From 649a39a13d253ec58af0afd29bded853b10acb38 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sat, 8 Dec 2018 18:00:44 +0000
Subject: [PATCH] Change time_as_integer from a property to get_time_as_integer
 method.

---
 .../symbols/linux/extensions/bash.py          | 37 ++++++++-----------
 volatility/plugins/linux/bash.py              |  3 +-
 2 files changed, 17 insertions(+), 23 deletions(-)

diff --git a/volatility/framework/symbols/linux/extensions/bash.py b/volatility/framework/symbols/linux/extensions/bash.py
index d59fcfb33..3da664a43 100644
--- a/volatility/framework/symbols/linux/extensions/bash.py
+++ b/volatility/framework/symbols/linux/extensions/bash.py
@@ -1,14 +1,13 @@
-import struct
-
-from volatility.framework import constants, exceptions
-from volatility.framework import objects, interfaces
+from volatility.framework import exceptions
+from volatility.framework import objects
 from volatility.framework.objects import utility
 
+
 class hist_entry(objects.Struct):
     def is_valid(self):
         try:
             cmd = self.get_command()
-            ts  = utility.array_to_string(self.timestamp.dereference())
+            ts = utility.array_to_string(self.timestamp.dereference())
         except exceptions.PagedInvalidAddressException:
             return False
 
@@ -18,35 +17,31 @@ class hist_entry(objects.Struct):
         if not ts or len(ts) == 0:
             return False
 
-        # At this point in time, the epoc integer size will 
-        # never be less than 10 characters, and the stamp is 
-        # always preceded by a pound/hash character. 
+        # At this point in time, the epoc integer size will
+        # never be less than 10 characters, and the stamp is
+        # always preceded by a pound/hash character.
         if len(ts) < 10 or str(ts)[0] != "#":
             return False
 
         # The final check is to make sure the entire string
-        # is composed of numbers. Try to convert to an int. 
+        # is composed of numbers. Try to convert to an int.
         try:
             int(str(ts)[1:])
         except ValueError:
-            return False 
+            return False
 
         return True
 
-    @property
-    def time_as_integer(self):
-        # Get the string and remove the leading "#" from the timestamp 
-        time_string = utility.array_to_string(self.timestamp.dereference())[1:] 
+    def get_time_as_integer(self):
+        # Get the string and remove the leading "#" from the timestamp
+        time_string = utility.array_to_string(self.timestamp.dereference())[1:]
         # Convert the string into an integer (number of seconds)
         return int(time_string)
 
     def get_time_object(self):
-        nsecs = self.time_as_integer
-        # Build a timestamp object from the integer 
+        nsecs = self.get_time_as_integer()
+        # Build a timestamp object from the integer
         return utility.unixtime_to_datetime(nsecs)
-       
+
     def get_command(self):
-       return utility.array_to_string(self.line.dereference())
-
-
-
+        return utility.array_to_string(self.line.dereference())
diff --git a/volatility/plugins/linux/bash.py b/volatility/plugins/linux/bash.py
index 2ca87bc08..1caf282ac 100644
--- a/volatility/plugins/linux/bash.py
+++ b/volatility/plugins/linux/bash.py
@@ -4,7 +4,6 @@ typically found in Linux's /proc file system.
 
 import datetime
 import struct
-from operator import attrgetter
 
 from volatility.framework import constants, renderers, symbols
 from volatility.framework.configuration import requirements
@@ -71,7 +70,7 @@ class Bash(plugins.PluginInterface):
                 if hist.is_valid():
                     history_entries.append(hist)
 
-            for hist in sorted(history_entries, key = attrgetter('time_as_integer')):
+            for hist in sorted(history_entries, key = lambda x: x.get_time_as_integer()):
                 yield (0, (task.pid, task_name, hist.get_time_object(), hist.get_command()))
 
     def run(self):