diff --git a/volatility3/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py index c7cb6a5b8..558bfb2f1 100644 --- a/volatility3/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -12,9 +12,7 @@ import urllib.request from abc import abstractmethod from typing import Dict, Generator, Iterable, List, Optional, Tuple -import volatility3.framework -import volatility3.schemas -from volatility3 import schemas +from volatility3 import framework, schemas from volatility3.framework import constants, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.layers import resources @@ -41,7 +39,7 @@ class IdentifierProcessor: Returns: identifier is valid or None if not found """ - raise NotImplemented("This base class has no get_identifier method defined") + raise NotImplementedError("This base class has no get_identifier method defined") class WindowsIdentifier(IdentifierProcessor): @@ -94,7 +92,7 @@ class CacheManagerInterface(interfaces.configuration.VersionableInterface): super().__init__() self._filename = filename self._classifiers = {} - for subclazz in volatility3.framework.class_subclasses(IdentifierProcessor): + for subclazz in framework.class_subclasses(IdentifierProcessor): self._classifiers[subclazz.operating_system] = subclazz def add_identifier(self, location: str, operating_system: str, identifier: str): @@ -267,7 +265,7 @@ class SqliteCache(CacheManagerInterface): if row['location'] in files_to_timestamp: cache_update.add(row['location']) - idextractors = list(volatility3.framework.class_subclasses(IdentifierProcessor)) + idextractors = list(framework.class_subclasses(IdentifierProcessor)) # New or not recently updated @@ -347,7 +345,8 @@ class SqliteCache(CacheManagerInterface): if missing_locations: self._database.cursor().execute( - f"DELETE FROM cache WHERE location IN ({','.join(['?'] * len(missing_locations))})", [x for x in missing_locations]) + f"DELETE FROM cache WHERE location IN ({','.join(['?'] * len(missing_locations))})", + [x for x in missing_locations]) self._database.commit() def get_identifier_dictionary(self, operating_system: Optional[str] = None, local_only: bool = False) -> \ diff --git a/volatility3/framework/automagic/symbol_finder.py b/volatility3/framework/automagic/symbol_finder.py index 610ed0e18..a9221a7cc 100644 --- a/volatility3/framework/automagic/symbol_finder.py +++ b/volatility3/framework/automagic/symbol_finder.py @@ -123,9 +123,8 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface): requirement.construct(context, config_path) break else: - if symbol_files: - vollog.debug(f"Symbol library path not found: {symbol_files}") - # print("Kernel", banner, hex(banner_offset)) + vollog.debug(f"Symbol library path not found for: {banner}") + # print("Kernel", banner, hex(banner_offset)) else: vollog.debug("No existing banners found") # TODO: Fallback to generic regex search? diff --git a/volatility3/framework/plugins/linux/psaux.py b/volatility3/framework/plugins/linux/psaux.py index ed91c66f2..d8b844ca4 100644 --- a/volatility3/framework/plugins/linux/psaux.py +++ b/volatility3/framework/plugins/linux/psaux.py @@ -4,11 +4,12 @@ from typing import Optional +from volatility3.framework import exceptions, interfaces, renderers from volatility3.framework.configuration import requirements -from volatility3.framework import symbols, exceptions, renderers, interfaces +from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.plugins.linux import pslist -from volatility3.framework.interfaces import plugins + class PsAux(plugins.PluginInterface): """ Lists processes with their command line arguments """ @@ -29,7 +30,7 @@ class PsAux(plugins.PluginInterface): ] def _get_command_line_args(self, task: interfaces.objects.ObjectInterface, - name: str) -> Optional[str]: + name: str) -> Optional[str]: """ Reads the command line arguments of a process These are stored on the userland stack @@ -104,8 +105,7 @@ class PsAux(plugins.PluginInterface): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) return renderers.TreeGrid([("PID", int), ("PPID", int), ("COMM", str), ("ARGS", str)], - self._generator( - pslist.PsList.list_tasks(self.context, - self.config['kernel'], - filter_func = filter_func))) - + self._generator( + pslist.PsList.list_tasks(self.context, + self.config['kernel'], + filter_func = filter_func))) diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index af3741bbe..430ad6a30 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -13,7 +13,7 @@ from typing import Any, Dict, Generator, List, Optional, Tuple, Union from urllib import parse, request from volatility3 import symbols -from volatility3.framework import constants, contexts, exceptions, interfaces +from volatility3.framework import constants, exceptions, interfaces from volatility3.framework.automagic import symbol_cache from volatility3.framework.configuration import requirements from volatility3.framework.configuration.requirements import SymbolTableRequirement