Merge branch 'feature/mbr-parser' of https://github.com/Digitalisx/volatility3 into feature/mbr-parser

doc/source/complex-plugin.rst

@@ -300,7 +300,7 @@ This will mean that when a specific structure is loaded from the symbol_space, i
 `StructType`, but instead is instantiated using the NewStructureClass, meaning new methods can be called directly on it.
 
 If the situation really calls for an entirely new object, that isn't covered by one of the existing
-:py:class:`~volatility3.framework.objects.PrimativeObject` objects (such as
+:py:class:`~volatility3.framework.objects.PrimitiveObject` objects (such as
 :py:class:`~volatility3.framework.objects.Integer`,
 :py:class:`~volatility3.framework.objects.Boolean`,
 :py:class:`~volatility3.framework.objects.Float`,

doc/source/glossary.rst

@@ -145,7 +145,7 @@ Struct, Structure
 
 Symbol
     This is used in many different contexts, as a short term for many things.  Within Volatility, a symbol is a
-    construct that usually encompasses a specific type :ref:`type<Type>` at a specfific :ref:`offset<Offset>`,
+    construct that usually encompasses a specific type :ref:`type<Type>` at a specific :ref:`offset<Offset>`,
     representing a particular instance of that type within the memory of a compiled and running program.  An example
     would be the location in memory of a list of active tcp endpoints maintained by the networking stack
     within an operating system.

doc/source/simple-plugin.rst

@@ -206,9 +206,9 @@ information may not be provided.
 
 The plugin then takes the process's ``BaseDllName`` value, and calls :py:meth:`~volatility3.framework.symbols.windows.extensions.UNICODE_STRING.get_string` on it.  All structure attributes,
 as defined by the symbols, are directly accessible and use the case-style of the symbol library it came from (in Windows,
-attributes are CamelCase), such as ``entry.BaseDllName`` in this instance.  Any attribtues not defined by the symbol but added
+attributes are CamelCase), such as ``entry.BaseDllName`` in this instance.  Any attributes not defined by the symbol but added
 by Volatility extensions cannot be properties (in case they overlap with the attributes defined in the symbol libraries)
-and are therefore always methods and prepended with ``get_``, in this example ``BaseDllName.get_string()``.
+and are therefore always methods and pretended with ``get_``, in this example ``BaseDllName.get_string()``.
 
 Finally, ``FullDllName`` is populated.  These operations read from memory, and as such, the memory image may be unable to
 read the data at a particular offset.  This will cause an exception to be thrown.  In Volatility 3, exceptions are thrown

volatility3/framework/contexts/__init__.py

@@ -141,7 +141,7 @@ class Context(interfaces.context.ContextInterface):
             layer_name: The layer within the context in which the module exists
             offset: The offset at which the module exists in the layer
             native_layer_name: The default native layer for objects constructed by the module
-            size: The size, in bytes, that the module occupys from offset location within the layer named layer_name
+            size: The size, in bytes, that the module occupies from offset location within the layer named layer_name
         """
         if size:
             return SizedModule.create(self,

volatility3/framework/interfaces/configuration.py

@@ -73,7 +73,7 @@ class HierarchicalDict(collections.abc.Mapping):
                  separator: str = CONFIG_SEPARATOR) -> None:
         """
         Args:
-            initial_dict: A dictionary to populate the HierachicalDict with initially
+            initial_dict: A dictionary to populate the HierarchicalDict with initially
             separator: A custom hierarchy separator (defaults to CONFIG_SEPARATOR)
         """
         if not (isinstance(separator, str) and len(separator) == 1):

volatility3/framework/interfaces/context.py

@@ -129,7 +129,7 @@ class ContextInterface(metaclass = ABCMeta):
             layer_name: The layer the module is associated with (which layer the module lives within)
             offset: The initial/base offset of the module (used as the offset for relative symbols)
             native_layer_name: The default native_layer_name to use when the module constructs objects
-            size: The size, in bytes, that the module occupys from offset location within the layer named layer_name
+            size: The size, in bytes, that the module occupies from offset location within the layer named layer_name
 
         Returns:
             A module object

volatility3/framework/interfaces/renderers.py

@@ -1,7 +1,7 @@
 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
-"""All plugins output a TreeGrid object which must then be rendered (eithe by a
+"""All plugins output a TreeGrid object which must then be rendered (either by a
 GUI, or as text output, html output or in some other form.
 
 This module defines both the output format (:class:`TreeGrid`) and the

volatility3/framework/layers/scanners/__init__.py

@@ -31,7 +31,7 @@ class BytesScanner(layers.ScannerInterface):
 
 class RegExScanner(layers.ScannerInterface):
     """A scanner that can be provided with a bytes-object regular expression pattern
-    The scanner will scqn all blocks for the regular expression and report the absolute offset of any finds
+    The scanner will scan all blocks for the regular expression and report the absolute offset of any finds
 
     The default flags include DOTALL, since the searches are through binary data and the newline character should
     have no specific significance in such searches"""
@@ -95,7 +95,7 @@ class MultiStringScanner(layers.ScannerInterface):
                 else:
                     suffixes.append(re.escape(bytes([entry])))
             else:
-                # If we've fininshed one of the strings at this point, remember it for later
+                # If we've finished one of the strings at this point, remember it for later
                 finished = True
 
         if len(suffixes) == 1:

volatility3/framework/objects/__init__.py

@@ -206,7 +206,7 @@ class Bytes(PrimitiveObject, bytes):
                 length: int = 1,
                 **kwargs) -> 'Bytes':
         """Creates the appropriate class and returns it so that the native type
-        is inherritted.
+        is inherited.
 
         The only reason the kwargs is added, is so that the
         inheriting types can override __init__ without needing to
@@ -704,7 +704,7 @@ class AggregateType(interfaces.objects.ObjectInterface):
                     tmp_list[member] = (relative_offset, new_child)
                     # If there's trouble with mutability, consider making update_vol return a clone with the changes
                     # (there will be a few other places that will be necessary) and/or making these part of the
-                    # permanent dictionaries rather than the non-clonable ones
+                    # permanent dictionaries rather than the non-cloneable ones
                     template.update_vol(members = tmp_list)
 
         @classmethod

volatility3/framework/plugins/windows/malfind.py

@@ -13,12 +13,6 @@ from volatility3.plugins.windows import pslist, vadinfo
 
 vollog = logging.getLogger(__name__)
 
-try:
-    import capstone
-    
-    has_capstone = True
-except ImportError:
-    has_capstone = False
 
 class Malfind(interfaces.plugins.PluginInterface):
     """Lists process memory ranges that potentially contain injected code."""
@@ -134,11 +128,7 @@ class Malfind(interfaces.plugins.PluginInterface):
                 else:
                     architecture = "intel64"
 
-                if has_capstone:
-                    disasm = interfaces.renderers.Disassembly(data, vad.get_start(), architecture)
-                else:
-                    raise exceptions.MissingModuleException(
-                        "capstone", "Requires capstone to disassembly data")
+                disasm = interfaces.renderers.Disassembly(data, vad.get_start(), architecture)
 
                 file_output = "Disabled"
                 if self.config['dump']:

volatility3/framework/plugins/windows/privileges.py

@@ -55,14 +55,14 @@ class Privs(interfaces.plugins.PluginInterface):
             try:
                 process_token = task.Token.dereference().cast("_TOKEN")
             except exceptions.InvalidAddressException:
-                vollog.log(constants.LOGLEVEL_VVV, 'Skeep invalid token.')
+                vollog.log(constants.LOGLEVEL_VVV, 'Skip invalid token.')
                 continue
 
             for value, present, enabled, default in process_token.privileges():
                 # Skip privileges whose bit positions cannot be
                 # translated to a privilege name
                 if not self.privilege_info.get(int(value)):
-                    vollog.log(constants.LOGLEVEL_VVV, f'Skeep invalid privilege ({value}).')
+                    vollog.log(constants.LOGLEVEL_VVV, f'Skip invalid privilege ({value}).')
                     continue
 
                 name, desc = self.privilege_info.get(int(value))

volatility3/framework/plugins/windows/psscan.py

@@ -85,7 +85,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
             context: The context to retrieve required elements (layers, symbol tables) from
             layer_name: The name of the layer on which to operate
             symbol_table: The name of the table containing the kernel symbols
-            proc: the process object with phisical address
+            proc: the process object with physical address
 
         Returns:
             A process object on virtual address layer

volatility3/framework/symbols/windows/mft.json

@@ -134,7 +134,7 @@
                           "kind": "base",
                           "name": "unsigned char"
                         }
-                      }
+                    }
                 },
                 "UpdateSequenceOffset": {
                     "offset": 4,
@@ -192,7 +192,7 @@
                         "name": "unsigned int"
                     }
                 },
-                "AlocatedSize": {
+                "AllocatedSize": {
                     "offset": 28,
                     "type":{
                         "kind": "base",
@@ -270,7 +270,8 @@
                     "offset": 8,
                     "type": {
                         "kind": "base",
-                        "name": "unsigned char"                      }
+                        "name": "unsigned char"                      
+                    }
                 },
                 "NameLength": {
                     "offset": 9,
@@ -322,7 +323,8 @@
                     "offset": 8,
                     "type": {
                         "kind": "base",
-                        "name": "unsigned short"                      }
+                        "name": "unsigned short"                      
+                    }
                 }
             },
             "kind": "struct",