From 5791cfaab7220f0333b22f675890acd5ff73f5dc Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 30 Aug 2018 11:41:19 +0100 Subject: [PATCH] Stop overriding the builtin filter method, and ensure suitable parameter names. --- doc/source/simple-plugin.rst | 2 +- volatility/framework/automagic/pdbscan.py | 8 ++++---- volatility/plugins/windows/cmdline.py | 10 +++++----- volatility/plugins/windows/dlldump.py | 16 ++++++++-------- volatility/plugins/windows/dlllist.py | 10 +++++----- volatility/plugins/windows/handles.py | 4 ++-- volatility/plugins/windows/hivelist.py | 12 ++++++------ volatility/plugins/windows/malfind.py | 10 +++++----- volatility/plugins/windows/moddump.py | 16 +++++++++------- volatility/plugins/windows/modules.py | 4 ++-- volatility/plugins/windows/procdump.py | 10 +++++----- volatility/plugins/windows/pslist.py | 16 ++++++++-------- volatility/plugins/windows/userassist.py | 9 +++++---- volatility/plugins/windows/vaddump.py | 16 ++++++++-------- volatility/plugins/windows/vadinfo.py | 20 ++++++++++---------- volatility/plugins/windows/vadyarascan.py | 10 +++++----- 16 files changed, 88 insertions(+), 85 deletions(-) diff --git a/doc/source/simple-plugin.rst b/doc/source/simple-plugin.rst index 96d3d4f42..facf3ff93 100644 --- a/doc/source/simple-plugin.rst +++ b/doc/source/simple-plugin.rst @@ -109,7 +109,7 @@ that will be output as part of the `TreeGrid`. self._generator(pslist.PsList.list_processes(self.context, self.config['primary'], self.config['nt_symbols'], - filter = filter))) + filter_func = filter_func))) In this instance, the plugin constructs a filter (using the PsList plugin's `classmethod` for creating filters). It passes checks the plugin's configuration for the `pid` value, and passes it in as a list if it finds it, or None if diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index 11e366e4d..564f1066c 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -191,14 +191,14 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): kernel = None for virtual_layer in self.valid_kernels: _kvo, kernel = self.valid_kernels[virtual_layer] - filter = os.path.join(kernel['pdb_name'], kernel['GUID'] + "-" + str(kernel['age'])) + filter_string = os.path.join(kernel['pdb_name'], kernel['GUID'] + "-" + str(kernel['age'])) # Take the first result of search for the intermediate file try: - isf_path = intermed.IntermediateSymbolTable.file_symbol_url("windows", filter).__next__() + isf_path = intermed.IntermediateSymbolTable.file_symbol_url("windows", filter_string).__next__() except StopIteration: isf_path = '' if isf_path: - vollog.debug("Using symbol library: {}".format(filter)) + vollog.debug("Using symbol library: {}".format(filter_string)) clazz = "volatility.framework.symbols.windows.WindowsKernelIntermedSymbols" # Set the discovered options context.config[join(sub_config_path, "class")] = clazz @@ -207,7 +207,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): requirement.construct(context, config_path) break else: - vollog.debug("Required symbol library path not found: {}".format(filter)) + vollog.debug("Required symbol library path not found: {}".format(filter_string)) else: vollog.debug("No suitable kernel pdb signature found") diff --git a/volatility/plugins/windows/cmdline.py b/volatility/plugins/windows/cmdline.py index b3b5a0983..fe4273c7d 100644 --- a/volatility/plugins/windows/cmdline.py +++ b/volatility/plugins/windows/cmdline.py @@ -43,12 +43,12 @@ class CmdLine(interfaces_plugins.PluginInterface): def run(self): - filter = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("Args", str)], - self._generator(pslist.PsList.list_processes(self.context, - self.config['primary'], - self.config['nt_symbols'], - filter = filter))) + self._generator(pslist.PsList.list_processes(context = self.context, + layer_name = self.config['primary'], + symbol_table = self.config['nt_symbols'], + filter_func = filter_func))) diff --git a/volatility/plugins/windows/dlldump.py b/volatility/plugins/windows/dlldump.py index 503406b45..7ddb250d0 100644 --- a/volatility/plugins/windows/dlldump.py +++ b/volatility/plugins/windows/dlldump.py @@ -37,16 +37,16 @@ class DllDump(interfaces_plugins.PluginInterface): "windows", "pe") - filter = lambda _: False + filter_func = lambda _: False if self.config.get('address', None) is not None: - filter = lambda x: x.get_start() not in [self.config['address']] + filter_func = lambda x: x.get_start() not in [self.config['address']] for proc in procs: process_name = utility.array_to_string(proc.ImageFileName) # TODO: what kind of exceptions could this raise and what should we do? proc_layer_name = proc.add_process_layer() - for vad in vadinfo.VadInfo.list_vads(proc, filter = filter): + for vad in vadinfo.VadInfo.list_vads(proc, filter_func = filter_func): # this parameter is inherited from the VadInfo plugin. if a user specifies # an address, then it bypasses the DLL identification heuristics @@ -92,12 +92,12 @@ class DllDump(interfaces_plugins.PluginInterface): result_text)) def run(self): - filter = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("Result", str)], - self._generator(pslist.PsList.list_processes(self.context, - self.config['primary'], - self.config['nt_symbols'], - filter = filter))) + self._generator(pslist.PsList.list_processes(context = self.context, + layer_name = self.config['primary'], + symbol_table = self.config['nt_symbols'], + filter_func = filter_func))) diff --git a/volatility/plugins/windows/dlllist.py b/volatility/plugins/windows/dlllist.py index a31334358..74e5b7fb6 100644 --- a/volatility/plugins/windows/dlllist.py +++ b/volatility/plugins/windows/dlllist.py @@ -38,7 +38,7 @@ class DllList(interfaces_plugins.PluginInterface): def run(self): - filter = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), @@ -46,7 +46,7 @@ class DllList(interfaces_plugins.PluginInterface): ("Size", format_hints.Hex), ("Name", str), ("Path", str)], - self._generator(pslist.PsList.list_processes(self.context, - self.config['primary'], - self.config['nt_symbols'], - filter = filter))) + self._generator(pslist.PsList.list_processes(context = self.context, + layer_name = self.config['primary'], + symbol_table = self.config['nt_symbols'], + filter_func = filter_func))) diff --git a/volatility/plugins/windows/handles.py b/volatility/plugins/windows/handles.py index c2cf146aa..57b7b5c96 100644 --- a/volatility/plugins/windows/handles.py +++ b/volatility/plugins/windows/handles.py @@ -308,7 +308,7 @@ class Handles(interfaces_plugins.PluginInterface): def run(self): - filter = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), @@ -319,4 +319,4 @@ class Handles(interfaces_plugins.PluginInterface): self._generator(pslist.PsList.list_processes(self.context, self.config['primary'], self.config['nt_symbols'], - filter = filter))) + filter_func = filter_func))) diff --git a/volatility/plugins/windows/hivelist.py b/volatility/plugins/windows/hivelist.py index be365c892..72c6dd3fc 100644 --- a/volatility/plugins/windows/hivelist.py +++ b/volatility/plugins/windows/hivelist.py @@ -19,16 +19,16 @@ class HiveList(plugins.PluginInterface): default = None)] def _generator(self): - for hive in self.list_hives(self.context, - self.config["primary"], - self.config["nt_symbols"], - self.config.get('filter', None)): + for hive in self.list_hives(context = self.context, + layer_name = self.config["primary"], + symbol_table = self.config["nt_symbols"], + filter_string = self.config.get('filter', None)): yield (0, (format_hints.Hex(hive.vol.offset), hive.get_name() or "")) @classmethod - def list_hives(cls, context, layer_name, symbol_table, filter = None): + def list_hives(cls, context, layer_name, symbol_table, filter_string = None): """Lists all the hives in the primary layer""" # We only use the object factory to demonstrate how to use one @@ -41,7 +41,7 @@ class HiveList(plugins.PluginInterface): cmhive = ntkrnlmp.object(type_name = "_CMHIVE", offset = list_entry.vol.offset - reloff) for hive in cmhive.HiveList: - if filter is None or filter.lower() in str(hive.get_name() or "").lower(): + if filter_string is None or filter_string.lower() in str(hive.get_name() or "").lower(): yield hive def run(self): diff --git a/volatility/plugins/windows/malfind.py b/volatility/plugins/windows/malfind.py index 1496b4b65..e7b3d792e 100644 --- a/volatility/plugins/windows/malfind.py +++ b/volatility/plugins/windows/malfind.py @@ -116,7 +116,7 @@ class Malfind(interfaces_plugins.PluginInterface): disasm)) def run(self): - filter = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), @@ -128,7 +128,7 @@ class Malfind(interfaces_plugins.PluginInterface): ("PrivateMemory", int), ("Hexdump", format_hints.HexBytes), ("Disasm", interfaces_renderers.Disassembly)], - self._generator(pslist.PsList.list_processes(self.context, - self.config['primary'], - self.config['nt_symbols'], - filter = filter))) + self._generator(pslist.PsList.list_processes(context = self.context, + layer_name = self.config['primary'], + symbol_table = self.config['nt_symbols'], + filter_func = filter_func))) diff --git a/volatility/plugins/windows/moddump.py b/volatility/plugins/windows/moddump.py index 6e94eb93f..94e4d2149 100644 --- a/volatility/plugins/windows/moddump.py +++ b/volatility/plugins/windows/moddump.py @@ -39,11 +39,12 @@ class ModDump(interfaces_plugins.PluginInterface): layers = [layer_name] seen_ids = [] - filter = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) - for proc in pslist.PsList.list_processes(self.context, - self.config['primary'], - self.config['nt_symbols']): + for proc in pslist.PsList.list_processes(context = self.context, + layer_name = self.config['primary'], + symbol_table = self.config['nt_symbols'], + filter_func = filter_func): proc_layer_name = proc.add_process_layer() try: @@ -136,6 +137,7 @@ class ModDump(interfaces_plugins.PluginInterface): return renderers.TreeGrid([("Base", format_hints.Hex), ("Name", str), ("Result", str)], - self._generator(modules.Modules.list_modules(self.context, - self.config['primary'], - self.config['nt_symbols']))) + self._generator( + modules.Modules.list_modules(context = self.context, + layer_name = self.config['primary'], + symbol_table = self.config['nt_symbols']))) diff --git a/volatility/plugins/windows/modules.py b/volatility/plugins/windows/modules.py index 670d45b63..d92c926b0 100644 --- a/volatility/plugins/windows/modules.py +++ b/volatility/plugins/windows/modules.py @@ -40,11 +40,11 @@ class Modules(plugins.PluginInterface): def list_modules(cls, context: interfaces.context.ContextInterface, layer_name: str, - nt_symbols: str): + symbol_table: str): """Lists all the modules in the primary layer""" kvo = context.memory[layer_name].config['kernel_virtual_offset'] - ntkrnlmp = context.module(nt_symbols, layer_name = layer_name, offset = kvo) + ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) try: # use this type if its available (starting with windows 10) diff --git a/volatility/plugins/windows/procdump.py b/volatility/plugins/windows/procdump.py index 8882d3dbd..c60682500 100644 --- a/volatility/plugins/windows/procdump.py +++ b/volatility/plugins/windows/procdump.py @@ -68,12 +68,12 @@ class ProcDump(interfaces_plugins.PluginInterface): result_text)) def run(self): - filter = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("Result", str)], - self._generator(pslist.PsList.list_processes(self.context, - self.config['primary'], - self.config['nt_symbols'], - filter = filter))) + self._generator(pslist.PsList.list_processes(context = self.context, + layer_name = self.config['primary'], + symbol_table = self.config['nt_symbols'], + filter_func = filter_func))) diff --git a/volatility/plugins/windows/pslist.py b/volatility/plugins/windows/pslist.py index c7303920e..1b54fd845 100644 --- a/volatility/plugins/windows/pslist.py +++ b/volatility/plugins/windows/pslist.py @@ -30,26 +30,26 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): @classmethod def create_filter(cls, pid_list: typing.List[int] = None) -> typing.Callable[[int], bool]: - filter = lambda _: False + filter_func = lambda _: False # FIXME: mypy #4973 or #2608 pid_list = pid_list or [] filter_list = [x for x in pid_list if x is not None] if filter_list: - filter = lambda x: x not in filter_list - return filter + filter_func = lambda x: x not in filter_list + return filter_func @classmethod def list_processes(cls, context: interfaces.context.ContextInterface, layer_name: str, - nt_symbols: str, - filter: typing.Callable[[int], bool] = lambda _: False) -> \ + symbol_table: str, + filter_func: typing.Callable[[int], bool] = lambda _: False) -> \ typing.Iterable[interfaces.objects.ObjectInterface]: """Lists all the processes in the primary layer that are in the pid config option""" # We only use the object factory to demonstrate how to use one kvo = context.memory[layer_name].config['kernel_virtual_offset'] - ntkrnlmp = context.module(nt_symbols, layer_name = layer_name, offset = kvo) + ntkrnlmp = context.module(symbol_table, layer_name = layer_name, offset = kvo) ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address list_entry = ntkrnlmp.object(type_name = "_LIST_ENTRY", offset = kvo + ps_aph_offset) @@ -69,7 +69,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): eproc = ntkrnlmp.object(type_name = "_EPROCESS", offset = list_entry.vol.offset - reloff) for proc in eproc.ActiveProcessLinks: - if not filter(proc): + if not filter_func(proc): yield proc def _generator(self): @@ -77,7 +77,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): for proc in self.list_processes(self.context, self.config['primary'], self.config['nt_symbols'], - filter = self.create_filter([self.config.get('pid', None)])): + filter_func = self.create_filter([self.config.get('pid', None)])): if not self.config.get('physical', self.PHYSICAL_DEFAULT): offset = proc.vol.offset diff --git a/volatility/plugins/windows/userassist.py b/volatility/plugins/windows/userassist.py index 5f7462630..d023d8df7 100644 --- a/volatility/plugins/windows/userassist.py +++ b/volatility/plugins/windows/userassist.py @@ -211,10 +211,11 @@ class UserAssist(interfaces_plugins.PluginInterface): if self.config.get('offset', None) is None: try: import volatility.plugins.windows.hivelist as hivelist - hive_offsets = [hive.vol.offset for hive in hivelist.HiveList.list_hives(self.context, - self.config['primary'], - self.config['nt_symbols'], - filter = "ntuser.dat")] + hive_offsets = [hive.vol.offset for hive in + hivelist.HiveList.list_hives(context = self.context, + layer_name = self.config['primary'], + symbol_table = self.config['nt_symbols'], + filter_string = "ntuser.dat")] except ImportError: vollog.warning("Unable to import windows.hivelist plugin, please provide a hive offset") raise ValueError("Unable to import windows.hivelist plugin, please provide a hive offset") diff --git a/volatility/plugins/windows/vaddump.py b/volatility/plugins/windows/vaddump.py index 06d52a574..6c2662c70 100644 --- a/volatility/plugins/windows/vaddump.py +++ b/volatility/plugins/windows/vaddump.py @@ -29,9 +29,9 @@ class VadDump(interfaces_plugins.PluginInterface): def _generator(self, procs): - filter = lambda _: False + filter_func = lambda _: False if self.config.get('address', None) is not None: - filter = lambda x: x.get_start() not in [self.config['address']] + filter_func = lambda x: x.get_start() not in [self.config['address']] chunk_size = 1024 * 1024 * 10 @@ -42,7 +42,7 @@ class VadDump(interfaces_plugins.PluginInterface): proc_layer_name = proc.add_process_layer() proc_layer = self.context.memory[proc_layer_name] - for vad in vadinfo.VadInfo.list_vads(proc, filter = filter): + for vad in vadinfo.VadInfo.list_vads(proc, filter_func = filter_func): try: filedata = interfaces_plugins.FileInterface( "pid.{0}.vad.{1:#x}-{2:#x}.dmp".format(proc.UniqueProcessId, @@ -69,12 +69,12 @@ class VadDump(interfaces_plugins.PluginInterface): result_text)) def run(self): - filter = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), ("Result", str)], - self._generator(pslist.PsList.list_processes(self.context, - self.config['primary'], - self.config['nt_symbols'], - filter = filter))) + self._generator(pslist.PsList.list_processes(context = self.context, + layer_name = self.config['primary'], + symbol_table = self.config['nt_symbols'], + filter_func = filter_func))) diff --git a/volatility/plugins/windows/vadinfo.py b/volatility/plugins/windows/vadinfo.py index 120a5182e..69e6e5bd9 100644 --- a/volatility/plugins/windows/vadinfo.py +++ b/volatility/plugins/windows/vadinfo.py @@ -67,23 +67,23 @@ class VadInfo(interfaces_plugins.PluginInterface): @classmethod def list_vads(cls, proc: interfaces.objects.ObjectInterface, - filter: typing.Callable[[int], bool] = lambda _: False) -> \ + filter_func: typing.Callable[[int], bool] = lambda _: False) -> \ typing.Generator[interfaces.objects.ObjectInterface, None, None]: for vad in proc.get_vad_root().traverse(): - if not filter(vad): + if not filter_func(vad): yield vad def _generator(self, procs): - filter = lambda _: False + filter_func = lambda _: False if self.config.get('address', None) is not None: - filter = lambda x: x.get_start() not in [self.config['address']] + filter_func = lambda x: x.get_start() not in [self.config['address']] for proc in procs: process_name = utility.array_to_string(proc.ImageFileName) - for vad in self.list_vads(proc, filter = filter): + for vad in self.list_vads(proc, filter_func = filter_func): yield (0, (proc.UniqueProcessId, process_name, format_hints.Hex(vad.vol.offset), @@ -100,7 +100,7 @@ class VadInfo(interfaces_plugins.PluginInterface): def run(self): - filter = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) return renderers.TreeGrid([("PID", int), ("Process", str), @@ -113,7 +113,7 @@ class VadInfo(interfaces_plugins.PluginInterface): ("PrivateMemory", int), ("Parent", format_hints.Hex), ("File", str)], - self._generator(pslist.PsList.list_processes(self.context, - self.config['primary'], - self.config['nt_symbols'], - filter = filter))) + self._generator(pslist.PsList.list_processes(context = self.context, + layer_name = self.config['primary'], + symbol_table = self.config['nt_symbols'], + filter_func = filter_func))) diff --git a/volatility/plugins/windows/vadyarascan.py b/volatility/plugins/windows/vadyarascan.py index 354383f19..01d40920b 100644 --- a/volatility/plugins/windows/vadyarascan.py +++ b/volatility/plugins/windows/vadyarascan.py @@ -58,12 +58,12 @@ class VadYaraScan(interfaces.plugins.PluginInterface): else: vollog.error("No yara rules, nor yara rules file were specified") - filter = pslist.PsList.create_filter([self.config.get('pid', None)]) + filter_func = pslist.PsList.create_filter([self.config.get('pid', None)]) - for task in pslist.PsList.list_processes(self.context, - self.config['primary'], - self.config['nt_symbols'], - filter = filter): + for task in pslist.PsList.list_processes(context = self.context, + layer_name = self.config['primary'], + symbol_table = self.config['nt_symbols'], + filter_func = filter_func): for offset, name in layer.scan(context = self.context, scanner = yarascan.YaraScanner(rules = rules), max_address = self.config['max_size'],