From 5c6107bf33e13e154c20bbcc382fc43390ad5904 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 17:27:45 -0600 Subject: [PATCH] Code Review (style): Use keyword args for clarity This updates a whole host of method calls to pass keyword arguments instead of positional arguments. --- volatility3/framework/layers/registry.py | 2 +- volatility3/framework/plugins/linux/bash.py | 2 +- .../framework/plugins/linux/malfind.py | 2 +- volatility3/framework/plugins/linux/psscan.py | 4 +++- volatility3/framework/plugins/mac/bash.py | 2 +- .../framework/plugins/windows/amcache.py | 8 ++++--- .../framework/plugins/windows/cachedump.py | 6 ++--- .../framework/plugins/windows/callbacks.py | 7 ++++-- .../framework/plugins/windows/cmdline.py | 4 ++-- .../framework/plugins/windows/cmdscan.py | 14 ++++++------ .../framework/plugins/windows/consoles.py | 14 +++++++----- .../plugins/windows/debugregisters.py | 4 +++- .../plugins/windows/direct_system_calls.py | 6 ++--- .../framework/plugins/windows/dlllist.py | 10 +++++---- .../framework/plugins/windows/driverirp.py | 6 +++-- .../framework/plugins/windows/drivermodule.py | 3 ++- .../framework/plugins/windows/dumpfiles.py | 4 ++-- .../framework/plugins/windows/envars.py | 10 ++++----- .../plugins/windows/getservicesids.py | 6 ++--- .../framework/plugins/windows/getsids.py | 10 ++++----- .../framework/plugins/windows/handles.py | 6 ++--- .../framework/plugins/windows/hashdump.py | 6 ++--- .../plugins/windows/hollowprocesses.py | 4 ++-- volatility3/framework/plugins/windows/iat.py | 4 ++-- volatility3/framework/plugins/windows/info.py | 9 +++++++- .../framework/plugins/windows/joblinks.py | 4 ++-- .../framework/plugins/windows/ldrmodules.py | 4 ++-- .../framework/plugins/windows/lsadump.py | 6 ++--- .../framework/plugins/windows/malfind.py | 6 ++--- .../framework/plugins/windows/mbrscan.py | 4 +++- .../framework/plugins/windows/memmap.py | 4 ++-- .../framework/plugins/windows/modules.py | 10 +++++---- .../framework/plugins/windows/netscan.py | 4 +++- .../framework/plugins/windows/netstat.py | 4 +++- .../plugins/windows/orphan_kernel_threads.py | 4 ++-- .../framework/plugins/windows/pe_symbols.py | 8 +++++-- .../framework/plugins/windows/pedump.py | 17 +++++++------- .../framework/plugins/windows/poolscanner.py | 8 +++++-- .../framework/plugins/windows/privileges.py | 4 ++-- .../plugins/windows/processghosting.py | 4 ++-- .../framework/plugins/windows/pstree.py | 4 +++- .../framework/plugins/windows/psxview.py | 4 +++- .../windows/registry/getcellroutine.py | 6 +++-- .../plugins/windows/registry/hivelist.py | 14 ++++++------ .../plugins/windows/registry/hivescan.py | 4 +++- .../plugins/windows/registry/printkey.py | 6 ++--- .../plugins/windows/registry/userassist.py | 6 ++--- .../plugins/windows/scheduled_tasks.py | 8 ++++--- .../framework/plugins/windows/sessions.py | 4 ++-- .../framework/plugins/windows/shimcachemem.py | 22 ++++++++++++++----- .../plugins/windows/skeleton_key_check.py | 8 ++++--- volatility3/framework/plugins/windows/ssdt.py | 6 ++--- .../framework/plugins/windows/strings.py | 10 +++++---- .../plugins/windows/suspended_threads.py | 8 +++++-- .../plugins/windows/suspicious_threads.py | 4 ++-- .../framework/plugins/windows/svcdiff.py | 2 +- .../framework/plugins/windows/svclist.py | 6 ++--- .../framework/plugins/windows/svcscan.py | 14 +++++++----- .../framework/plugins/windows/threads.py | 4 ++-- .../framework/plugins/windows/timers.py | 4 ++-- .../plugins/windows/unhooked_system_calls.py | 8 +++---- .../plugins/windows/unloadedmodules.py | 8 +++++-- .../framework/plugins/windows/vadinfo.py | 4 ++-- .../framework/plugins/windows/vadregexscan.py | 4 ++-- .../framework/plugins/windows/vadwalk.py | 4 ++-- .../framework/plugins/windows/vadyarascan.py | 4 ++-- .../framework/plugins/windows/verinfo.py | 6 +++-- .../plugins/windows/windowstations.py | 22 ++++++++++--------- .../symbols/linux/extensions/__init__.py | 8 +++++-- .../symbols/windows/extensions/__init__.py | 12 +++++++--- .../symbols/windows/extensions/pool.py | 4 +++- .../plugins/windows/registry/certificates.py | 6 ++--- 72 files changed, 286 insertions(+), 192 deletions(-) diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index 6d96a76a1..48dd2b624 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -66,7 +66,7 @@ class RegistryHive(linear.LinearlyMappedLayer): # Win10 17063 introduced the Registry process to map most hives. Check # if it exists and update RegistryHive._base_layer for proc in pslist.PsList.list_processes( - self.context, self.config["kernel_module_name"] + context=self.context, kernel_module_name=self.config["kernel_module_name"] ): proc_name = proc.ImageFileName.cast( "string", max_length=proc.ImageFileName.vol.count, errors="replace" diff --git a/volatility3/framework/plugins/linux/bash.py b/volatility3/framework/plugins/linux/bash.py index 8acfeb848..293c47224 100644 --- a/volatility3/framework/plugins/linux/bash.py +++ b/volatility3/framework/plugins/linux/bash.py @@ -46,7 +46,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): def _generator(self, tasks): vmlinux = self.context.modules[self.config["kernel"]] is_32bit = not symbols.symbol_table_is_64bit( - self.context, vmlinux.symbol_table_name + context=self.context, symbol_table_name=vmlinux.symbol_table_name ) if is_32bit: pack_format = "I" diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py index 297116890..8bbf3b89c 100644 --- a/volatility3/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -64,7 +64,7 @@ class Malfind(interfaces.plugins.PluginInterface): # determine if we're on a 32 or 64 bit kernel vmlinux = self.context.modules[self.config["kernel"]] is_32bit_arch = not symbols.symbol_table_is_64bit( - self.context, vmlinux.symbol_table_name + context=self.context, symbol_table_name=vmlinux.symbol_table_name ) for task in tasks: diff --git a/volatility3/framework/plugins/linux/psscan.py b/volatility3/framework/plugins/linux/psscan.py index ba68c4856..6c4c5eb35 100644 --- a/volatility3/framework/plugins/linux/psscan.py +++ b/volatility3/framework/plugins/linux/psscan.py @@ -84,7 +84,9 @@ class PsScan(interfaces.plugins.PluginInterface): vmlinux = context.modules[vmlinux_module_name] # check if this image is 32bit or 64bit - is_32bit = not symbols.symbol_table_is_64bit(context, vmlinux.symbol_table_name) + is_32bit = not symbols.symbol_table_is_64bit( + context=context, symbol_table_name=vmlinux.symbol_table_name + ) if is_32bit: pack_format = "I" else: diff --git a/volatility3/framework/plugins/mac/bash.py b/volatility3/framework/plugins/mac/bash.py index a52ae616a..5be5e74d6 100644 --- a/volatility3/framework/plugins/mac/bash.py +++ b/volatility3/framework/plugins/mac/bash.py @@ -44,7 +44,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): def _generator(self, tasks): darwin = self.context.modules[self.config["kernel"]] is_32bit = not symbols.symbol_table_is_64bit( - self.context, darwin.symbol_table_name + context=self.context, symbol_table_name=darwin.symbol_table_name ) if is_32bit: pack_format = "I" diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index 2ce1ead02..133297de3 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -259,9 +259,11 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Retrieves the `Amcache.hve` registry hive from the kernel module, if it can be located.""" return next( hivelist.HiveList.list_hives( - context, - interfaces.configuration.path_join(config_path, "hivelist"), - kernel_module_name, + context=context, + base_config_path=interfaces.configuration.path_join( + config_path, "hivelist" + ), + kernel_module_name=kernel_module_name, filter_string="amcache", ), None, diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 5f5862e36..ef4096b42 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -171,9 +171,9 @@ class Cachedump(interfaces.plugins.PluginInterface): syshive = sechive = None for hive in hivelist.HiveList.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], hive_offsets=None if offset is None else [offset], ): if hive.get_name().split("\\")[-1].upper() == "SYSTEM": diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py index 035ed9091..08e343ec7 100644 --- a/volatility3/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -187,7 +187,9 @@ class Callbacks(interfaces.plugins.PluginInterface): The name of the constructed symbol table """ native_types = context.symbol_space[nt_symbol_table].natives - is_64bit = symbols.symbol_table_is_64bit(context, nt_symbol_table) + is_64bit = symbols.symbol_table_is_64bit( + context=context, symbol_table_name=nt_symbol_table + ) table_mapping = {"nt_symbols": nt_symbol_table} if is_64bit: @@ -691,7 +693,8 @@ class Callbacks(interfaces.plugins.PluginInterface): ) collection = ssdt.SSDT.build_module_collection( - self.context, self.config["kernel"] + context=self.context, + kernel_module_name=self.config["kernel"], ) callback_methods = ( diff --git a/volatility3/framework/plugins/windows/cmdline.py b/volatility3/framework/plugins/windows/cmdline.py index dbfac35bf..c095cff9e 100644 --- a/volatility3/framework/plugins/windows/cmdline.py +++ b/volatility3/framework/plugins/windows/cmdline.py @@ -106,8 +106,8 @@ class CmdLine(interfaces.plugins.PluginInterface): [("PID", int), ("Process", str), ("Args", str)], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/cmdscan.py b/volatility3/framework/plugins/windows/cmdscan.py index fd0dd76b9..be955374b 100644 --- a/volatility3/framework/plugins/windows/cmdscan.py +++ b/volatility3/framework/plugins/windows/cmdscan.py @@ -286,11 +286,11 @@ class CmdScan(interfaces.plugins.PluginInterface): if no_registry is False: max_history, _ = consoles.Consoles.get_console_settings_from_registry( - self.context, - self.config_path, - self.config["kernel"], - max_history, - [], + context=self.context, + config_path=self.config_path, + kernel_module_name=self.config["kernel"], + max_history=max_history, + max_buffers=[], ) vollog.debug(f"Possible CommandHistorySize values: {max_history}") @@ -370,8 +370,8 @@ class CmdScan(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=self._conhost_proc_filter, ) ), diff --git a/volatility3/framework/plugins/windows/consoles.py b/volatility3/framework/plugins/windows/consoles.py index a4003956f..ff5875354 100644 --- a/volatility3/framework/plugins/windows/consoles.py +++ b/volatility3/framework/plugins/windows/consoles.py @@ -149,7 +149,9 @@ class Consoles(interfaces.plugins.PluginInterface): The filename of the symbol table to use and the associated class types. """ - is_64bit = symbols.symbol_table_is_64bit(context, nt_symbol_table) + is_64bit = symbols.symbol_table_is_64bit( + context=context, symbol_table_name=nt_symbol_table + ) if is_64bit: arch = "x64" @@ -824,9 +826,9 @@ class Consoles(interfaces.plugins.PluginInterface): ) for hive in hivelist.HiveList.list_hives( - context, - config_path, - kernel_module_name, + context=context, + base_config_path=config_path, + kernel_module_name=kernel_module_name, hive_offsets=None, ): try: @@ -943,8 +945,8 @@ class Consoles(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=self._conhost_proc_filter, ) ), diff --git a/volatility3/framework/plugins/windows/debugregisters.py b/volatility3/framework/plugins/windows/debugregisters.py index 394c30e25..d1404b69f 100644 --- a/volatility3/framework/plugins/windows/debugregisters.py +++ b/volatility3/framework/plugins/windows/debugregisters.py @@ -117,7 +117,9 @@ class DebugRegisters(interfaces.plugins.PluginInterface): proc_modules = None - procs = pslist.PsList.list_processes(self.context, self.config["kernel"]) + procs = pslist.PsList.list_processes( + context=self.context, kernel_module_name=self.config["kernel"] + ) for proc in procs: for thread in threads.Threads.list_threads(kernel, proc): diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py index eaf35e842..9d5b81507 100644 --- a/volatility3/framework/plugins/windows/direct_system_calls.py +++ b/volatility3/framework/plugins/windows/direct_system_calls.py @@ -354,12 +354,12 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): kernel = context.modules[kernel_module_name] is_32bit_arch = not symbols.symbol_table_is_64bit( - context, kernel.symbol_table_name + context=context, symbol_table_name=kernel.symbol_table_name ) for proc in pslist.PsList.list_processes( - context, - kernel_module_name, + context=context, + kernel_module_name=kernel_module_name, filter_func=filter_func, ): proc_name = utility.array_to_string(proc.ImageFileName) diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index b609b4fc3..7efc8a7eb 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -13,7 +13,7 @@ from volatility3.framework.renderers import conversion, format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows.extensions import pe from volatility3.plugins import timeliner -from volatility3.plugins.windows import info, pslist, psscan, pedump +from volatility3.plugins.windows import info, pedump, pslist, psscan vollog = logging.getLogger(__name__) @@ -192,7 +192,9 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): def generate_timeline(self): for row in self._generator( - pslist.PsList.list_processes(self.context, self.config["kernel"]) + pslist.PsList.list_processes( + context=self.context, kernel_module_name=self.config["kernel"] + ) ): _depth, row_data = row if not isinstance(row_data[6], datetime.datetime): @@ -217,8 +219,8 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) else: procs = pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) diff --git a/volatility3/framework/plugins/windows/driverirp.py b/volatility3/framework/plugins/windows/driverirp.py index 2fc699e79..20d8ac170 100644 --- a/volatility3/framework/plugins/windows/driverirp.py +++ b/volatility3/framework/plugins/windows/driverirp.py @@ -71,11 +71,13 @@ class DriverIrp(interfaces.plugins.PluginInterface): def _generator(self): collection = ssdt.SSDT.build_module_collection( - self.context, self.config["kernel"] + context=self.context, + kernel_module_name=self.config["kernel"], ) kernel_space_start = modules.Modules.get_kernel_space_start( - self.context, self.config["kernel"] + context=self.context, + module_name=self.config["kernel"], ) for driver in driverscan.DriverScan.scan_drivers( diff --git a/volatility3/framework/plugins/windows/drivermodule.py b/volatility3/framework/plugins/windows/drivermodule.py index 9b4c78ae8..97e9e5b3c 100644 --- a/volatility3/framework/plugins/windows/drivermodule.py +++ b/volatility3/framework/plugins/windows/drivermodule.py @@ -43,7 +43,8 @@ class DriverModule(interfaces.plugins.PluginInterface): which allows us to detect the disconnect between a malicious driver and its hidden module. """ collection = ssdt.SSDT.build_module_collection( - self.context, self.config["kernel"] + context=self.context, + kernel_module_name=self.config["kernel"], ) kernel_space_start = modules.Modules.get_kernel_space_start( diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py index 74a328f78..e89b99275 100755 --- a/volatility3/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -371,8 +371,8 @@ class DumpFiles(interfaces.plugins.PluginInterface): [self.config.get("pid", None)] ) procs = pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) diff --git a/volatility3/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py index f390c09d5..6f0f8fec1 100644 --- a/volatility3/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -60,9 +60,9 @@ class Envars(interfaces.plugins.PluginInterface): values = [] for hive in hivelist.HiveList.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], hive_offsets=None, ): ## The global variables @@ -225,8 +225,8 @@ class Envars(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py index c222d55b1..6c0040b98 100644 --- a/volatility3/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -76,9 +76,9 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): def _generator(self): # Get the system hive for hive in hivelist.HiveList.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], filter_string="machine\\system", hive_offsets=None, ): diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index ba1820a30..710b98bb6 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -104,9 +104,9 @@ class GetSIDs(interfaces.plugins.PluginInterface): sids = {} for hive in hivelist.HiveList.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], filter_string="config\\software", hive_offsets=None, ): @@ -220,8 +220,8 @@ class GetSIDs(interfaces.plugins.PluginInterface): [("PID", int), ("Process", str), ("SID", str), ("Name", str)], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index d9e97c1b5..4d21cc9d9 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -78,7 +78,7 @@ class Handles(interfaces.plugins.PluginInterface): except AttributeError: # starting with windows 8 is_64bit = symbols.symbol_table_is_64bit( - self.context, kernel.symbol_table_name + context=self.context, symbol_table_name=kernel.symbol_table_name ) if is_64bit: @@ -393,8 +393,8 @@ class Handles(interfaces.plugins.PluginInterface): ) else: procs = pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index 5fdfd549f..fa4081366 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -594,9 +594,9 @@ class Hashdump(interfaces.plugins.PluginInterface): syshive = None samhive = None for hive in hivelist.HiveList.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], hive_offsets=None if offset is None else [offset], ): if hive.get_name().split("\\")[-1].upper() == "SYSTEM": diff --git a/volatility3/framework/plugins/windows/hollowprocesses.py b/volatility3/framework/plugins/windows/hollowprocesses.py index 7990cb112..af559bfbc 100644 --- a/volatility3/framework/plugins/windows/hollowprocesses.py +++ b/volatility3/framework/plugins/windows/hollowprocesses.py @@ -214,8 +214,8 @@ class HollowProcesses(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/iat.py b/volatility3/framework/plugins/windows/iat.py index 0fe39e685..701db5734 100644 --- a/volatility3/framework/plugins/windows/iat.py +++ b/volatility3/framework/plugins/windows/iat.py @@ -137,8 +137,8 @@ class IAT(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=pslist.PsList.create_pid_filter( self.config.get("pid", None) ), diff --git a/volatility3/framework/plugins/windows/info.py b/volatility3/framework/plugins/windows/info.py index efaf1f737..e20af8114 100644 --- a/volatility3/framework/plugins/windows/info.py +++ b/volatility3/framework/plugins/windows/info.py @@ -207,7 +207,14 @@ class Info(plugins.PluginInterface): yield (0, ("Symbols", table.config["isf_url"])) yield ( 0, - ("Is64Bit", str(symbols.symbol_table_is_64bit(self.context, symbol_table))), + ( + "Is64Bit", + str( + symbols.symbol_table_is_64bit( + context=self.context, symbol_table_name=symbol_table + ) + ), + ), ) yield ( 0, diff --git a/volatility3/framework/plugins/windows/joblinks.py b/volatility3/framework/plugins/windows/joblinks.py index f6a59d7d1..a7fa4e709 100644 --- a/volatility3/framework/plugins/windows/joblinks.py +++ b/volatility3/framework/plugins/windows/joblinks.py @@ -46,8 +46,8 @@ class JobLinks(interfaces.plugins.PluginInterface): memory = self.context.layers[kernel.layer_name] for proc in pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], ): try: if not self.config["physical"]: diff --git a/volatility3/framework/plugins/windows/ldrmodules.py b/volatility3/framework/plugins/windows/ldrmodules.py index e1eb14599..32432c44e 100644 --- a/volatility3/framework/plugins/windows/ldrmodules.py +++ b/volatility3/framework/plugins/windows/ldrmodules.py @@ -120,8 +120,8 @@ class LdrModules(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index eb83352e0..ac2b678f6 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -211,9 +211,9 @@ class Lsadump(interfaces.plugins.PluginInterface): syshive = sechive = None for hive in hivelist.HiveList.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], hive_offsets=None if offset is None else [offset], ): if hive.get_name().split("\\")[-1].upper() == "SYSTEM": diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py index 9d79be9dd..33a20ee51 100644 --- a/volatility3/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -172,7 +172,7 @@ class Malfind(interfaces.plugins.PluginInterface): } is_32bit_arch = not symbols.symbol_table_is_64bit( - self.context, kernel.symbol_table_name + context=self.context, symbol_table_name=kernel.symbol_table_name ) for proc in procs: @@ -256,8 +256,8 @@ class Malfind(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/mbrscan.py b/volatility3/framework/plugins/windows/mbrscan.py index e58ca8c24..4d5198181 100644 --- a/volatility3/framework/plugins/windows/mbrscan.py +++ b/volatility3/framework/plugins/windows/mbrscan.py @@ -53,7 +53,9 @@ class MBRScan(interfaces.plugins.PluginInterface): layer = self.context.layers[physical_layer_name] architecture = ( "intel" - if not symbols.symbol_table_is_64bit(self.context, kernel.symbol_table_name) + if not symbols.symbol_table_is_64bit( + context=self.context, symbol_table_name=kernel.symbol_table_name + ) else "intel64" ) diff --git a/volatility3/framework/plugins/windows/memmap.py b/volatility3/framework/plugins/windows/memmap.py index 790c37aab..5a7bd1b9a 100644 --- a/volatility3/framework/plugins/windows/memmap.py +++ b/volatility3/framework/plugins/windows/memmap.py @@ -108,8 +108,8 @@ class Memmap(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index ee42b665b..6ec16af1b 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -92,7 +92,7 @@ class Modules(interfaces.plugins.PluginInterface): session_layers = list( self.get_session_layers( - self.context, + context=self.context, kernel_module_name=self.config["kernel"], ) ) @@ -140,7 +140,9 @@ class Modules(interfaces.plugins.PluginInterface): module = context.modules[module_name] # default is used if/when MmSystemRangeStart is paged out - if symbols.symbol_table_is_64bit(context, module.symbol_table_name): + if symbols.symbol_table_is_64bit( + context=context, symbol_table_name=module.symbol_table_name + ): object_type = "unsigned long long" default_start = 0xFFFF800000000000 else: @@ -188,8 +190,8 @@ class Modules(interfaces.plugins.PluginInterface): kernel = context.modules[kernel_module_name] for proc in pslist.PsList.list_processes( - context, - kernel_module_name, + context=context, + kernel_module_name=kernel_module_name, filter_func=filter_func, ): proc_id = "Unknown" diff --git a/volatility3/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py index c30792908..6f98547d7 100644 --- a/volatility3/framework/plugins/windows/netscan.py +++ b/volatility3/framework/plugins/windows/netscan.py @@ -137,7 +137,9 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # therefore we determine the version based on the kernel version as testing # with several windows versions has showed this to work out correctly. - is_64bit = symbols.symbol_table_is_64bit(context, nt_symbol_table) + is_64bit = symbols.symbol_table_is_64bit( + context=context, symbol_table_name=nt_symbol_table + ) is_18363_or_later = versions.is_win10_18363_or_later( context=context, symbol_table=nt_symbol_table diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index 5b5b56ae3..5daa6cc79 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -319,7 +319,9 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): Returns: The list of TCP endpoint objects from the `layer_name` layer's `PartitionTable` """ - if symbols.symbol_table_is_64bit(context, net_symbol_table): + if symbols.symbol_table_is_64bit( + context=context, symbol_table_name=net_symbol_table + ): alignment = 0x10 else: alignment = 8 diff --git a/volatility3/framework/plugins/windows/orphan_kernel_threads.py b/volatility3/framework/plugins/windows/orphan_kernel_threads.py index bae1160d6..151fe88c9 100644 --- a/volatility3/framework/plugins/windows/orphan_kernel_threads.py +++ b/volatility3/framework/plugins/windows/orphan_kernel_threads.py @@ -60,8 +60,8 @@ class Threads(thrdscan.ThrdScan): A generator of thread objects of orphaned threads """ collection = ssdt.SSDT.build_module_collection( - context, - kernel_module_name, + context=context, + kernel_module_name=kernel_module_name, ) kernel_space_start = modules.Modules.get_kernel_space_start( diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py index 555010ac9..270c6a174 100644 --- a/volatility3/framework/plugins/windows/pe_symbols.py +++ b/volatility3/framework/plugins/windows/pe_symbols.py @@ -803,7 +803,9 @@ class PESymbols(interfaces.plugins.PluginInterface): filter_modules_check = None session_layers = list( - modules.Modules.get_session_layers(context, kernel_module_name) + modules.Modules.get_session_layers( + context=context, kernel_module_name=kernel_module_name + ) ) # special handling for the kernel @@ -917,7 +919,9 @@ class PESymbols(interfaces.plugins.PluginInterface): Args: Generator[Tuple[interfaces.objects.ObjectInterface, str, ranges_type]]: Yields tuple of process objects, layers, and VADs mapping files """ - procs = pslist.PsList.list_processes(context, kernel_module_name) + procs = pslist.PsList.list_processes( + context=context, kernel_module_name=kernel_module_name + ) for proc in procs: try: diff --git a/volatility3/framework/plugins/windows/pedump.py b/volatility3/framework/plugins/windows/pedump.py index 5f2a1d737..9f125410c 100644 --- a/volatility3/framework/plugins/windows/pedump.py +++ b/volatility3/framework/plugins/windows/pedump.py @@ -161,7 +161,9 @@ class PEDump(interfaces.plugins.PluginInterface): """ Extracts a PE file from kernel memory at the given base address """ - session_layers = modules.Modules.get_session_layers(context, kernel_module_name) + session_layers = modules.Modules.get_session_layers( + context=context, kernel_module_name=kernel_module_name + ) session_layer_name = modules.Modules.find_session_layer( context, session_layers, base @@ -195,8 +197,7 @@ class PEDump(interfaces.plugins.PluginInterface): for proc in pslist.PsList.list_processes( context=context, - layer_name=kernel.layer_name, - symbol_table_name=kernel.symbol_table_name, + kernel_module_name=kernel.name, filter_func=filter_func, ): pid = proc.UniqueProcessId @@ -237,11 +238,11 @@ class PEDump(interfaces.plugins.PluginInterface): if self.config["kernel_module"]: pe_files = self.dump_kernel_pe_at_base( - self.context, - self.config["kernel"], - pe_table_name, - self.open, - self.config["base"], + context=self.context, + kernel_module_name=self.config["kernel"], + pe_table_name=pe_table_name, + open_method=self.open, + base=self.config["base"], ) else: filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index 050a86c58..af19cd035 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -417,7 +417,9 @@ class PoolScanner(plugins.PluginInterface): if not is_windows_10: scan_layer = context.layers[scan_layer].config["memory_layer"] - if symbols.symbol_table_is_64bit(context, kernel_symbol_table_name): + if symbols.symbol_table_is_64bit( + context=context, symbol_table_name=kernel_symbol_table_name + ): alignment = 0x10 else: alignment = 8 @@ -565,7 +567,9 @@ class PoolScanner(plugins.PluginInterface): except exceptions.SymbolError: # We have to manually load a symbol table - if symbols.symbol_table_is_64bit(context, symbol_table): + if symbols.symbol_table_is_64bit( + context=context, symbol_table_name=symbol_table + ): is_win_7 = versions.is_windows_7(context, symbol_table) if is_win_7: pool_header_json_filename = "poolheader-x64-win7" diff --git a/volatility3/framework/plugins/windows/privileges.py b/volatility3/framework/plugins/windows/privileges.py index a0282e8c8..e41915442 100644 --- a/volatility3/framework/plugins/windows/privileges.py +++ b/volatility3/framework/plugins/windows/privileges.py @@ -119,8 +119,8 @@ class Privs(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/processghosting.py b/volatility3/framework/plugins/windows/processghosting.py index b94adee47..5bc6bc5a3 100644 --- a/volatility3/framework/plugins/windows/processghosting.py +++ b/volatility3/framework/plugins/windows/processghosting.py @@ -94,8 +94,8 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/pstree.py b/volatility3/framework/plugins/windows/pstree.py index d0cea43ff..24f7e2356 100644 --- a/volatility3/framework/plugins/windows/pstree.py +++ b/volatility3/framework/plugins/windows/pstree.py @@ -84,7 +84,9 @@ class PsTree(interfaces.plugins.PluginInterface): """Generates the Tree of processes.""" kernel = self.context.modules[self.config["kernel"]] - for proc in pslist.PsList.list_processes(self.context, self.config["kernel"]): + for proc in pslist.PsList.list_processes( + context=self.context, kernel_module_name=self.config["kernel"] + ): if not self.config.get("physical", pslist.PsList.PHYSICAL_DEFAULT): offset = proc.vol.offset else: diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index f7df979a8..89ef897cb 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -182,7 +182,9 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter kernel = self.context.modules[self.config["kernel"]] kdbg_list_processes = list( - pslist.PsList.list_processes(self.context, self.config["kernel"]) + pslist.PsList.list_processes( + context=self.context, kernel_module_name=self.config["kernel"] + ) ) # get processes from each source diff --git a/volatility3/framework/plugins/windows/registry/getcellroutine.py b/volatility3/framework/plugins/windows/registry/getcellroutine.py index 724ed1c9d..5be4254ba 100644 --- a/volatility3/framework/plugins/windows/registry/getcellroutine.py +++ b/volatility3/framework/plugins/windows/registry/getcellroutine.py @@ -37,13 +37,15 @@ class GetCellRoutine(interfaces.plugins.PluginInterface): def _generator(self): collection = ssdt.SSDT.build_module_collection( - self.context, self.config["kernel"] + context=self.context, kernel_module_name=self.config["kernel"] ) # walk each hive and validate that the GetCellRoutine handler # is inside of the kernel (ntoskrnl) for hive_object in hivelist.HiveList.list_hives( - self.context, self.config_path, self.config["kernel"] + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], ): hive = hive_object.hive diff --git a/volatility3/framework/plugins/windows/registry/hivelist.py b/volatility3/framework/plugins/windows/registry/hivelist.py index 60ac0445e..fefd24b67 100644 --- a/volatility3/framework/plugins/windows/registry/hivelist.py +++ b/volatility3/framework/plugins/windows/registry/hivelist.py @@ -95,9 +95,9 @@ class HiveList(interfaces.plugins.PluginInterface): # Construct the hive hive = next( self.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], hive_offsets=[hive_object.vol.offset], ) ) @@ -162,10 +162,10 @@ class HiveList(interfaces.plugins.PluginInterface): hive_offsets = [ hive.vol.offset for hive in cls.list_hive_objects( - context, - kernel.layer_name, - kernel.symbol_table_name, - filter_string, + context=context, + layer_name=kernel.layer_name, + symbol_table=kernel.symbol_table_name, + filter_string=filter_string, ) ] except ImportError: diff --git a/volatility3/framework/plugins/windows/registry/hivescan.py b/volatility3/framework/plugins/windows/registry/hivescan.py index 58ed63b4e..d91eeafc2 100644 --- a/volatility3/framework/plugins/windows/registry/hivescan.py +++ b/volatility3/framework/plugins/windows/registry/hivescan.py @@ -50,7 +50,9 @@ class HiveScan(interfaces.plugins.PluginInterface): kernel = context.modules[kernel_name] - is_64bit = symbols.symbol_table_is_64bit(context, kernel.symbol_table_name) + is_64bit = symbols.symbol_table_is_64bit( + context=context, symbol_table_name=kernel.symbol_table_name + ) is_windows_8_1_or_later = versions.is_windows_8_1_or_later( context=context, symbol_table=kernel.symbol_table_name ) diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index c14fcf507..71a54040c 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -245,9 +245,9 @@ class PrintKey(interfaces.plugins.PluginInterface): recurse: bool = False, ): for hive in hivelist.HiveList.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], hive_offsets=hive_offsets, ): try: diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index 0e5d3c90c..e2e1436a8 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -302,9 +302,9 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac # get all the user hive offsets or use the one specified for hive in hivelist.HiveList.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], filter_string="ntuser.dat", hive_offsets=hive_offsets, ): diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index 67b88d8fc..c437d8654 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -1140,9 +1140,11 @@ information about triggers, actions, run times, and creation times.""" """Retrieves the `Amcache.hve` registry hive from the kernel module, if it can be located.""" return next( hivelist.HiveList.list_hives( - context, - interfaces.configuration.path_join(config_path, "hivelist"), - kernel_module_name, + context=context, + base_config_path=interfaces.configuration.path_join( + config_path, "hivelist" + ), + kernel_module_name=kernel_module_name, filter_string="SOFTWARE", ), None, diff --git a/volatility3/framework/plugins/windows/sessions.py b/volatility3/framework/plugins/windows/sessions.py index 99a3cf335..73a537cd4 100644 --- a/volatility3/framework/plugins/windows/sessions.py +++ b/volatility3/framework/plugins/windows/sessions.py @@ -45,8 +45,8 @@ class Sessions(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) sessions = {} for proc in pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ): session_id = proc.get_session_id() diff --git a/volatility3/framework/plugins/windows/shimcachemem.py b/volatility3/framework/plugins/windows/shimcachemem.py index 46045087f..f26bf3d6b 100644 --- a/volatility3/framework/plugins/windows/shimcachemem.py +++ b/volatility3/framework/plugins/windows/shimcachemem.py @@ -93,7 +93,9 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf The name of the constructed shimcache table """ native_types = context.symbol_space[symbol_table_name].natives - is_64bit = symbols.symbol_table_is_64bit(context, symbol_table_name) + is_64bit = symbols.symbol_table_is_64bit( + context=context, symbol_table_name=symbol_table_name + ) table_mapping = {"nt_symbols": symbol_table_name} try: @@ -260,7 +262,11 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf mod_page_offset, mod_page_size = mod_page addr_size = ( - 8 if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name) else 4 + 8 + if symbols.symbol_table_is_64bit( + context=context, symbol_table_name=kernel.symbol_table_name + ) + else 4 ) shim_head = None @@ -322,7 +328,9 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf ).size ersrc_alignment = ( 0x20 - if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name) + if symbols.symbol_table_is_64bit( + context=context, symbol_table_name=kernel.symbol_table_name + ) else 0x10 # 0x20 if context.symbol_space.get_type("pointer").size == 8 else 0x10 ) @@ -420,7 +428,9 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf data_sec_offset + data_sec_size, ( 8 - if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name) + if symbols.symbol_table_is_64bit( + context=context, symbol_table_name=kernel.symbol_table_name + ) else 4 ), ): @@ -448,7 +458,9 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf # On Windows 8 x64, the first cache contains the shim cache. # On Windows 8 x86, 8.1 x86/x64, and 10, the second cache contains the shim cache. if ( - not symbols.symbol_table_is_64bit(context, kernel.symbol_table_name) + not symbols.symbol_table_is_64bit( + context=context, symbol_table_name=kernel.symbol_table_name + ) and not is_8_1_or_later ): valid_head = shim_heads[1] diff --git a/volatility3/framework/plugins/windows/skeleton_key_check.py b/volatility3/framework/plugins/windows/skeleton_key_check.py index b57683f04..bd32d1987 100644 --- a/volatility3/framework/plugins/windows/skeleton_key_check.py +++ b/volatility3/framework/plugins/windows/skeleton_key_check.py @@ -568,7 +568,9 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): """ kernel = self.context.modules[self.config["kernel"]] - if not symbols.symbol_table_is_64bit(self.context, kernel.symbol_table_name): + if not symbols.symbol_table_is_64bit( + context=self.context, symbol_table_name=kernel.symbol_table_name + ): vollog.info("This plugin only supports 64bit Windows memory samples") return None @@ -670,8 +672,8 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=self._lsass_proc_filter, ) ), diff --git a/volatility3/framework/plugins/windows/ssdt.py b/volatility3/framework/plugins/windows/ssdt.py index 471dc9e18..ed7d1310d 100644 --- a/volatility3/framework/plugins/windows/ssdt.py +++ b/volatility3/framework/plugins/windows/ssdt.py @@ -83,8 +83,8 @@ class SSDT(plugins.PluginInterface): kernel = self.context.modules[self.config["kernel"]] collection = self.build_module_collection( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], ) ntkrnlmp = kernel @@ -101,7 +101,7 @@ class SSDT(plugins.PluginInterface): # on 64-bit systems the indexes are also 32-bits but they're offsets from the # base address of the table and can be negative, so we need a signed data type is_kernel_64 = symbols.symbol_table_is_64bit( - self.context, kernel.symbol_table_name + context=self.context, symbol_table_name=kernel.symbol_table_name ) if is_kernel_64: array_subtype = "long" diff --git a/volatility3/framework/plugins/windows/strings.py b/volatility3/framework/plugins/windows/strings.py index b5a2b7145..0ec07d719 100644 --- a/volatility3/framework/plugins/windows/strings.py +++ b/volatility3/framework/plugins/windows/strings.py @@ -73,8 +73,8 @@ class Strings(interfaces.plugins.PluginInterface): line = strings_fp.readline() revmap = self.generate_mapping( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], progress_callback=self._progress_callback, pid_list=self.config["pid"], ) @@ -161,9 +161,11 @@ class Strings(interfaces.plugins.PluginInterface): # TODO: Include kernel modules - for process in pslist.PsList.list_processes(context, kernel_module_name): + for process in pslist.PsList.list_processes( + context=context, kernel_module_name=kernel_module_name + ): if not filter(process): - proc_id = "Unknown" + kernel_module_name = proc_id = "Unknown" try: proc_id = process.UniqueProcessId proc_layer_name = process.add_process_layer() diff --git a/volatility3/framework/plugins/windows/suspended_threads.py b/volatility3/framework/plugins/windows/suspended_threads.py index 2c3d584df..f83a201b5 100644 --- a/volatility3/framework/plugins/windows/suspended_threads.py +++ b/volatility3/framework/plugins/windows/suspended_threads.py @@ -61,7 +61,9 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): proc_modules = None # walk the threads of each process checking for suspended threads - for proc in pslist.PsList.list_processes(self.context, self.config["kernel"]): + for proc in pslist.PsList.list_processes( + context=self.context, kernel_module_name=self.config["kernel"] + ): for thread in threads.Threads.list_threads(kernel, proc): try: # we only care if the thread is suspended @@ -92,7 +94,9 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): # will not have suspended threads if not proc_modules: proc_modules = pe_symbols.PESymbols.get_process_modules( - self.context, self.config["kernel"], None + context=self.context, + kernel_module_name=self.config["kernel"], + filter_modules=None, ) path_and_symbol = functools.partial( diff --git a/volatility3/framework/plugins/windows/suspicious_threads.py b/volatility3/framework/plugins/windows/suspicious_threads.py index 938c6a940..41affcbc7 100644 --- a/volatility3/framework/plugins/windows/suspicious_threads.py +++ b/volatility3/framework/plugins/windows/suspicious_threads.py @@ -138,8 +138,8 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) for proc in pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ): ranges = self._get_ranges(kernel, all_ranges, proc) diff --git a/volatility3/framework/plugins/windows/svcdiff.py b/volatility3/framework/plugins/windows/svcdiff.py index ca9bcfb75..d2c3da3d3 100644 --- a/volatility3/framework/plugins/windows/svcdiff.py +++ b/volatility3/framework/plugins/windows/svcdiff.py @@ -65,7 +65,7 @@ class SvcDiff(svcscan.SvcScan): kernel = context.modules[kernel_module_name] if not symbols.symbol_table_is_64bit( - context, kernel.symbol_table_name + context=context, symbol_table_name=kernel.symbol_table_name ) or not versions.is_win10_15063_or_later( context=context, symbol_table=kernel.symbol_table_name ): diff --git a/volatility3/framework/plugins/windows/svclist.py b/volatility3/framework/plugins/windows/svclist.py index 00782c543..00d4aa647 100644 --- a/volatility3/framework/plugins/windows/svclist.py +++ b/volatility3/framework/plugins/windows/svclist.py @@ -70,7 +70,7 @@ class SvcList(svcscan.SvcScan): kernel = context.modules[kernel_module_name] if not symbols.symbol_table_is_64bit( - context, kernel.symbol_table_name + context=context, symbol_table_name=kernel.symbol_table_name ) or not versions.is_win10_15063_or_later( context=context, symbol_table=kernel.symbol_table_name ): @@ -80,8 +80,8 @@ class SvcList(svcscan.SvcScan): return for proc in pslist.PsList.list_processes( - context, - kernel_module_name, + context=context, + kernel_module_name=kernel_module_name, filter_func=filter_func, ): try: diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py index 602e7fbd5..653995f90 100644 --- a/volatility3/framework/plugins/windows/svcscan.py +++ b/volatility3/framework/plugins/windows/svcscan.py @@ -121,7 +121,9 @@ class SvcScan(interfaces.plugins.PluginInterface): A symbol table containing the symbols necessary for services """ native_types = context.symbol_space[symbol_table_name].natives - is_64bit = symbols.symbol_table_is_64bit(context, symbol_table_name) + is_64bit = symbols.symbol_table_is_64bit( + context=context, symbol_table_name=symbol_table_name + ) try: symbol_filename = next( @@ -148,9 +150,11 @@ class SvcScan(interfaces.plugins.PluginInterface): ) -> Optional[objects.StructType]: for hive in hivelist.HiveList.list_hives( - context, - interfaces.configuration.path_join(config_path, "hivelist"), - kernel_module_name, + context=context, + base_config_path=interfaces.configuration.path_join( + config_path, "hivelist" + ), + kernel_module_name=kernel_module_name, filter_string="machine\\system", ): # Get ControlSet\Services. @@ -300,7 +304,7 @@ class SvcScan(interfaces.plugins.PluginInterface): for task in pslist.PsList.list_processes( context, - kernel_module_name, + kernel_module_name=kernel_module_name, filter_func=filter_func, ): proc_id = "Unknown" diff --git a/volatility3/framework/plugins/windows/threads.py b/volatility3/framework/plugins/windows/threads.py index 806caaa52..f6d542357 100644 --- a/volatility3/framework/plugins/windows/threads.py +++ b/volatility3/framework/plugins/windows/threads.py @@ -69,8 +69,8 @@ class Threads(thrdscan.ThrdScan): filter_func = pslist.PsList.create_pid_filter(context.config.get("pid", None)) for proc in pslist.PsList.list_processes( - context, - kernel_module_name, + context=context, + kernel_module_name=kernel_module_name, filter_func=filter_func, ): yield from cls.list_threads(module, proc) diff --git a/volatility3/framework/plugins/windows/timers.py b/volatility3/framework/plugins/windows/timers.py index 4bf574143..d08bc59dd 100644 --- a/volatility3/framework/plugins/windows/timers.py +++ b/volatility3/framework/plugins/windows/timers.py @@ -124,8 +124,8 @@ class Timers(interfaces.plugins.PluginInterface): kernel = self.context.modules[self.config["kernel"]] collection = ssdt.SSDT.build_module_collection( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], ) # FIXME - the list_timers API is gross. Fix after GUI merge diff --git a/volatility3/framework/plugins/windows/unhooked_system_calls.py b/volatility3/framework/plugins/windows/unhooked_system_calls.py index c941ff768..8882ff46f 100644 --- a/volatility3/framework/plugins/windows/unhooked_system_calls.py +++ b/volatility3/framework/plugins/windows/unhooked_system_calls.py @@ -151,10 +151,10 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface): def _generator(self) -> Generator[Tuple[int, Tuple[str, str, int]], None, None]: found_symbols = pe_symbols.PESymbols.addresses_for_process_symbols( - self.context, - self.config_path, - self.config["kernel"], - unhooked_system_calls.system_calls, + context=self.context, + config_path=self.config_path, + kernel_module_name=self.config["kernel"], + symbols=unhooked_system_calls.system_calls, ) # code_bytes[dll_name][func_name][func_bytes] diff --git a/volatility3/framework/plugins/windows/unloadedmodules.py b/volatility3/framework/plugins/windows/unloadedmodules.py index 178fe65c5..90ad0fdb5 100644 --- a/volatility3/framework/plugins/windows/unloadedmodules.py +++ b/volatility3/framework/plugins/windows/unloadedmodules.py @@ -52,7 +52,9 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt The name of the constructed unloaded modules table """ native_types = context.symbol_space[symbol_table].natives - is_64bit = symbols.symbol_table_is_64bit(context, symbol_table) + is_64bit = symbols.symbol_table_is_64bit( + context=context, symbol_table_name=symbol_table + ) table_mapping = {"nt_symbols": symbol_table} if is_64bit: @@ -100,7 +102,9 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt offset=unloadedmodules_offset, subtype="array", ) - is_64bit = symbols.symbol_table_is_64bit(context, symbol_table) + is_64bit = symbols.symbol_table_is_64bit( + context=context, symbol_table_name=symbol_table + ) if is_64bit: unloaded_count_type = "unsigned long long" diff --git a/volatility3/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py index 46afcaca8..2b1d3f4bc 100644 --- a/volatility3/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -292,8 +292,8 @@ class VadInfo(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/vadregexscan.py b/volatility3/framework/plugins/windows/vadregexscan.py index 0d9b6a72e..5d2356f54 100644 --- a/volatility3/framework/plugins/windows/vadregexscan.py +++ b/volatility3/framework/plugins/windows/vadregexscan.py @@ -112,8 +112,8 @@ class VadRegExScan(plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) procs = pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) return renderers.TreeGrid( diff --git a/volatility3/framework/plugins/windows/vadwalk.py b/volatility3/framework/plugins/windows/vadwalk.py index 0d6a8b245..cc8105e0c 100644 --- a/volatility3/framework/plugins/windows/vadwalk.py +++ b/volatility3/framework/plugins/windows/vadwalk.py @@ -83,8 +83,8 @@ class VadWalk(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index 2dd2dec26..a19206e22 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -60,8 +60,8 @@ class VadYaraScan(interfaces.plugins.PluginInterface): sanity_check = 1024 * 1024 * 1024 # 1 GB for task in pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ): layer_name = task.add_process_layer() diff --git a/volatility3/framework/plugins/windows/verinfo.py b/volatility3/framework/plugins/windows/verinfo.py index 63a0d9ece..fa7d4e113 100644 --- a/volatility3/framework/plugins/windows/verinfo.py +++ b/volatility3/framework/plugins/windows/verinfo.py @@ -253,13 +253,15 @@ class VerInfo(interfaces.plugins.PluginInterface): ) def run(self): - procs = pslist.PsList.list_processes(self.context, self.config["kernel"]) + procs = pslist.PsList.list_processes( + context=self.context, kernel_module_name=self.config["kernel"] + ) mods = modules.Modules.list_modules(self.context, self.config["kernel"]) # populate the session layers for kernel modules session_layers = modules.Modules.get_session_layers( - self.context, self.config["kernel"] + context=self.context, kernel_module_name=self.config["kernel"] ) return renderers.TreeGrid( diff --git a/volatility3/framework/plugins/windows/windowstations.py b/volatility3/framework/plugins/windows/windowstations.py index 6dac484f5..b9c6932f9 100644 --- a/volatility3/framework/plugins/windows/windowstations.py +++ b/volatility3/framework/plugins/windows/windowstations.py @@ -67,7 +67,9 @@ class WindowStations(interfaces.plugins.PluginInterface): native_types = intermed.native.x64NativeTable - if not symbols.symbol_table_is_64bit(context, symbol_table): + if not symbols.symbol_table_is_64bit( + context=context, symbol_table_name=symbol_table + ): raise NotImplementedError( "This plugin only supports x64 versions of Windows" ) @@ -86,10 +88,10 @@ class WindowStations(interfaces.plugins.PluginInterface): vollog.debug(f"Using GUI table {symbol_filename}") return intermed.IntermediateSymbolTable.create( - context, - config_path, - os.path.join("windows", "gui"), - symbol_filename, + context=context, + config_path=config_path, + sub_path=os.path.join("windows", "gui"), + filename=symbol_filename, class_types=gui.class_types, native_types=native_types, table_mapping=table_mapping, @@ -152,11 +154,11 @@ class WindowStations(interfaces.plugins.PluginInterface): session_map = cls.get_session_map(context, kernel_module_name, gui_table_name) for result in poolscanner.PoolScanner.generate_pool_scan_extended( - context, - kernel.layer_name, - kernel.symbol_table_name, - gui_table_name, - constraints, + context=context, + kernel_layer_name=kernel.layer_name, + kernel_symbol_table_name=kernel.symbol_table_name, + object_symbol_table_name=gui_table_name, + constraints=constraints, ): _constraint, mem_object, _header = result diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index d5528a8b5..39605cf52 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -237,7 +237,9 @@ class module(generic.GenericIntelProcess): elf_table_name = self.get_elf_table_name() symbol_table_name = self.get_symbol_table_name() - is_64bit = symbols.symbol_table_is_64bit(self._context, symbol_table_name) + is_64bit = symbols.symbol_table_is_64bit( + context=self._context, symbol_table_name=symbol_table_name + ) sym_name = "Elf64_Sym" if is_64bit else "Elf32_Sym" sym_type = self._context.symbol_space.get_type( elf_table_name + constants.BANG + sym_name @@ -280,7 +282,9 @@ class module(generic.GenericIntelProcess): elf_table_name = self.get_elf_table_name() symbol_table_name = self.get_symbol_table_name() - is_64bit = symbols.symbol_table_is_64bit(self._context, symbol_table_name) + is_64bit = symbols.symbol_table_is_64bit( + context=self._context, symbol_table_name=symbol_table_name + ) sym_name = "Elf64_Sym" if is_64bit else "Elf32_Sym" sym_type = self._context.symbol_space.get_type( elf_table_name + constants.BANG + sym_name diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index e852de0da..933178c91 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -53,7 +53,9 @@ class MMVAD_SHORT(objects.StructType): # the offset is different on 32 and 64 bits symbol_table_name = self.vol.type_name.split(constants.BANG)[0] - if not symbols.symbol_table_is_64bit(self._context, symbol_table_name): + if not symbols.symbol_table_is_64bit( + context=self._context, symbol_table_name=symbol_table_name + ): vad_address -= 4 else: vad_address -= 12 @@ -389,7 +391,9 @@ class EX_FAST_REF(objects.StructType): # the mask value is different on 32 and 64 bits symbol_table_name = self.vol.type_name.split(constants.BANG)[0] - if not symbols.symbol_table_is_64bit(self._context, symbol_table_name): + if not symbols.symbol_table_is_64bit( + context=self._context, symbol_table_name=symbol_table_name + ): max_fast_ref = 7 else: max_fast_ref = 15 @@ -1406,7 +1410,9 @@ class CONTROL_AREA(objects.StructType): ) mmpte_size = mmpte_type.size subsection = self.get_subsection() - is_64bit = symbols.symbol_table_is_64bit(self._context, symbol_table_name) + is_64bit = symbols.symbol_table_is_64bit( + context=self._context, symbol_table_name=symbol_table_name + ) is_pae = self._context.layers[self.vol.layer_name].metadata.get("pae", False) # the sector_size is used as a multiplier to the StartingSector diff --git a/volatility3/framework/symbols/windows/extensions/pool.py b/volatility3/framework/symbols/windows/extensions/pool.py index 5427e3773..b0c480d19 100644 --- a/volatility3/framework/symbols/windows/extensions/pool.py +++ b/volatility3/framework/symbols/windows/extensions/pool.py @@ -78,7 +78,9 @@ class POOL_HEADER(objects.StructType): # otherwise we have an executive object in the pool else: - if symbols.symbol_table_is_64bit(self._context, symbol_table_name): + if symbols.symbol_table_is_64bit( + context=self._context, symbol_table_name=symbol_table_name + ): alignment = 16 else: alignment = 8 diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index 3cbeb3e7c..eea05548b 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -70,9 +70,9 @@ class Certificates(interfaces.plugins.PluginInterface): def _generator(self) -> Iterator[Tuple[int, Tuple[str, str, str, str]]]: for hive in hivelist.HiveList.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], ): for top_key in [ "Microsoft\\SystemCertificates",