Refactor conversion code from objects.utility to a conversion module in renderers.

volatility/framework/objects/utility.py

@@ -1,7 +1,6 @@
-import datetime
 import typing
 
-from volatility.framework import interfaces, objects, renderers, constants
+from volatility.framework import interfaces, objects, constants
 
 
 def array_to_string(array: objects.Array,
@@ -44,45 +43,3 @@ def array_of_pointers(array: interfaces.objects.ObjectInterface,
     return array.cast("array", count = count, subtype = subtype_pointer)
 
 
-def wintime_to_datetime(wintime: int) -> typing.Union[
-    interfaces.renderers.BaseAbsentValue, datetime.datetime]:
-    unix_time = wintime // 10000000
-    if unix_time == 0:
-        return renderers.NotApplicableValue()
-    unix_time = unix_time - 11644473600
-    try:
-        return datetime.datetime.utcfromtimestamp(unix_time)
-    except ValueError:
-        return renderers.UnparsableValue()
-
-
-def unixtime_to_datetime(unixtime: int) -> typing.Union[interfaces.renderers.BaseAbsentValue, datetime.datetime]:
-    ret = renderers.UnparsableValue()  # type: typing.Union[interfaces.renderers.BaseAbsentValue, datetime.datetime]
-
-    if unixtime > 0:
-        try:
-            ret = datetime.datetime.utcfromtimestamp(unixtime)
-        except ValueError:
-            pass
-
-    return ret
-
-
-def round(addr: int, align: int, up: bool = False) -> int:
-    """Round an address up or down based on an alignment.
-
-    Args:
-        addr: the address
-        align: the alignment value
-        up: Whether to round up or not
-
-    Returns:
-        The aligned address
-    """
-
-    if addr % align == 0:
-        return addr
-    else:
-        if up:
-            return (addr + (align - (addr % align)))
-        return (addr - (addr % align))

volatility/framework/renderers/conversion.py

@@ -0,0 +1,48 @@
+import datetime
+import typing
+
+from volatility.framework import interfaces, renderers
+
+
+def wintime_to_datetime(wintime: int) -> typing.Union[
+    interfaces.renderers.BaseAbsentValue, datetime.datetime]:
+    unix_time = wintime // 10000000
+    if unix_time == 0:
+        return renderers.NotApplicableValue()
+    unix_time = unix_time - 11644473600
+    try:
+        return datetime.datetime.utcfromtimestamp(unix_time)
+    except ValueError:
+        return renderers.UnparsableValue()
+
+
+def unixtime_to_datetime(unixtime: int) -> typing.Union[interfaces.renderers.BaseAbsentValue, datetime.datetime]:
+    ret = renderers.UnparsableValue()  # type: typing.Union[interfaces.renderers.BaseAbsentValue, datetime.datetime]
+
+    if unixtime > 0:
+        try:
+            ret = datetime.datetime.utcfromtimestamp(unixtime)
+        except ValueError:
+            pass
+
+    return ret
+
+
+def round(addr: int, align: int, up: bool = False) -> int:
+    """Round an address up or down based on an alignment.
+
+    Args:
+        addr: the address
+        align: the alignment value
+        up: Whether to round up or not
+
+    Returns:
+        The aligned address
+    """
+
+    if addr % align == 0:
+        return addr
+    else:
+        if up:
+            return (addr + (align - (addr % align)))
+        return (addr - (addr % align))

volatility/framework/symbols/linux/extensions/bash.py

@@ -1,6 +1,7 @@
 from volatility.framework import exceptions
 from volatility.framework import objects
 from volatility.framework.objects import utility
+from volatility.framework.renderers import conversion
 
 
 class hist_entry(objects.Struct):
@@ -41,7 +42,7 @@ class hist_entry(objects.Struct):
     def get_time_object(self):
         nsecs = self.get_time_as_integer()
         # Build a timestamp object from the integer
-        return utility.unixtime_to_datetime(nsecs)
+        return conversion.unixtime_to_datetime(nsecs)
 
     def get_command(self):
         return utility.array_to_string(self.line.dereference())

volatility/framework/symbols/windows/extensions/__init__.py

@@ -3,9 +3,9 @@ import functools
 import logging
 import typing
 
-import volatility.framework.objects.utility
 from volatility.framework import constants, exceptions, interfaces, objects, renderers, symbols
 from volatility.framework.layers import intel
+from volatility.framework.renderers import conversion
 from volatility.framework.symbols import generic
 from volatility.framework.symbols.windows.extensions.registry import RegKeyFlags
 
@@ -45,7 +45,7 @@ class _POOL_HEADER(objects.Struct):
         else:
             alignment = pool_header_size
             type_size = self._context.symbol_space.get_type(symbol_table_name + constants.BANG + type_name).size
-            rounded_size = objects.utility.round(type_size, alignment, up = True)
+            rounded_size = conversion.round(type_size, alignment, up = True)
 
             mem_object = self._context.object(symbol_table_name + constants.BANG + type_name,
                                               layer_name = self.vol.layer_name,
@@ -69,7 +69,7 @@ class _KSYSTEM_TIME(objects.Struct):
 
     def get_time(self):
         wintime = (self.High1Time << 32) | self.LowPart
-        return objects.utility.wintime_to_datetime(wintime)
+        return conversion.wintime_to_datetime(wintime)
 
 
 class _MMVAD_SHORT(objects.Struct):
@@ -564,10 +564,10 @@ class _EPROCESS(generic.GenericIntelProcess, ExecutiveObject):
         return renderers.UnreadableValue()
 
     def get_create_time(self):
-        return objects.utility.wintime_to_datetime(self.CreateTime.QuadPart)
+        return conversion.wintime_to_datetime(self.CreateTime.QuadPart)
 
     def get_exit_time(self):
-        return objects.utility.wintime_to_datetime(self.ExitTime.QuadPart)
+        return conversion.wintime_to_datetime(self.ExitTime.QuadPart)
 
     def get_wow_64_process(self):
         if self.has_member("Wow64Process"):

volatility/framework/symbols/windows/extensions/pe.py

@@ -3,7 +3,7 @@ import typing
 
 from volatility.framework import constants
 from volatility.framework import objects, interfaces
-from volatility.framework.objects import utility
+from volatility.framework.renderers import conversion
 
 
 class _IMAGE_DOS_HEADER(objects.Struct):
@@ -127,7 +127,7 @@ class _IMAGE_DOS_HEADER(objects.Struct):
                 sect_sizes.append(sect.VirtualAddress - prevsect.VirtualAddress)
             prevsect = sect
         if prevsect is not None:
-            sect_sizes.append(utility.round(prevsect.Misc.VirtualSize, section_alignment, up = True))
+            sect_sizes.append(conversion.round(prevsect.Misc.VirtualSize, section_alignment, up = True))
 
         counter = 0
         start_addr = nt_header.FileHeader.SizeOfOptionalHeader + \

volatility/plugins/windows/registry/printkey.py

@@ -6,8 +6,7 @@ import volatility.framework.interfaces.plugins as plugins
 from volatility.framework import objects, renderers, exceptions
 from volatility.framework.configuration import requirements
 from volatility.framework.layers.registry import RegistryHive
-from volatility.framework.objects import utility
-from volatility.framework.renderers import TreeGrid
+from volatility.framework.renderers import TreeGrid, conversion
 from volatility.framework.symbols.windows.extensions.registry import RegValueTypes
 
 vollog = logging.getLogger(__name__)
@@ -48,7 +47,7 @@ class PrintKey(plugins.PluginInterface):
             return
         node = node_path[-1]
         key_path = key_path or node.get_key_path()
-        last_write_time = utility.wintime_to_datetime(node.LastWriteTime.QuadPart)
+        last_write_time = conversion.wintime_to_datetime(node.LastWriteTime.QuadPart)
 
         for key_node in node.get_subkeys():
             result = (key_path.count("\\"),

volatility/plugins/windows/registry/userassist.py

@@ -5,19 +5,17 @@ import logging
 import os
 import typing
 
-import volatility.framework.interfaces.plugins as interfaces_plugins
-from volatility.framework import exceptions, renderers, constants
+from volatility.framework import exceptions, renderers, constants, interfaces
 from volatility.framework.configuration import requirements
 from volatility.framework.layers.physical import BufferDataLayer
 from volatility.framework.layers.registry import RegistryHive
-from volatility.framework.objects import utility
-from volatility.framework.renderers import format_hints
+from volatility.framework.renderers import format_hints, conversion
 from volatility.framework.symbols import intermed
 
 vollog = logging.getLogger(__name__)
 
 
-class UserAssist(interfaces_plugins.PluginInterface):
+class UserAssist(interfaces.plugins.PluginInterface):
     """Print userassist registry keys and information"""
 
     def __init__(self, *args, **kwargs):
@@ -92,7 +90,7 @@ class UserAssist(interfaces_plugins.PluginInterface):
             item["focus"] = renderers.NotApplicableValue()
             item["time"] = renderers.NotApplicableValue()
 
-        item["lastupdated"] = utility.wintime_to_datetime(userassist_obj.LastUpdated.QuadPart)
+        item["lastupdated"] = conversion.wintime_to_datetime(userassist_obj.LastUpdated.QuadPart)
 
         return item
 
@@ -140,7 +138,8 @@ class UserAssist(interfaces_plugins.PluginInterface):
             # each guid key should have a Count key in it
             for countkey in guidkey.get_subkeys():
                 countkey_path = countkey.get_key_path()
-                countkey_last_write_time = utility.wintime_to_datetime(countkey.LastWriteTime.QuadPart)
+                countkey_last_write_time = volatility.framework.renderers.conversion.wintime_to_datetime(
+                    countkey.LastWriteTime.QuadPart)
 
                 # output the parent Count key
                 result = (0,