WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 11:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Black and Ruff fixes

Browse Source
This commit is contained in:
Andrew Case
2025-03-16 17:17:46 +00:00
parent c8869d87cd
commit 7e5a34ae49
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/symbols/windows/extensions/gui.py
+9 -7
View File
@@ -14,6 +14,7 @@ from volatility3.framework.symbols.windows.extensions import pool
vollog = logging.getLogger(__name__)
class GUIExtensions(interfaces.configuration.VersionableInterface):
_version = (1, 0, 0)
_required_framework_version = (2, 0, 0)
@@ -83,14 +84,13 @@ class GUIExtensions(interfaces.configuration.VersionableInterface):
seen.add(desktop.vol.offset)
class tagDESKTOP(objects.StructType, pool.ExecutiveObject):
def is_valid(self) -> bool:
"""
Enforce a valid session ID and Window station
We aren't interested in terminated desktops as there are so many pointers
going from station -> desktop -> windows, that we would just be processing junk.
Even if the pointers were still in tact by some miracle, its not that helpful to
Even if the pointers were still in tact by some miracle, its not that helpful to
have a floating desktop appear in the output as you can't do much with it.
"""
sid = self.get_session_id()
@@ -102,7 +102,7 @@ class GUIExtensions(interfaces.configuration.VersionableInterface):
return False
def get_window_station(self) -> Optional["tagWINDOWSTATION"]:
def get_window_station(self) -> Optional["GUIExtensions.tagWINDOWSTATION"]:
"""
Attempts to return the window station for this desktop
"""
@@ -133,7 +133,9 @@ class GUIExtensions(interfaces.configuration.VersionableInterface):
symbol_table_name + constants.BANG + "tagTHREADINFO", "PtiLink"
):
try:
process_name = utility.array_to_string(thread.ppi.Process.ImageFileName)
process_name = utility.array_to_string(
thread.ppi.Process.ImageFileName
)
process_pid = thread.ppi.Process.UniqueProcessId
except exceptions.InvalidAddressException:
continue
@@ -217,7 +219,6 @@ class GUIExtensions(interfaces.configuration.VersionableInterface):
if len(seen_windows) == max_windows:
break
class tagWND(objects.StructType, pool.ExecutiveObject):
def is_valid(self) -> bool:
@@ -297,10 +298,11 @@ class GUIExtensions(interfaces.configuration.VersionableInterface):
else:
return self.lpfnWndProc
except exceptions.InvalidAddressException:
vollog.debug(f"Invalid window procedure for window {self.vol.offset:#x}")
vollog.debug(
f"Invalid window procedure for window {self.vol.offset:#x}"
)
return None
# This is copy/paste from UNICODE_STRING in `symbols/windows/extensions/__init__.py`
# The versioning of modules would get very ugly if we let different modules share implementations
# across different data structures