diff --git a/volatility3/framework/symbols/windows/extensions/gui.py b/volatility3/framework/symbols/windows/extensions/gui.py index 48ec2eba4..f811f4313 100644 --- a/volatility3/framework/symbols/windows/extensions/gui.py +++ b/volatility3/framework/symbols/windows/extensions/gui.py @@ -14,6 +14,7 @@ from volatility3.framework.symbols.windows.extensions import pool vollog = logging.getLogger(__name__) + class GUIExtensions(interfaces.configuration.VersionableInterface): _version = (1, 0, 0) _required_framework_version = (2, 0, 0) @@ -83,14 +84,13 @@ class GUIExtensions(interfaces.configuration.VersionableInterface): seen.add(desktop.vol.offset) - class tagDESKTOP(objects.StructType, pool.ExecutiveObject): def is_valid(self) -> bool: """ Enforce a valid session ID and Window station We aren't interested in terminated desktops as there are so many pointers going from station -> desktop -> windows, that we would just be processing junk. - Even if the pointers were still in tact by some miracle, its not that helpful to + Even if the pointers were still in tact by some miracle, its not that helpful to have a floating desktop appear in the output as you can't do much with it. """ sid = self.get_session_id() @@ -102,7 +102,7 @@ class GUIExtensions(interfaces.configuration.VersionableInterface): return False - def get_window_station(self) -> Optional["tagWINDOWSTATION"]: + def get_window_station(self) -> Optional["GUIExtensions.tagWINDOWSTATION"]: """ Attempts to return the window station for this desktop """ @@ -133,7 +133,9 @@ class GUIExtensions(interfaces.configuration.VersionableInterface): symbol_table_name + constants.BANG + "tagTHREADINFO", "PtiLink" ): try: - process_name = utility.array_to_string(thread.ppi.Process.ImageFileName) + process_name = utility.array_to_string( + thread.ppi.Process.ImageFileName + ) process_pid = thread.ppi.Process.UniqueProcessId except exceptions.InvalidAddressException: continue @@ -217,7 +219,6 @@ class GUIExtensions(interfaces.configuration.VersionableInterface): if len(seen_windows) == max_windows: break - class tagWND(objects.StructType, pool.ExecutiveObject): def is_valid(self) -> bool: @@ -297,10 +298,11 @@ class GUIExtensions(interfaces.configuration.VersionableInterface): else: return self.lpfnWndProc except exceptions.InvalidAddressException: - vollog.debug(f"Invalid window procedure for window {self.vol.offset:#x}") + vollog.debug( + f"Invalid window procedure for window {self.vol.offset:#x}" + ) return None - # This is copy/paste from UNICODE_STRING in `symbols/windows/extensions/__init__.py` # The versioning of modules would get very ugly if we let different modules share implementations # across different data structures