offsets = [hive.vol.offset for hive in hivelist.HiveList.list_hives(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = "ntuser.dat")]
hive_offsets = [hive.vol.offset for hive in
hivelist.HiveList.list_hives(context = self.context,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
filter_string = "ntuser.dat")]
except ImportError:
vollog.warning("Unable to import windows.hivelist plugin, please provide a hive offset")
raise ValueError("Unable to import windows.hivelist plugin, please provide a hive offset")
volatility/plugins/windows/vaddump.py
+8 -8
View File
@@ -29,9 +29,9 @@ class VadDump(interfaces_plugins.PluginInterface):
def _generator(self, procs):
filter = lambda _: False
filter_func = lambda _: False
if self.config.get('address', None) is not None:
filter = lambda x: x.get_start() not in [self.config['address']]
filter_func = lambda x: x.get_start() not in [self.config['address']]
chunk_size = 1024 * 1024 * 10
@@ -42,7 +42,7 @@ class VadDump(interfaces_plugins.PluginInterface):
proc_layer_name = proc.add_process_layer()
proc_layer = self.context.memory[proc_layer_name]
for vad in vadinfo.VadInfo.list_vads(proc, filter = filter):
for vad in vadinfo.VadInfo.list_vads(proc, filter_func = filter_func):
try:
filedata = interfaces_plugins.FileInterface(
"pid.{0}.vad.{1:#x}-{2:#x}.dmp".format(proc.UniqueProcessId,
@@ -69,12 +69,12 @@ class VadDump(interfaces_plugins.PluginInterface):
result_text))
def run(self):
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int),
("Process", str),
("Result", str)],
self._generator(pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = filter)))
self._generator(pslist.PsList.list_processes(context = self.context,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
filter_func = filter_func)))
volatility/plugins/windows/vadinfo.py
+10 -10
View File
@@ -67,23 +67,23 @@ class VadInfo(interfaces_plugins.PluginInterface):
@classmethod
def list_vads(cls, proc: interfaces.objects.ObjectInterface,
filter: typing.Callable[[int], bool] = lambda _: False) -> \
filter_func: typing.Callable[[int], bool] = lambda _: False) -> \
typing.Generator[interfaces.objects.ObjectInterface, None, None]:
for vad in proc.get_vad_root().traverse():
if not filter(vad):
if not filter_func(vad):
yield vad
def _generator(self, procs):
filter = lambda _: False
filter_func = lambda _: False
if self.config.get('address', None) is not None:
filter = lambda x: x.get_start() not in [self.config['address']]
filter_func = lambda x: x.get_start() not in [self.config['address']]
for proc in procs:
process_name = utility.array_to_string(proc.ImageFileName)
for vad in self.list_vads(proc, filter = filter):
for vad in self.list_vads(proc, filter_func = filter_func):
yield (0, (proc.UniqueProcessId,
process_name,
format_hints.Hex(vad.vol.offset),
@@ -100,7 +100,7 @@ class VadInfo(interfaces_plugins.PluginInterface):
def run(self):
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
return renderers.TreeGrid([("PID", int),
("Process", str),
@@ -113,7 +113,7 @@ class VadInfo(interfaces_plugins.PluginInterface):
("PrivateMemory", int),
("Parent", format_hints.Hex),
("File", str)],
self._generator(pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = filter)))
self._generator(pslist.PsList.list_processes(context = self.context,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
filter_func = filter_func)))
volatility/plugins/windows/vadyarascan.py
+5 -5
View File
@@ -58,12 +58,12 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
else:
vollog.error("No yara rules, nor yara rules file were specified")
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_filter([self.config.get('pid', None)])
for task in pslist.PsList.list_processes(self.context,
self.config['primary'],
self.config['nt_symbols'],
filter = filter):
for task in pslist.PsList.list_processes(context = self.context,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
filter_func = filter_func):
for offset, name in layer.scan(context = self.context,
scanner = yarascan.YaraScanner(rules = rules),
max_address = self.config['max_size'],