From 76d6764e8172db7e8b3f411a5a01a15b4187cae1 Mon Sep 17 00:00:00 2001
From: Steffi Keene <steffikeene@Steffis-MacBook-Pro-2.local>
Date: Mon, 10 Aug 2020 14:04:22 -0500
Subject: [PATCH] cleanups

---
 volatility/framework/plugins/windows/memdump.py | 13 ++++++-------
 volatility/framework/plugins/windows/memmap.py  |  5 +----
 2 files changed, 7 insertions(+), 11 deletions(-)

diff --git a/volatility/framework/plugins/windows/memdump.py b/volatility/framework/plugins/windows/memdump.py
index 29c9ec32d..6187278ed 100644
--- a/volatility/framework/plugins/windows/memdump.py
+++ b/volatility/framework/plugins/windows/memdump.py
@@ -3,12 +3,10 @@
 #
 
 from typing import List
-import sys
 from volatility.framework import exceptions, renderers, interfaces
 from volatility.framework.configuration import requirements
 from volatility.framework.renderers import format_hints
-from volatility.framework.objects import utility
-from volatility.plugins.windows import pslist, dlllist, ssdt, vadinfo
+from volatility.plugins.windows import pslist
 
 
 class Memdump(interfaces.plugins.PluginInterface):
@@ -23,7 +21,6 @@ class Memdump(interfaces.plugins.PluginInterface):
                                                      architectures = ["Intel32", "Intel64"]),
             requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
             requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)),
-            requirements.PluginRequirement(name = 'vadinfo', plugin = vadinfo.VadInfo, version = (1, 0, 0)),
             requirements.IntRequirement(name = 'pid',
                                         description = "Process ID to include (all other processes are excluded)",
                                         optional = True)
@@ -38,6 +35,8 @@ class Memdump(interfaces.plugins.PluginInterface):
             pid = "Unknown"
             try:
                 pid = proc.UniqueProcessId
+                offset = format_hints.Hex(proc.vol.offset)
+                filename = str(pid) + "." + str(offset)
                 proc_layer_name = proc.add_process_layer()
                 proc_layer = self.context.layers[proc_layer_name]
             except exceptions.InvalidAddressException as excp:
@@ -45,7 +44,7 @@ class Memdump(interfaces.plugins.PluginInterface):
                 continue
 
             #Create file for writing
-            filedata = interfaces.plugins.FileInterface("{}.dmp".format(proc.UniqueProcessId))
+            filedata = interfaces.plugins.FileInterface("{}.dmp".format(filename))
 
             for mapval in proc_layer.mapping(0x0, proc_layer.maximum_address, ignore_errors = True):
                 vadd, _, vpage, page_size, maplayer = mapval
@@ -57,10 +56,10 @@ class Memdump(interfaces.plugins.PluginInterface):
                     continue
 
             try:
-                result_text = "Writing {} [ {} ] to {}.dmp".format(process_name, proc.UniqueProcessId, proc.UniqueProcessId)
+                result_text = "Writing {} [ {} ] to {}.dmp".format(process_name, proc.UniqueProcessId, filename)
                 self.produce_file(filedata)
             except exceptions.InvalidAddressException:
-                result_text = "Unable to write {} [ {} ]to {}.dmp".format(process_name, proc.UniqueProcessId, proc.UniqueProcessId)
+                result_text = "Unable to write {} [ {} ]to {}.dmp".format(process_name, proc.UniqueProcessId, filename)
             
             yield(0, (result_text,))
             
diff --git a/volatility/framework/plugins/windows/memmap.py b/volatility/framework/plugins/windows/memmap.py
index 90251573e..e3f03d08b 100644
--- a/volatility/framework/plugins/windows/memmap.py
+++ b/volatility/framework/plugins/windows/memmap.py
@@ -3,11 +3,10 @@
 #
 
 from typing import List
-
 from volatility.framework import exceptions, renderers, interfaces
 from volatility.framework.configuration import requirements
 from volatility.framework.renderers import format_hints
-from volatility.plugins.windows import pslist, dlllist, ssdt, vadinfo
+from volatility.plugins.windows import pslist
 
 
 class Memmap(interfaces.plugins.PluginInterface):
@@ -22,7 +21,6 @@ class Memmap(interfaces.plugins.PluginInterface):
                                                      architectures = ["Intel32", "Intel64"]),
             requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
             requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)),
-            requirements.PluginRequirement(name = 'vadinfo', plugin = vadinfo.VadInfo, version = (1, 0, 0)),
             requirements.IntRequirement(name = 'pid',
                                         description = "Process ID to include (all other processes are excluded)",
                                         optional = True)
@@ -30,7 +28,6 @@ class Memmap(interfaces.plugins.PluginInterface):
 
     def _generator(self, procs):
         for proc in procs:
-            reverse_map = dict()
             offset = 0
             pid = "Unknown"