Merge branch 'develop' into linux_sockstats_plugin

volatility3/cli/text_renderer.py

@@ -322,10 +322,7 @@ class PrettyTextRenderer(CLIRenderer):
         tab_width = 8
         while line.find('\t') >= 0:
             i = line.find('\t')
-            if (tab_width > 0):
-                pad = " " * (tab_width - (i % tab_width))
-            else:
-                pad = ""
+            pad = " " * (tab_width - (i % tab_width))
             line = line.replace("\t", pad, 1)
         return line
 

volatility3/framework/configuration/requirements.py

@@ -470,14 +470,14 @@ class ModuleRequirement(interfaces.configuration.ConstructableRequirementInterfa
             if req_unsatisfied:
                 result.update(req_unsatisfied)
         if not result:
+            vollog.log(constants.LOGLEVEL_V, f"IndexError - No configuration provided: {config_path}")
             result = {config_path: self}
-        return result
 
         ### NOTE: This validate method has side effects (the dependencies can change)!!!
 
         self._validate_class(context, interfaces.configuration.parent_path(config_path))
-        vollog.log(constants.LOGLEVEL_V, f"IndexError - No configuration provided: {config_path}")
-        return {config_path: self}
+
+        return result
 
     def construct(self, context: interfaces.context.ContextInterface, config_path: str) -> None:
         """Constructs the appropriate layer and adds it based on the class parameter."""

volatility3/framework/interfaces/objects.py

@@ -115,7 +115,8 @@ class ObjectInterface(metaclass = abc.ABCMeta):
         mask = context.layers[object_info.layer_name].address_mask
         normalized_offset = object_info.offset & mask
 
-        self._vol = collections.ChainMap({}, {'type_name': type_name, 'offset': normalized_offset}, object_info, kwargs)
+        vol_info_dict = {'type_name': type_name, 'offset': normalized_offset}
+        self._vol = collections.ChainMap({}, vol_info_dict, object_info, kwargs)
         self._context = context
 
     def __getattr__(self, attr: str) -> Any:
@@ -156,7 +157,7 @@ class ObjectInterface(metaclass = abc.ABCMeta):
         """
         # TODO: Carefully consider the implications of casting and how it should work
         if constants.BANG not in new_type_name:
-            symbol_table = self.vol['type_name'].split(constants.BANG)[0]
+            symbol_table = self.get_symbol_table_name()
             new_type_name = symbol_table + constants.BANG + new_type_name
         object_template = self._context.symbol_space.get_type(new_type_name)
         object_template = object_template.clone()

volatility3/framework/interfaces/symbols.py

@@ -167,6 +167,20 @@ class BaseSymbolTableInterface:
         """
         raise NotImplementedError("Abstract method set_type_class not implemented yet.")
 
+    def optional_set_type_class(self, name: str, clazz: Type[objects.ObjectInterface]) -> bool:
+        """Calls the set_type_class function but does not throw an exception.
+        Returns whether setting the type class was successfull.
+        Args:
+            name: The name of the type to override the class for
+            clazz: The actual class to override for the provided type name
+        """
+        try:
+            self.set_type_class(name, clazz)
+            
+            return True
+        except ValueError:
+            return False
+
     def get_type_class(self, name: str) -> Type[objects.ObjectInterface]:
         """Returns the class associated with a Symbol type."""
         raise NotImplementedError("Abstract method get_type_class not implemented yet.")

volatility3/framework/layers/qemu.py

@@ -3,7 +3,6 @@
 #
 import functools
 import json
-import math
 from typing import Optional, Dict, Any, Tuple, List, Set
 
 from volatility3.framework import interfaces, exceptions, constants
@@ -131,8 +130,6 @@ class QemuSuspendLayer(segmented.NonLinearlySegmentedLayer):
         index = 8
         section_info = dict()
         current_section_id = -1
-        version_id = -1
-        name = None
         while section_byte != self.QEVM_EOF and index <= base_layer.maximum_address:
             section_byte = self.context.object(self._qemu_table_name + constants.BANG + 'unsigned char',
                                                offset = index,

volatility3/framework/plugins/windows/ldrmodules.py

@@ -1,7 +1,6 @@
 from volatility3.framework import interfaces, constants
 from volatility3.framework import renderers, interfaces, exceptions
 from volatility3.framework.configuration import requirements
-from volatility3.framework.objects import utility
 from volatility3.framework.renderers import format_hints
 from volatility3.framework.symbols import intermed
 from volatility3.framework.symbols.windows.extensions import pe

volatility3/framework/symbols/windows/__init__.py

@@ -4,7 +4,7 @@
 
 from volatility3.framework.symbols import intermed
 from volatility3.framework.symbols.windows import extensions
-from volatility3.framework.symbols.windows.extensions import registry, pool
+from volatility3.framework.symbols.windows.extensions import registry, pool, pe
 
 
 class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable):
@@ -38,6 +38,11 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable):
         self.set_type_class('_SHARED_CACHE_MAP', extensions.SHARED_CACHE_MAP)
         self.set_type_class('_VACB', extensions.VACB)
         self.set_type_class('_POOL_TRACKER_BIG_PAGES', pool.POOL_TRACKER_BIG_PAGES)
+        self.set_type_class('_IMAGE_DOS_HEADER', pe.IMAGE_DOS_HEADER)
+        
+        # Might not necessarily defined in every version of windows
+        self.optional_set_type_class('_IMAGE_NT_HEADERS', pe.IMAGE_NT_HEADERS)
+        self.optional_set_type_class('_IMAGE_NT_HEADERS64', pe.IMAGE_NT_HEADERS)
 
         # This doesn't exist in very specific versions of windows
         try:
@@ -49,19 +54,11 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable):
             pass
 
         # these don't exist in windows XP
-        try:
-            self.set_type_class('_MMADDRESS_NODE', extensions.MMVAD_SHORT)
-        except ValueError:
-            pass
-
+        self.optional_set_type_class('_MMADDRESS_NODE', extensions.MMVAD_SHORT)
+        
         # these were introduced starting in windows 8
-        try:
-            self.set_type_class('_MM_AVL_NODE', extensions.MMVAD_SHORT)
-        except ValueError:
-            pass
-
+        self.optional_set_type_class('_MM_AVL_NODE', extensions.MMVAD_SHORT)
+        
         # these were introduced starting in windows 7
-        try:
-            self.set_type_class('_RTL_BALANCED_NODE', extensions.MMVAD_SHORT)
-        except ValueError:
-            pass
+        self.optional_set_type_class('_RTL_BALANCED_NODE', extensions.MMVAD_SHORT)
+        

volatility3/framework/symbols/windows/extensions/__init__.py

@@ -574,9 +574,9 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject):
         proc_layer = self._context.layers[proc_layer_name]
         if not proc_layer.is_valid(self.Peb):
             raise exceptions.InvalidAddressException(proc_layer_name, self.Peb,
-                                                     f"Invalid address at {self.Peb:0x}")
+                                                     f"Invalid Peb address at {self.Peb:0x}")
 
-        sym_table = self.vol.type_name.split(constants.BANG)[0]
+        sym_table = self.get_symbol_table_name()
         peb = self._context.object(f"{sym_table}{constants.BANG}_PEB",
                                    layer_name = proc_layer_name,
                                    offset = self.Peb)