diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index 9bfd14c6c..91bda7c66 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -662,7 +662,7 @@ class CommandLine: def close(self): # Don't overcommit if self.closed: - return + return None self.seek(0) @@ -712,7 +712,7 @@ class CommandLine: """Closes and commits the file (by moving the temporary file to the correct name""" # Don't overcommit if self._file.closed: - return + return None self._file.close() output_filename = self._get_final_filename() diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index ea9e65d9b..b95129d19 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -108,7 +108,7 @@ class Volshell(interfaces.plugins.PluginInterface): """Describes the available commands""" if args: help(*args) - return + return None variables = [] print("\nMethods:") @@ -325,7 +325,7 @@ class Volshell(interfaces.plugins.PluginInterface): (str, interfaces.objects.ObjectInterface, interfaces.objects.Template), ): print("Cannot display information about non-type object") - return + return None if not isinstance(object, str): # Mypy requires us to order things this way @@ -453,7 +453,7 @@ class Volshell(interfaces.plugins.PluginInterface): """Prints an alphabetical list of symbols for a symbol table""" if symbol_table is None: print("No symbol table provided") - return + return None longest_offset = longest_name = 0 table = self.context.symbol_space[symbol_table] diff --git a/volatility3/cli/volshell/linux.py b/volatility3/cli/volshell/linux.py index 8c23bbec3..c5e555ec7 100644 --- a/volatility3/cli/volshell/linux.py +++ b/volatility3/cli/volshell/linux.py @@ -35,9 +35,9 @@ class Volshell(generic.Volshell): process_layer = task.add_process_layer() if process_layer is not None: self.change_layer(process_layer) - return + return None print(f"Layer for task ID {pid} could not be constructed") - return + return None print(f"No task with task ID {pid} found") def list_tasks(self): diff --git a/volatility3/cli/volshell/mac.py b/volatility3/cli/volshell/mac.py index b709511b1..2b32ad677 100644 --- a/volatility3/cli/volshell/mac.py +++ b/volatility3/cli/volshell/mac.py @@ -35,9 +35,9 @@ class Volshell(generic.Volshell): process_layer = task.add_process_layer() if process_layer is not None: self.change_layer(process_layer) - return + return None print(f"Layer for task ID {pid} could not be constructed") - return + return None print(f"No task with task ID {pid} found") def list_tasks(self, method=None): diff --git a/volatility3/cli/volshell/windows.py b/volatility3/cli/volshell/windows.py index 652b2e66b..5c2190c02 100644 --- a/volatility3/cli/volshell/windows.py +++ b/volatility3/cli/volshell/windows.py @@ -32,7 +32,7 @@ class Volshell(generic.Volshell): if process.UniqueProcessId == pid: process_layer = process.add_process_layer() self.change_layer(process_layer) - return + return None print(f"No process with process ID {pid} found") def list_processes(self): diff --git a/volatility3/framework/automagic/module.py b/volatility3/framework/automagic/module.py index 2bdaf3f62..ee56a040c 100644 --- a/volatility3/framework/automagic/module.py +++ b/volatility3/framework/automagic/module.py @@ -29,9 +29,9 @@ class KernelModule(interfaces.automagic.AutomagicInterface): requirement.requirements[req], progress_callback, ) - return + return None if not requirement.unsatisfied(context, config_path): - return + return None # The requirement is unfulfilled and is a ModuleRequirement context.config[ @@ -43,7 +43,7 @@ class KernelModule(interfaces.automagic.AutomagicInterface): requirement.requirements[req].unsatisfied(context, new_config_path) and req != "offset" ): - return + return None # We now just have the offset requirement, but the layer requirement has been fulfilled. # Unfortunately we don't know the layer name requirement's exact name diff --git a/volatility3/framework/automagic/stacker.py b/volatility3/framework/automagic/stacker.py index d966d99fa..c251d3c46 100644 --- a/volatility3/framework/automagic/stacker.py +++ b/volatility3/framework/automagic/stacker.py @@ -103,7 +103,7 @@ class LayerStacker(interfaces.automagic.AutomagicInterface): appropriate_config_path, layer_name = result context.config.merge(appropriate_config_path, subconfig) context.config[appropriate_config_path] = top_layer_name - return + return None self._cached = None new_context = context.clone() diff --git a/volatility3/framework/automagic/symbol_finder.py b/volatility3/framework/automagic/symbol_finder.py index f30dff456..bf1c8ff16 100644 --- a/volatility3/framework/automagic/symbol_finder.py +++ b/volatility3/framework/automagic/symbol_finder.py @@ -69,7 +69,7 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface): # Bomb out early if our details haven't been configured if self.symbol_class is None: - return + return None self._requirements = self.find_requirements( context, @@ -120,7 +120,7 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface): # Bomb out early if there's no banners if not self.banners: - return + return None mss = scanners.MultiStringScanner([x for x in self.banners if x is not None]) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index 046203fa6..7d3b86a12 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -331,9 +331,9 @@ class Intel(linear.LinearlyMappedLayer): except exceptions.InvalidAddressException: if not ignore_errors: raise - return + return None yield offset, length, mapped_offset, length, layer_name - return + return None while length > 0: try: chunk_offset, page_size, layer_name = self._translate(offset) diff --git a/volatility3/framework/layers/msf.py b/volatility3/framework/layers/msf.py index 76c645e92..8d84a774b 100644 --- a/volatility3/framework/layers/msf.py +++ b/volatility3/framework/layers/msf.py @@ -47,7 +47,7 @@ class PdbMultiStreamFormat(linear.LinearlyMappedLayer): def read_streams(self): # Shortcut in case they've already been read if self._streams: - return + return None # Recover the root table, by recovering the root table index table... module = self.context.module(self.pdb_symbol_table, self._base_layer, offset=0) diff --git a/volatility3/framework/layers/segmented.py b/volatility3/framework/layers/segmented.py index beb667436..0d29d8bff 100644 --- a/volatility3/framework/layers/segmented.py +++ b/volatility3/framework/layers/segmented.py @@ -126,9 +126,9 @@ class NonLinearlySegmentedLayer( current_offset = logical_offset # If it starts too late then we're done if logical_offset > offset + length: - return + return None except exceptions.InvalidAddressException: - return + return None # Crop it to the amount we need left chunk_size = min(size, length + offset - logical_offset) yield logical_offset, chunk_size, mapped_offset, mapped_size, self._base_layer diff --git a/volatility3/framework/plugins/linux/capabilities.py b/volatility3/framework/plugins/linux/capabilities.py index 518f52603..bfdb69aba 100644 --- a/volatility3/framework/plugins/linux/capabilities.py +++ b/volatility3/framework/plugins/linux/capabilities.py @@ -88,7 +88,7 @@ class Capabilities(plugins.PluginInterface): kernel_cap_last_cap = vmlinux.object_from_symbol(symbol_name="cap_last_cap") except exceptions.SymbolError: # It should be a kernel < 3.2 - return + return None vol2_last_cap = extensions.kernel_cap_struct.get_last_cap_value() if kernel_cap_last_cap > vol2_last_cap: diff --git a/volatility3/framework/plugins/linux/check_syscall.py b/volatility3/framework/plugins/linux/check_syscall.py index b1d2919f9..b6634d612 100644 --- a/volatility3/framework/plugins/linux/check_syscall.py +++ b/volatility3/framework/plugins/linux/check_syscall.py @@ -145,7 +145,7 @@ class Check_syscall(plugins.PluginInterface): table_info = self._get_table_info(vmlinux, "sys_call_table", ptr_sz) except exceptions.SymbolError: vollog.error("Unable to find the system call table. Exiting.") - return + return None tables = [(table_name, table_info)] diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py index 8a21afc03..cf06ee0cc 100644 --- a/volatility3/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -44,7 +44,7 @@ class Malfind(interfaces.plugins.PluginInterface): proc_layer_name = task.add_process_layer() if not proc_layer_name: - return + return None proc_layer = self.context.layers[proc_layer_name] diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index fa67122ba..e9c98a227 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -147,7 +147,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface): socket_filter["bpf_filter_type"] = "cBPF" if not sock_filter.has_member("prog") or not sock_filter.prog: - return + return None bpfprog = sock_filter.prog @@ -158,13 +158,13 @@ class SockHandlers(interfaces.configuration.VersionableInterface): return # cBPF filter except AttributeError: # kernel < 3.18.140, it's a cBPF filter - return + return None BPF_PROG_TYPE_SOCKET_FILTER = 1 # eBPF filter if bpfprog_type != BPF_PROG_TYPE_SOCKET_FILTER: socket_filter["bpf_filter_type"] = f"UNK({bpfprog_type})" vollog.warning(f"Unexpected BPF type {bpfprog_type} for a socket") - return + return None socket_filter["bpf_filter_type"] = "eBPF" if not bpfprog.has_member("aux") or not bpfprog.aux: @@ -329,17 +329,17 @@ class SockHandlers(interfaces.configuration.VersionableInterface): xdp_sock = sock.cast("xdp_sock") device = xdp_sock.dev if not device: - return + return None src_addr = utility.array_to_string(device.name) src_port = dst_addr = dst_port = None bpfprog = device.xdp_prog if not bpfprog: - return + return None if not bpfprog.has_member("aux") or not bpfprog.aux: - return + return None bpfprog_aux = bpfprog.aux if bpfprog_aux.has_member("id"): diff --git a/volatility3/framework/plugins/mac/check_sysctl.py b/volatility3/framework/plugins/mac/check_sysctl.py index 165aad436..4f64eaed8 100644 --- a/volatility3/framework/plugins/mac/check_sysctl.py +++ b/volatility3/framework/plugins/mac/check_sysctl.py @@ -69,7 +69,7 @@ class Check_sysctl(plugins.PluginInterface): try: sysctl = sysctl.oid_link.sle_next.dereference() except exceptions.InvalidAddressException: - return + return None while sysctl: try: diff --git a/volatility3/framework/plugins/mac/kevents.py b/volatility3/framework/plugins/mac/kevents.py index 3b996bc0a..2a8692b77 100644 --- a/volatility3/framework/plugins/mac/kevents.py +++ b/volatility3/framework/plugins/mac/kevents.py @@ -116,7 +116,7 @@ class Kevents(interfaces.plugins.PluginInterface): ) except exceptions.InvalidAddressException: - return + return None for klist in klist_array: for kn in mac.MacUtilities.walk_slist(klist, "kn_link"): @@ -140,7 +140,7 @@ class Kevents(interfaces.plugins.PluginInterface): try: p_klist = task.p_klist except exceptions.InvalidAddressException: - return + return None for kn in mac.MacUtilities.walk_slist(p_klist, "kn_link"): yield kn diff --git a/volatility3/framework/plugins/mac/lsmod.py b/volatility3/framework/plugins/mac/lsmod.py index 2979e374b..c6f57f889 100644 --- a/volatility3/framework/plugins/mac/lsmod.py +++ b/volatility3/framework/plugins/mac/lsmod.py @@ -75,7 +75,7 @@ class Lsmod(plugins.PluginInterface): try: kmod = kmod.next except exceptions.InvalidAddressException: - return + return None return # Generation finished def _generator(self): diff --git a/volatility3/framework/plugins/mac/malfind.py b/volatility3/framework/plugins/mac/malfind.py index 98b282e24..3094ada85 100644 --- a/volatility3/framework/plugins/mac/malfind.py +++ b/volatility3/framework/plugins/mac/malfind.py @@ -40,7 +40,7 @@ class Malfind(interfaces.plugins.PluginInterface): proc_layer_name = task.add_process_layer() if proc_layer_name is None: - return + return None proc_layer = self.context.layers[proc_layer_name] diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index a9b669add..6e667984a 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -108,12 +108,12 @@ class Cachedump(interfaces.plugins.PluginInterface): vollog.warning("Unable to locate SYSTEM hive") if sechive is None: vollog.warning("Unable to locate SECURITY hive") - return + return None bootkey = hashdump.Hashdump.get_bootkey(syshive) if not bootkey: vollog.warning("Unable to find bootkey") - return + return None kernel = self.context.modules[self.config["kernel"]] @@ -124,17 +124,17 @@ class Cachedump(interfaces.plugins.PluginInterface): lsakey = lsadump.Lsadump.get_lsa_key(sechive, bootkey, vista_or_later) if not lsakey: vollog.warning("Unable to find lsa key") - return + return None nlkm = self.get_nlkm(sechive, lsakey, vista_or_later) if not nlkm: vollog.warning("Unable to find nlkma key") - return + return None cache = hashdump.Hashdump.get_hive_key(sechive, "Cache") if not cache: vollog.warning("Unable to find cache key") - return + return None for cache_item in cache.get_values(): if cache_item.Name == "NL$Control": diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py index 48b2e7c62..fcc333b9f 100644 --- a/volatility3/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -157,7 +157,7 @@ class Callbacks(interfaces.plugins.PluginInterface): ) if callback_count == 0: - return + return None fast_refs = ntkrnlmp.object( object_type="array", @@ -199,7 +199,7 @@ class Callbacks(interfaces.plugins.PluginInterface): ) if callback_count == 0: - return + return None callback_list = ntkrnlmp.object(object_type="_LIST_ENTRY", offset=symbol_offset) for callback in callback_list.to_list(full_type_name, "Link"): @@ -256,7 +256,7 @@ class Callbacks(interfaces.plugins.PluginInterface): symbol_status = "exists" vollog.debug(f"symbol {symbol_name} {symbol_status}.") - return + return None @classmethod def list_bugcheck_reason_callbacks( @@ -287,7 +287,7 @@ class Callbacks(interfaces.plugins.PluginInterface): ).address except exceptions.SymbolError: vollog.debug("Cannot find KeBugCheckReasonCallbackListHead") - return + return None full_type_name = ( callback_table_name + constants.BANG + "_KBUGCHECK_REASON_CALLBACK_RECORD" @@ -343,7 +343,7 @@ class Callbacks(interfaces.plugins.PluginInterface): list_offset = ntkrnlmp.get_symbol("KeBugCheckCallbackListHead").address except exceptions.SymbolError: vollog.debug("Cannot find KeBugCheckCallbackListHead") - return + return None full_type_name = ( callback_table_name + constants.BANG + "_KBUGCHECK_CALLBACK_RECORD" diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py index 38d55d15d..dd82d897e 100755 --- a/volatility3/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -130,7 +130,7 @@ class DumpFiles(interfaces.plugins.PluginInterface): constants.LOGLEVEL_VVV, f"The file object at {file_obj.vol.offset:#x} is not a file on disk", ) - return + return None # Depending on the type of object (DataSection, ImageSection, SharedCacheMap) we may need to # read from the memory layer or the primary layer. diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index dd7c90860..ddd9cb78e 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -285,7 +285,7 @@ class Handles(interfaces.plugins.PluginInterface): count = 0x1000 / subtype.size if not self.context.layers[virtual].is_valid(offset): - return + return None table = ntkrnlmp.object( object_type="array", @@ -335,7 +335,7 @@ class Handles(interfaces.plugins.PluginInterface): constants.LOGLEVEL_VVV, "Handle table parsing was aborted due to an invalid address exception", ) - return + return None for handle_table_entry in self._make_handle_array(TableCode, table_levels): yield handle_table_entry diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 12589b07e..da8dee325 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -168,16 +168,16 @@ class Lsadump(interfaces.plugins.PluginInterface): lsakey = self.get_lsa_key(sechive, bootkey, vista_or_later) if not bootkey: vollog.warning("Unable to find bootkey") - return + return None if not lsakey: vollog.warning("Unable to find lsa key") - return + return None secrets_key = hashdump.Hashdump.get_hive_key(sechive, "Policy\\Secrets") if not secrets_key: vollog.warning("Unable to find secrets key") - return + return None for key in secrets_key.get_subkeys(): sec_val_key = hashdump.Hashdump.get_hive_key( diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py index 424925955..6ed078996 100644 --- a/volatility3/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -110,7 +110,7 @@ class Malfind(interfaces.plugins.PluginInterface): proc_id, excp.invalid_address, excp.layer_name ) ) - return + return None proc_layer = context.layers[proc_layer_name] diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index d3ce3fd2e..24eb02018 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -154,7 +154,7 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) else: # invalid argument. - return + return None vollog.debug(f"Current Port: {port}") # the given port serves as a shifted index into the port pool lists @@ -175,7 +175,7 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): assignment = inpa.InPaBigPoolBase.Assignments[truncated_port] if not assignment: - return + return None # the value within assignment.Entry is a) masked and b) points inside of the network object # first decode the pointer diff --git a/volatility3/framework/plugins/windows/pstree.py b/volatility3/framework/plugins/windows/pstree.py index 5c78d1682..a39fe7485 100644 --- a/volatility3/framework/plugins/windows/pstree.py +++ b/volatility3/framework/plugins/windows/pstree.py @@ -108,13 +108,13 @@ class PsTree(interfaces.plugins.PluginInterface): def yield_processes(pid, descendant: bool = False): if pid in process_pids: vollog.debug(f"Pid cycle: already processed pid {pid}") - return + return None process_pids.add(pid) if pid not in self._ancestors and not descendant: vollog.debug(f"Pid cycle: pid {pid} not in filtered tree") - return + return None proc, offset = self._processes[pid] row = ( diff --git a/volatility3/framework/plugins/windows/registry/hivelist.py b/volatility3/framework/plugins/windows/registry/hivelist.py index 91798de40..1cc76dad6 100644 --- a/volatility3/framework/plugins/windows/registry/hivelist.py +++ b/volatility3/framework/plugins/windows/registry/hivelist.py @@ -30,7 +30,7 @@ class HiveGenerator: ): if not hive.is_valid(): self._invalid = hive.vol.offset - return + return None yield hive @property diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index f66e55f4b..e248c19bc 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -74,7 +74,7 @@ class PrintKey(interfaces.plugins.PluginInterface): node_path = [hive.get_node(hive.root_cell_offset)] if not isinstance(node_path, list) or len(node_path) < 1: vollog.warning("Hive walker was not passed a valid node_path (or None)") - return + return None node = node_path[-1] key_path_items = [hive] + node_path[1:] key_path = "\\".join([k.get_name() for k in key_path_items]) diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index f90724f66..70c75b50b 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -173,11 +173,11 @@ class UserAssist(interfaces.plugins.PluginInterface): if not userassist_node_path: vollog.warning("list_userassist did not find a valid node_path (or None)") - return + return None if not isinstance(userassist_node_path, list): vollog.warning("userassist_node_path did not return a list as expected") - return + return None userassist_node = userassist_node_path[-1] # iterate through the GUIDs under the userassist key for guidkey in userassist_node.get_subkeys(): diff --git a/volatility3/framework/plugins/windows/skeleton_key_check.py b/volatility3/framework/plugins/windows/skeleton_key_check.py index b697774cb..d321c2cc0 100644 --- a/volatility3/framework/plugins/windows/skeleton_key_check.py +++ b/volatility3/framework/plugins/windows/skeleton_key_check.py @@ -601,21 +601,21 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): if not symbols.symbol_table_is_64bit(self.context, kernel.symbol_table_name): vollog.info("This plugin only supports 64bit Windows memory samples") - return + return None lsass_proc, proc_layer_name = self._find_lsass_proc(procs) if not lsass_proc: vollog.info( "Unable to find a valid lsass.exe process in the process list. This should never happen. Analysis cannot proceed." ) - return + return None cryptdll_base, cryptdll_size = self._find_cryptdll(lsass_proc) if not cryptdll_base: vollog.info( "Unable to find the location of cryptdll.dll inside of lsass.exe. Analysis cannot proceed." ) - return + return None # the custom type information from binary analysis cryptdll_types = self._get_cryptdll_types( @@ -649,7 +649,7 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): vollog.info( "Unable to find CSystems inside of cryptdll.dll. Analysis cannot proceed." ) - return + return None for csystem in csystems: if not self.context.layers[proc_layer_name].is_valid( diff --git a/volatility3/framework/renderers/format_hints.py b/volatility3/framework/renderers/format_hints.py index 6ec9ebab9..6120b77c9 100644 --- a/volatility3/framework/renderers/format_hints.py +++ b/volatility3/framework/renderers/format_hints.py @@ -59,7 +59,8 @@ class MultiTypeData(bytes): def __eq__(self, other): return ( - super(self) == super(other) + isinstance(other, self.__class__) + and super() == super(self.__class__, other) and self.converted_int == other.converted_int and self.encoding == other.encoding and self.split_nulls == other.split_nulls diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index f96302684..3d424dedd 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -243,17 +243,17 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): ): # task.files can be null if not task.files: - return + return None fd_table = task.files.get_fds() if fd_table == 0: - return + return None max_fds = task.files.get_max_fds() # corruption check if max_fds > 500000: - return + return None file_type = symbol_table + constants.BANG + "file" @@ -378,7 +378,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): """ if not addr: - return + return None type_dec = vmlinux.get_type(type_name) member_offset = type_dec.relative_child_offset(member_name) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 3fb772135..d1edfdfe0 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -319,7 +319,7 @@ class maple_tree(objects.StructType): vollog.warning( f"The mte {hex(maple_tree_entry)} has all ready been seen, no further results will be produced for this node." ) - return + return None else: seen.add(maple_tree_entry) # check if we have exceeded the expected depth of this maple tree. @@ -402,7 +402,7 @@ class mm_struct(objects.StructType): "get_mmap_iter called on mm_struct where no mmap member exists." ) if not self.mmap: - return + return None yield self.mmap seen = {self.mmap.vol.offset} @@ -723,7 +723,7 @@ class list_head(objects.StructType, collections.abc.Iterable): try: link = getattr(self, direction).dereference() except exceptions.InvalidAddressException: - return + return None if not sentinel: yield self._context.object( symbol_type, layer, offset=self.vol.offset - relative_offset @@ -1218,7 +1218,7 @@ class sock(objects.StructType): return self.sk_socket.get_inode() def get_protocol(self): - return + return None def get_state(self): # Return the generic socket state @@ -1230,13 +1230,13 @@ class sock(objects.StructType): class unix_sock(objects.StructType): def get_name(self): if not self.addr: - return + return None sockaddr_un = self.addr.name.cast("sockaddr_un") saddr = str(utility.array_to_string(sockaddr_un.sun_path)) return saddr def get_protocol(self): - return + return None def get_state(self): """Return a string representing the sock state.""" @@ -1295,7 +1295,7 @@ class inet_sock(objects.StructType): elif hasattr(sk_common, "skc_dport"): dport_le = sk_common.skc_dport else: - return + return None return socket_module.htons(dport_le) def get_src_addr(self): @@ -1313,7 +1313,7 @@ class inet_sock(objects.StructType): addr_size = 16 saddr = self.pinet6.saddr else: - return + return None parent_layer = self._context.layers[self.vol.layer_name] try: addr_bytes = parent_layer.read(saddr.vol.offset, addr_size) @@ -1321,7 +1321,7 @@ class inet_sock(objects.StructType): vollog.debug( f"Unable to read socket src address from {saddr.vol.offset:#x}" ) - return + return None return socket_module.inet_ntop(family, addr_bytes) def get_dst_addr(self): @@ -1342,7 +1342,7 @@ class inet_sock(objects.StructType): daddr = sk_common.skc_v6_daddr addr_size = 16 else: - return + return None parent_layer = self._context.layers[self.vol.layer_name] try: addr_bytes = parent_layer.read(daddr.vol.offset, addr_size) @@ -1350,7 +1350,7 @@ class inet_sock(objects.StructType): vollog.debug( f"Unable to read socket dst address from {daddr.vol.offset:#x}" ) - return + return None return socket_module.inet_ntop(family, addr_bytes) @@ -1388,7 +1388,7 @@ class netlink_sock(objects.StructType): class vsock_sock(objects.StructType): def get_protocol(self): # The protocol should always be 0 for vsocks - return + return None def get_state(self): # Return the generic socket state @@ -1399,7 +1399,7 @@ class packet_sock(objects.StructType): def get_protocol(self): eth_proto = socket_module.htons(self.num) if eth_proto == 0: - return + return None elif eth_proto in ETH_PROTOCOLS: return ETH_PROTOCOLS[eth_proto] else: @@ -1425,7 +1425,7 @@ class bt_sock(objects.StructType): class xdp_sock(objects.StructType): def get_protocol(self): # The protocol should always be 0 for xdp_sock - return + return None def get_state(self): # xdp_sock.state is an enum diff --git a/volatility3/framework/symbols/linux/extensions/elf.py b/volatility3/framework/symbols/linux/extensions/elf.py index 416a7e4d2..e3034d643 100644 --- a/volatility3/framework/symbols/linux/extensions/elf.py +++ b/volatility3/framework/symbols/linux/extensions/elf.py @@ -171,7 +171,7 @@ class elf(objects.StructType): self._find_symbols() if self._cached_symtab is None: - return + return None symtab_arr = self._context.object( self.get_symbol_table_name() + constants.BANG + "array", diff --git a/volatility3/framework/symbols/mac/__init__.py b/volatility3/framework/symbols/mac/__init__.py index 56ac96633..bc98e5bdc 100644 --- a/volatility3/framework/symbols/mac/__init__.py +++ b/volatility3/framework/symbols/mac/__init__.py @@ -169,7 +169,7 @@ class MacUtilities(interfaces.configuration.VersionableInterface): try: table_addr = task.p_fd.fd_ofiles.dereference() except exceptions.InvalidAddressException: - return + return None fds = objects.utility.array_of_pointers( table_addr, count=num_fds, subtype=file_type, context=context @@ -204,7 +204,7 @@ class MacUtilities(interfaces.configuration.VersionableInterface): try: current = queue.member(attr=list_head_member) except exceptions.InvalidAddressException: - return + return None while current: if current.vol.offset in seen: diff --git a/volatility3/framework/symbols/mac/extensions/__init__.py b/volatility3/framework/symbols/mac/extensions/__init__.py index c89b527e6..bf0b3d775 100644 --- a/volatility3/framework/symbols/mac/extensions/__init__.py +++ b/volatility3/framework/symbols/mac/extensions/__init__.py @@ -50,7 +50,7 @@ class proc(generic.GenericIntelProcess): task = self.get_task() current_map = task.map.hdr.links.next except exceptions.InvalidAddressException: - return + return None seen: Set[int] = set() @@ -138,13 +138,13 @@ class vm_map_object(objects.StructType): class vnode(objects.StructType): def _do_calc_path(self, ret, vnodeobj, vname): if vnodeobj is None: - return + return None if vname: try: ret.append(utility.pointer_to_string(vname, 255)) except exceptions.InvalidAddressException: - return + return None if int(vnodeobj.v_flag) & 0x000001 != 0 and int(vnodeobj.v_mount) != 0: if int(vnodeobj.v_mount.mnt_vnodecovered) != 0: @@ -158,7 +158,7 @@ class vnode(objects.StructType): parent = vnodeobj.v_parent parent_name = parent.v_name except exceptions.InvalidAddressException: - return + return None self._do_calc_path(ret, parent, parent_name) @@ -502,7 +502,7 @@ class queue_entry(objects.StructType): yielded = yielded + 1 if yielded == max_size: - return + return None n = ( getattr(n.member(attr=member_name), attr) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index ba00a4053..d435851d7 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -91,7 +91,7 @@ class MMVAD_SHORT(objects.StructType): if vad_address in visited: vollog.log(constants.LOGLEVEL_VVV, "VAD node already seen!") - return + return None visited.add(vad_address) tag = self.get_tag() @@ -111,7 +111,7 @@ class MMVAD_SHORT(objects.StructType): constants.LOGLEVEL_VVV, f"Skipping VAD at {self.vol.offset} depth {depth} with tag {tag}", ) - return + return None if target: vad_object = self.cast(target) @@ -665,7 +665,7 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): ): yield entry except exceptions.InvalidAddressException: - return + return None def init_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]: """Generator for DLLs in the order that they were initialized""" @@ -678,7 +678,7 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): ): yield entry except exceptions.InvalidAddressException: - return + return None def mem_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]: """Generator for DLLs in the order that they appear in memory""" @@ -691,7 +691,7 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): ): yield entry except exceptions.InvalidAddressException: - return + return None def get_handle_count(self): try: @@ -841,11 +841,11 @@ class LIST_ENTRY(objects.StructType, collections.abc.Iterable): try: is_valid = trans_layer.is_valid(self.vol.offset) if not is_valid: - return + return None link = getattr(self, direction).dereference() except exceptions.InvalidAddressException: - return + return None if not sentinel: yield self._context.object( @@ -860,7 +860,7 @@ class LIST_ENTRY(objects.StructType, collections.abc.Iterable): obj_offset = link.vol.offset - relative_offset if not trans_layer.is_valid(obj_offset): - return + return None obj = self._context.object( symbol_type, @@ -875,7 +875,7 @@ class LIST_ENTRY(objects.StructType, collections.abc.Iterable): try: link = getattr(link, direction).dereference() except exceptions.InvalidAddressException: - return + return None def __iter__(self) -> Iterator[interfaces.objects.ObjectInterface]: return self.to_list(self.vol.parent.vol.type_name, self.vol.member_name) @@ -905,10 +905,10 @@ class TOKEN(objects.StructType): sid = sid_and_attr.Sid.dereference().cast("_SID") # catch invalid pointers (UserAndGroupCount is too high) if sid is None: - return + return None # this mimics the windows API IsValidSid if sid.Revision & 0xF != 1 or sid.SubAuthorityCount > 15: - return + return None id_auth = "" for i in sid.IdentifierAuthority.Value: id_auth = i diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py index fbd3ead8e..51be0841c 100644 --- a/volatility3/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -162,7 +162,7 @@ class CM_KEY_NODE(objects.StructType): try: signature = node.cast("string", max_length=2, encoding="latin-1") except (exceptions.InvalidAddressException, RegistryFormatException): - return + return None listjump = None if signature == "ri": @@ -220,7 +220,7 @@ class CM_KEY_NODE(objects.StructType): yield node except (exceptions.InvalidAddressException, RegistryFormatException) as excp: vollog.debug(f"Invalid address in get_values iteration: {excp}") - return + return None def get_name(self) -> interfaces.objects.ObjectInterface: """Gets the name for the current key node""" diff --git a/volatility3/framework/symbols/windows/extensions/services.py b/volatility3/framework/symbols/windows/extensions/services.py index 00fb1cc4e..e14de761d 100644 --- a/volatility3/framework/symbols/windows/extensions/services.py +++ b/volatility3/framework/symbols/windows/extensions/services.py @@ -110,7 +110,7 @@ class SERVICE_RECORD(objects.StructType): yield rec rec = rec.ServiceList.Blink.dereference() except exceptions.InvalidAddressException: - return + return None class SERVICE_HEADER(objects.StructType): diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index bdcf25fa1..3816312cd 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -2,7 +2,6 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import binascii import json import logging import lzma