From 7d9c66c407f7c534026f03594d348213fa27cd2b Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Tue, 1 Jun 2021 14:27:20 -0500 Subject: [PATCH] run yapf on the newly added files --- volatility3/framework/layers/crash.py | 34 ++++---- .../framework/plugins/windows/crashinfo.py | 83 ++++++++++--------- .../symbols/windows/extensions/crash.py | 14 ++-- 3 files changed, 67 insertions(+), 64 deletions(-) diff --git a/volatility3/framework/layers/crash.py b/volatility3/framework/layers/crash.py index f6cf0e0cc..328e73ed4 100644 --- a/volatility3/framework/layers/crash.py +++ b/volatility3/framework/layers/crash.py @@ -29,7 +29,7 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer): VALIDDUMP = 0x504d5544 crashdump_json = 'crash' - supported_dumptypes = [0x01, 0x05] # we need 0x5 for 32-bit bitmaps + supported_dumptypes = [0x01, 0x05] # we need 0x5 for 32-bit bitmaps dump_header_name = '_DUMP_HEADER' _magic_struct = struct.Struct(' interfaces.objects.ObjectInterface: return self.context.object(self._crash_table_name + constants.BANG + self.dump_header_name, - offset=0, - layer_name=self._base_layer) + offset = 0, + layer_name = self._base_layer) def get_summary_header(self) -> interfaces.objects.ObjectInterface: return self.context.object(self._crash_common_table_name + constants.BANG + "_SUMMARY_DUMP", - offset=0x1000 * self.headerpages, - layer_name=self._base_layer) + offset = 0x1000 * self.headerpages, + layer_name = self._base_layer) def _load_segments(self) -> None: """Loads up the segments from the meta_layer.""" @@ -92,13 +93,14 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer): if self.dump_type == 0x1: header = self.context.object(self._crash_table_name + constants.BANG + self.dump_header_name, - offset=0, - layer_name=self._base_layer) + offset = 0, + layer_name = self._base_layer) offset = self.headerpages header.PhysicalMemoryBlockBuffer.Run.count = header.PhysicalMemoryBlockBuffer.NumberOfRuns for run in header.PhysicalMemoryBlockBuffer.Run: - segments.append((run.BasePage * 0x1000, offset * 0x1000, run.PageCount * 0x1000, run.PageCount * 0x1000)) + segments.append( + (run.BasePage * 0x1000, offset * 0x1000, run.PageCount * 0x1000, run.PageCount * 0x1000)) offset += run.PageCount elif self.dump_type == 0x05: @@ -150,18 +152,17 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer): # report the segments for debugging. this is valuable for dev/troubleshooting but # not important enough for a dedicated plugin. for idx, (start_position, mapped_offset, length, _) in enumerate(segments): - vollog.log(constants.LOGLEVEL_VVVV, - "Segment {}: Position {:#x} Offset {:#x} Length {:#x}".format(idx, - start_position, - mapped_offset, - length)) + vollog.log( + constants.LOGLEVEL_VVVV, + "Segment {}: Position {:#x} Offset {:#x} Length {:#x}".format(idx, start_position, mapped_offset, + length)) self._segments = segments @classmethod def check_header(cls, base_layer: interfaces.layers.DataLayerInterface, offset: int = 0) -> Tuple[int, int]: # Verify the Window's crash dump file magic - + try: header_data = base_layer.read(offset, cls._magic_struct.size) except exceptions.InvalidAddressException: @@ -209,4 +210,3 @@ class WindowsCrashDumpStacker(interfaces.automagic.StackerLayerInterface): except WindowsCrashDumpFormatException: pass return None - diff --git a/volatility3/framework/plugins/windows/crashinfo.py b/volatility3/framework/plugins/windows/crashinfo.py index cdcbfc920..051345657 100644 --- a/volatility3/framework/plugins/windows/crashinfo.py +++ b/volatility3/framework/plugins/windows/crashinfo.py @@ -12,6 +12,7 @@ from volatility3.framework.layers import crash vollog = logging.getLogger(__name__) + class Crashinfo(interfaces.plugins.PluginInterface): _required_framework_version = (1, 0, 0) @@ -20,12 +21,12 @@ class Crashinfo(interfaces.plugins.PluginInterface): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', - architectures = ["Intel32", "Intel64"]), - ] - + architectures = ["Intel32", "Intel64"]), + ] + def _generator(self, layer: crash.WindowsCrashDump32Layer): header = layer.get_header() - uptime = datetime.timedelta(microseconds=int(header.SystemUpTime) / 10) + uptime = datetime.timedelta(microseconds = int(header.SystemUpTime) / 10) if header.DumpType == 0x1: dump_type = "Full Dump (0x1)" @@ -43,24 +44,25 @@ class Crashinfo(interfaces.plugins.PluginInterface): else: bitmap_header_size = bitmap_size = bitmap_pages = renderers.NotApplicableValue() - yield(0, (utility.array_to_string(header.Signature), - header.MajorVersion, - header.MinorVersion, - format_hints.Hex(header.DirectoryTableBase), - format_hints.Hex(header.PfnDataBase), - format_hints.Hex(header.PsLoadedModuleList), - format_hints.Hex(header.PsActiveProcessHead), - header.MachineImageType, - header.NumberProcessors, - format_hints.Hex(header.KdDebuggerDataBlock), - dump_type, - str(uptime), - utility.array_to_string(header.Comment), - conversion.wintime_to_datetime(header.SystemTime), - bitmap_header_size, - bitmap_size, - bitmap_pages, - )) + yield (0, ( + utility.array_to_string(header.Signature), + header.MajorVersion, + header.MinorVersion, + format_hints.Hex(header.DirectoryTableBase), + format_hints.Hex(header.PfnDataBase), + format_hints.Hex(header.PsLoadedModuleList), + format_hints.Hex(header.PsActiveProcessHead), + header.MachineImageType, + header.NumberProcessors, + format_hints.Hex(header.KdDebuggerDataBlock), + dump_type, + str(uptime), + utility.array_to_string(header.Comment), + conversion.wintime_to_datetime(header.SystemTime), + bitmap_header_size, + bitmap_size, + bitmap_pages, + )) def run(self): crash_layer = None @@ -74,21 +76,22 @@ class Crashinfo(interfaces.plugins.PluginInterface): vollog.error("This plugin requires a Windows crash dump") raise - return renderers.TreeGrid([("Signature", str), - ("MajorVersion", int), - ("MinorVersion", int), - ("DirectoryTableBase", format_hints.Hex), - ("PfnDataBase", format_hints.Hex), - ("PsLoadedModuleList", format_hints.Hex), - ("PsActiveProcessHead", format_hints.Hex), - ("MachineImageType", int), - ("NumberProcessors", int), - ("KdDebuggerDataBlock", format_hints.Hex), - ("DumpType", str), - ("SystemUpTime", str), - ("Comment", str), - ("SystemTime", datetime.datetime), - ("BitmapHeaderSize", format_hints.Hex), - ("BitmapSize", format_hints.Hex), - ("BitmapPages", format_hints.Hex), - ], self._generator(crash_layer)) \ No newline at end of file + return renderers.TreeGrid([ + ("Signature", str), + ("MajorVersion", int), + ("MinorVersion", int), + ("DirectoryTableBase", format_hints.Hex), + ("PfnDataBase", format_hints.Hex), + ("PsLoadedModuleList", format_hints.Hex), + ("PsActiveProcessHead", format_hints.Hex), + ("MachineImageType", int), + ("NumberProcessors", int), + ("KdDebuggerDataBlock", format_hints.Hex), + ("DumpType", str), + ("SystemUpTime", str), + ("Comment", str), + ("SystemTime", datetime.datetime), + ("BitmapHeaderSize", format_hints.Hex), + ("BitmapSize", format_hints.Hex), + ("BitmapPages", format_hints.Hex), + ], self._generator(crash_layer)) diff --git a/volatility3/framework/symbols/windows/extensions/crash.py b/volatility3/framework/symbols/windows/extensions/crash.py index 9786f0d40..8d8200aeb 100644 --- a/volatility3/framework/symbols/windows/extensions/crash.py +++ b/volatility3/framework/symbols/windows/extensions/crash.py @@ -11,17 +11,17 @@ class SUMMARY_DUMP(objects.StructType): def get_buffer(self, sub_type: str, count: int) -> interfaces.objects.ObjectInterface: symbol_table_name = self.get_symbol_table_name() subtype = self._context.symbol_space.get_type(symbol_table_name + constants.BANG + sub_type) - return self._context.object(object_type=symbol_table_name + constants.BANG + "array", - layer_name=self.vol.layer_name, - offset=self.BufferChar.vol.offset, - count=count, - subtype=subtype) + return self._context.object(object_type = symbol_table_name + constants.BANG + "array", + layer_name = self.vol.layer_name, + offset = self.BufferChar.vol.offset, + count = count, + subtype = subtype) def get_buffer_char(self) -> interfaces.objects.ObjectInterface: - return self.get_buffer(sub_type="unsigned char", count=(self.BitmapSize + 7) // 8) + return self.get_buffer(sub_type = "unsigned char", count = (self.BitmapSize + 7) // 8) def get_buffer_long(self) -> interfaces.objects.ObjectInterface: - return self.get_buffer(sub_type="unsigned long", count=(self.BitmapSize + 31) // 32) + return self.get_buffer(sub_type = "unsigned long", count = (self.BitmapSize + 31) // 32) class_types = {'_SUMMARY_DUMP': SUMMARY_DUMP}