Numerous pycharm warnings resolved

This includes:

* Better ways of checking empty lists
* Not shadowing builtin functions like filter
* Preventing invalid slash warnings by marking strings as regexps
* Removing unnecessary brackets
* Lowercase variable names
* Adding/updating parameters in docstrings
* Removing unused code (lines not chunks)
* Change in not a member tests
* Changing some methods to static
* Shorting range membership checks
* Missing parameters
* Make some exception handlers more specific
* Don't define a lambda to a variable
* A few more instance checks to help type checkers

volatility/plugins/linux/bash.py

@@ -50,7 +50,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
                 continue
 
             proc_layer_name = task.add_process_layer()
-            if proc_layer_name == None:
+            if not proc_layer_name:
                 continue
 
             proc_layer = self.context.memory[proc_layer_name]
@@ -79,7 +79,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
                 yield (0, (task.pid, task_name, hist.get_time_object(), hist.get_command()))
 
     def run(self):
-        filter = pslist.PsList.create_filter([self.config.get('pid', None)])
+        filt = pslist.PsList.create_filter([self.config.get('pid', None)])
 
         plugin = pslist.PsList.list_tasks
 
@@ -91,17 +91,17 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
             self._generator(plugin(self.context,
                                    self.config['primary'],
                                    self.config['vmlinux'],
-                                   filter = filter)))
+                                   filter = filt)))
 
     def generate_timeline(self):
-        filter = pslist.PsList.create_filter([self.config.get('pid', None)])
+        filt = pslist.PsList.create_filter([self.config.get('pid', None)])
 
         plugin = pslist.PsList.list_tasks
 
         for row in self._generator(plugin(self.context,
                                           self.config['primary'],
                                           self.config['vmlinux'],
-                                          filter = filter)):
+                                          filter = filt)):
             _depth, row_data = row
             description = "{} ({}): \"{}\"".format(row_data[0], row_data[1], row_data[3])
             yield (description, timeliner.TimeLinerType.CREATED, row_data[2])

volatility/plugins/linux/elfs.py

@@ -26,7 +26,7 @@ class Elfs(plugins.PluginInterface):
     def _generator(self, tasks):
         for task in tasks:
             proc_layer_name = task.add_process_layer()
-            if proc_layer_name == None:
+            if not proc_layer_name:
                 continue
 
             proc_layer = self.context.memory[proc_layer_name]
@@ -50,7 +50,7 @@ class Elfs(plugins.PluginInterface):
                      ))
 
     def run(self):
-        filter = pslist.PsList.create_filter([self.config.get('pid', None)])
+        filt = pslist.PsList.create_filter([self.config.get('pid', None)])
 
         plugin = pslist.PsList.list_tasks
 
@@ -63,4 +63,4 @@ class Elfs(plugins.PluginInterface):
             self._generator(plugin(self.context,
                                    self.config['primary'],
                                    self.config['vmlinux'],
-                                   filter = filter)))
+                                   filter = filt)))

volatility/plugins/linux/malfind.py

@@ -27,7 +27,7 @@ class Malfind(interfaces_plugins.PluginInterface):
         """
 
         proc_layer_name = task.add_process_layer()
-        if proc_layer_name == None:
+        if not proc_layer_name:
             return
 
         proc_layer = self.context.memory[proc_layer_name]
@@ -64,7 +64,7 @@ class Malfind(interfaces_plugins.PluginInterface):
                            disasm))
 
     def run(self):
-        filter = pslist.PsList.create_filter([self.config.get('pid', None)])
+        filt = pslist.PsList.create_filter([self.config.get('pid', None)])
 
         plugin = pslist.PsList.list_tasks
 
@@ -78,4 +78,4 @@ class Malfind(interfaces_plugins.PluginInterface):
                                   self._generator(plugin(self.context,
                                                          self.config['primary'],
                                                          self.config['vmlinux'],
-                                                         filter = filter)))
+                                                         filter = filt)))

volatility/plugins/linux/pslist.py

@@ -20,13 +20,16 @@ class PsList(interfaces_plugins.PluginInterface):
 
     @classmethod
     def create_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]:
-        filter = lambda _: False
         # FIXME: mypy #4973 or #2608
         pid_list = pid_list or []
         filter_list = [x for x in pid_list if x is not None]
         if filter_list:
-            filter = lambda x: x not in filter_list
-        return filter
+            def filter_func(x):
+                return x not in filter_list
+
+            return filter_func
+        else:
+            return lambda _: False
 
     def _generator(self):
         for task in self.list_tasks(self.context,
@@ -54,7 +57,8 @@ class PsList(interfaces_plugins.PluginInterface):
         init_task = vmlinux.object(symbol_name = "init_task")
 
         for task in init_task.tasks:
-            yield task
+            if not filter(task):
+                yield task
 
     def run(self):
         return renderers.TreeGrid([("PID", int),

volatility/plugins/mac/pslist.py

@@ -9,6 +9,7 @@ from volatility.framework.objects import utility
 
 vollog = logging.getLogger(__name__)
 
+
 class PsList(interfaces_plugins.PluginInterface):
     """Lists the processes present in a particular mac memory image"""
 
@@ -35,7 +36,7 @@ class PsList(interfaces_plugins.PluginInterface):
                                     self.config['primary'],
                                     self.config['darwin'],
                                     filter = self.create_filter([self.config.get('pid', None)])):
-            pid  = task.p_pid
+            pid = task.p_pid
             ppid = task.p_ppid
             name = utility.array_to_string(task.p_comm)
             yield (0, (pid, ppid, name))
@@ -51,7 +52,7 @@ class PsList(interfaces_plugins.PluginInterface):
         """Lists all the tasks in the primary layer"""
 
         aslr_shift = mac.MacUtilities.find_aslr(context, mac_symbols, layer_name)
-        darwin  = context.module(mac_symbols, layer_name, aslr_shift)
+        darwin = context.module(mac_symbols, layer_name, aslr_shift)
         proc = darwin.object(symbol_name = "allproc").lh_first
 
         seen = {}
@@ -61,7 +62,7 @@ class PsList(interfaces_plugins.PluginInterface):
                 break
             else:
                 seen[proc.vol.offset] = 1
-           
+
             yield proc
 
             proc = proc.p_list.le_next.dereference()

volatility/plugins/timeliner.py

@@ -47,9 +47,15 @@ class Timeliner(interfaces.plugins.PluginInterface):
         plugin_list = list(framework.class_subclasses(TimeLinerInterface))
 
         # Get the filter from the configuration
-        filter_func = lambda _n, _s: True
+        def passthrough(_n, _s):
+            return True
+
+        filter_func = passthrough
         if selected_list:
-            filter_func = lambda name, selected: any([s in name for s in selected])
+            def filter_plugins(name, selected):
+                return any([s in name for s in selected])
+
+            filter_func = filter_plugins
 
         return [plugin_class for plugin_class in plugin_list if filter_func(plugin_class.__name__, selected_list)]
 
@@ -99,7 +105,6 @@ class Timeliner(interfaces.plugins.PluginInterface):
         # Use all the plugins if there's no filter
         self.usable_plugins = self.usable_plugins or self.get_usable_plugins()
         self.automagics = self.automagics or automagic.available(self._context)
-        sep = configuration.CONFIG_SEPARATOR
         runable_plugins = []
 
         # Identify plugins that we can run which output datetimes
@@ -114,7 +119,8 @@ class Timeliner(interfaces.plugins.PluginInterface):
                                             self._progress_callback,
                                             self._file_consumer)
 
-                runable_plugins.append(plugin)
+                if isinstance(plugin, TimeLinerInterface):
+                    runable_plugins.append(plugin)
             except exceptions.UnsatisfiedException as excp:
                 # Remove the failed plugin from the list and continue
                 vollog.debug("Unable to satisfy {}: {}".format(plugin_class.__name__, excp.unsatisfied))

volatility/plugins/windows/handles.py

@@ -204,7 +204,7 @@ class Handles(interfaces_plugins.PluginInterface):
                                 subtype = subtype, count = int(count))
 
         layer_object = self.context.memory[virtual]
-        masked_offset = layer_object._mask(offset, 0, layer_object._maxvirtaddr)
+        masked_offset = (offset & layer_object.maximum_address)
 
         for entry in table:
 
@@ -251,8 +251,8 @@ class Handles(interfaces_plugins.PluginInterface):
                                      layer_name = self.config["primary"],
                                      symbol_table = self.config["nt_symbols"])
         cookie = self.find_cookie(context = self.context,
-                                     layer_name = self.config["primary"],
-                                     symbol_table = self.config["nt_symbols"])
+                                  layer_name = self.config["primary"],
+                                  symbol_table = self.config["nt_symbols"])
 
         for proc in procs:
 

volatility/plugins/windows/info.py

@@ -40,6 +40,8 @@ class Info(plugins.PluginInterface):
 
         virtual_layer_name = self.config["primary"]
         virtual_layer = self.context.memory[virtual_layer_name]
+        if not isinstance(virtual_layer, layers.intel.Intel):
+            raise TypeError("Virtual Layer is not an intel layer")
 
         native_types = self.context.symbol_space[self.config["nt_symbols"]].natives
 

volatility/plugins/windows/poolscanner.py

@@ -2,6 +2,7 @@ import enum
 import logging
 from typing import Optional, Tuple, List, Generator
 
+import volatility.plugins.windows.handles as handles
 from volatility.framework import constants, interfaces, renderers, validity, exceptions, symbols
 from volatility.framework.configuration import requirements
 from volatility.framework.interfaces import plugins, configuration
@@ -9,7 +10,6 @@ from volatility.framework.layers import scanners
 from volatility.framework.renderers import format_hints
 from volatility.framework.symbols import intermed
 from volatility.framework.symbols.windows import extensions
-import volatility.plugins.windows.handles as handles
 
 vollog = logging.getLogger(__name__)
 

volatility/plugins/windows/pslist.py

@@ -2,7 +2,7 @@ import datetime
 from typing import Callable, Iterable, List
 
 import volatility.framework.interfaces.plugins as plugins
-from volatility.framework import renderers, interfaces
+from volatility.framework import renderers, interfaces, layers
 from volatility.framework.configuration import requirements
 from volatility.framework.renderers import format_hints
 from volatility.plugins import timeliner
@@ -84,6 +84,8 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
             else:
                 layer_name = self.config['primary']
                 memory = self.context.memory[layer_name]
+                if not isinstance(memory, layers.intel.Intel):
+                    raise TypeError("Primary layer is not an intel layer")
                 (_, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0]
 
             yield (0, (proc.UniqueProcessId,

volatility/plugins/windows/registry/printkey.py

@@ -6,7 +6,7 @@ import volatility.framework.interfaces.plugins as plugins
 from volatility.framework import objects, renderers, exceptions
 from volatility.framework.configuration import requirements
 from volatility.framework.layers.registry import RegistryHive
-from volatility.framework.renderers import TreeGrid, conversion
+from volatility.framework.renderers import TreeGrid, conversion, format_hints
 from volatility.framework.symbols.windows.extensions.registry import RegValueTypes
 
 vollog = logging.getLogger(__name__)
@@ -97,8 +97,8 @@ class PrintKey(plugins.PluginInterface):
             reg_config_path = self.make_subconfig(hive_offset = hive_offset,
                                                   base_layer = self.config['primary'],
                                                   nt_symbols = self.config['nt_symbols'])
+            hive = RegistryHive(self.context, reg_config_path, name = 'hive' + hex(hive_offset))
             try:
-                hive = RegistryHive(self.context, reg_config_path, name = 'hive' + hex(hive_offset))
                 self.context.memory.add_layer(hive)
 
                 # Walk it
@@ -116,7 +116,7 @@ class PrintKey(plugins.PluginInterface):
                     vollog.debug("Invalid address identified in Hive: {}".format(hex(excp.invalid_address)))
                 result = (0,
                           (renderers.UnreadableValue(),
-                           renderers.format_hints.Hex(hive.hive_offset),
+                           format_hints.Hex(hive.hive_offset),
                            "Key",
                            self.config.get('key', "ROOT"),
                            renderers.UnreadableValue(),
@@ -127,7 +127,7 @@ class PrintKey(plugins.PluginInterface):
     def run(self):
 
         return TreeGrid(columns = [('Last Write Time', datetime.datetime),
-                                   ('Hive Offset', renderers.format_hints.Hex),
+                                   ('Hive Offset', format_hints.Hex),
                                    ('Type', str),
                                    ('Key', str),
                                    ('Name', str),

volatility/plugins/windows/ssdt.py

@@ -69,10 +69,18 @@ class SSDT(plugins.PluginInterface):
         is_kernel_64 = symbols.symbol_table_is_64bit(self.context, self.config["nt_symbols"])
         if is_kernel_64:
             array_subtype = "long"
-            find_address = lambda func: kvo + service_table_address + (func >> 4)
+
+            def kvo_calulator(func):
+                return kvo + service_table_address + (func >> 4)
+
+            find_address = kvo_calulator
         else:
             array_subtype = "unsigned long"
-            find_address = lambda func: func
+
+            def passthrough(func):
+                return func
+
+            find_address = passthrough
 
         functions = ntkrnlmp.object(type_name = "array", offset = kvo + service_table_address,
                                     subtype = ntkrnlmp.get_type(array_subtype),

volatility/plugins/windows/vaddump.py

@@ -62,7 +62,7 @@ class VadDump(interfaces_plugins.PluginInterface):
 
                     self.produce_file(filedata)
                     result_text = "Stored {}".format(filedata.preferred_filename)
-                except Exception:
+                except exceptions.InvalidAddressException:
                     result_text = "Unable to dump {0:#x} - {1:#x}".format(vad.get_start(), vad.get_end())
 
                 yield (0, (proc.UniqueProcessId,

volatility/plugins/windows/vadinfo.py

@@ -76,9 +76,15 @@ class VadInfo(interfaces_plugins.PluginInterface):
 
     def _generator(self, procs):
 
-        filter_func = lambda _: False
+        def passthrough(_):
+            return False
+
+        filter_func = passthrough
         if self.config.get('address', None) is not None:
-            filter_func = lambda x: x.get_start() not in [self.config['address']]
+            def filter_function(x):
+                return x.get_start() not in [self.config['address']]
+
+            filter_func = filter_function
 
         for proc in procs:
             process_name = utility.array_to_string(proc.ImageFileName)

volatility/plugins/windows/verinfo.py

@@ -41,6 +41,7 @@ class VerInfo(interfaces_plugins.PluginInterface):
         """Get File and Product version information from PE files
 
         Args:
+            context: volatility context on which to operate
             pe_table_name: name of the PE table
             layer_name: name of the layer containing the PE file
             base_address: base address of the PE (where MZ is found)
@@ -69,7 +70,7 @@ class VerInfo(interfaces_plugins.PluginInterface):
 
         pe_data.close()
 
-        return (major, minor, product, build)
+        return major, minor, product, build
 
     def _generator(self,
                    procs: Generator[interfaces.objects.ObjectInterface, None, None],
@@ -80,7 +81,7 @@ class VerInfo(interfaces_plugins.PluginInterface):
         Args:
             procs: <generator> of processes
             mods: <generator> of modules
-            moddump_plugin: <moddump.ModDump>
+            session_layers: <generator> of layers in the session to be checked
         """
 
         pe_table_name = PEIntermedSymbols.create(self.context,