Numerous pycharm warnings resolved

This includes:

* Better ways of checking empty lists
* Not shadowing builtin functions like filter
* Preventing invalid slash warnings by marking strings as regexps
* Removing unnecessary brackets
* Lowercase variable names
* Adding/updating parameters in docstrings
* Removing unused code (lines not chunks)
* Change in not a member tests
* Changing some methods to static
* Shorting range membership checks
* Missing parameters
* Make some exception handlers more specific
* Don't define a lambda to a variable
* A few more instance checks to help type checkers

volatility/plugins/windows/handles.py

@@ -204,7 +204,7 @@ class Handles(interfaces_plugins.PluginInterface):
                                 subtype = subtype, count = int(count))
 
         layer_object = self.context.memory[virtual]
-        masked_offset = layer_object._mask(offset, 0, layer_object._maxvirtaddr)
+        masked_offset = (offset & layer_object.maximum_address)
 
         for entry in table:
 
@@ -251,8 +251,8 @@ class Handles(interfaces_plugins.PluginInterface):
                                      layer_name = self.config["primary"],
                                      symbol_table = self.config["nt_symbols"])
         cookie = self.find_cookie(context = self.context,
-                                     layer_name = self.config["primary"],
-                                     symbol_table = self.config["nt_symbols"])
+                                  layer_name = self.config["primary"],
+                                  symbol_table = self.config["nt_symbols"])
 
         for proc in procs:
 

volatility/plugins/windows/info.py

@@ -40,6 +40,8 @@ class Info(plugins.PluginInterface):
 
         virtual_layer_name = self.config["primary"]
         virtual_layer = self.context.memory[virtual_layer_name]
+        if not isinstance(virtual_layer, layers.intel.Intel):
+            raise TypeError("Virtual Layer is not an intel layer")
 
         native_types = self.context.symbol_space[self.config["nt_symbols"]].natives
 

volatility/plugins/windows/poolscanner.py

@@ -2,6 +2,7 @@ import enum
 import logging
 from typing import Optional, Tuple, List, Generator
 
+import volatility.plugins.windows.handles as handles
 from volatility.framework import constants, interfaces, renderers, validity, exceptions, symbols
 from volatility.framework.configuration import requirements
 from volatility.framework.interfaces import plugins, configuration
@@ -9,7 +10,6 @@ from volatility.framework.layers import scanners
 from volatility.framework.renderers import format_hints
 from volatility.framework.symbols import intermed
 from volatility.framework.symbols.windows import extensions
-import volatility.plugins.windows.handles as handles
 
 vollog = logging.getLogger(__name__)
 

volatility/plugins/windows/pslist.py

@@ -2,7 +2,7 @@ import datetime
 from typing import Callable, Iterable, List
 
 import volatility.framework.interfaces.plugins as plugins
-from volatility.framework import renderers, interfaces
+from volatility.framework import renderers, interfaces, layers
 from volatility.framework.configuration import requirements
 from volatility.framework.renderers import format_hints
 from volatility.plugins import timeliner
@@ -84,6 +84,8 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
             else:
                 layer_name = self.config['primary']
                 memory = self.context.memory[layer_name]
+                if not isinstance(memory, layers.intel.Intel):
+                    raise TypeError("Primary layer is not an intel layer")
                 (_, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0]
 
             yield (0, (proc.UniqueProcessId,

volatility/plugins/windows/registry/printkey.py

@@ -6,7 +6,7 @@ import volatility.framework.interfaces.plugins as plugins
 from volatility.framework import objects, renderers, exceptions
 from volatility.framework.configuration import requirements
 from volatility.framework.layers.registry import RegistryHive
-from volatility.framework.renderers import TreeGrid, conversion
+from volatility.framework.renderers import TreeGrid, conversion, format_hints
 from volatility.framework.symbols.windows.extensions.registry import RegValueTypes
 
 vollog = logging.getLogger(__name__)
@@ -97,8 +97,8 @@ class PrintKey(plugins.PluginInterface):
             reg_config_path = self.make_subconfig(hive_offset = hive_offset,
                                                   base_layer = self.config['primary'],
                                                   nt_symbols = self.config['nt_symbols'])
+            hive = RegistryHive(self.context, reg_config_path, name = 'hive' + hex(hive_offset))
             try:
-                hive = RegistryHive(self.context, reg_config_path, name = 'hive' + hex(hive_offset))
                 self.context.memory.add_layer(hive)
 
                 # Walk it
@@ -116,7 +116,7 @@ class PrintKey(plugins.PluginInterface):
                     vollog.debug("Invalid address identified in Hive: {}".format(hex(excp.invalid_address)))
                 result = (0,
                           (renderers.UnreadableValue(),
-                           renderers.format_hints.Hex(hive.hive_offset),
+                           format_hints.Hex(hive.hive_offset),
                            "Key",
                            self.config.get('key', "ROOT"),
                            renderers.UnreadableValue(),
@@ -127,7 +127,7 @@ class PrintKey(plugins.PluginInterface):
     def run(self):
 
         return TreeGrid(columns = [('Last Write Time', datetime.datetime),
-                                   ('Hive Offset', renderers.format_hints.Hex),
+                                   ('Hive Offset', format_hints.Hex),
                                    ('Type', str),
                                    ('Key', str),
                                    ('Name', str),

volatility/plugins/windows/ssdt.py

@@ -69,10 +69,18 @@ class SSDT(plugins.PluginInterface):
         is_kernel_64 = symbols.symbol_table_is_64bit(self.context, self.config["nt_symbols"])
         if is_kernel_64:
             array_subtype = "long"
-            find_address = lambda func: kvo + service_table_address + (func >> 4)
+
+            def kvo_calulator(func):
+                return kvo + service_table_address + (func >> 4)
+
+            find_address = kvo_calulator
         else:
             array_subtype = "unsigned long"
-            find_address = lambda func: func
+
+            def passthrough(func):
+                return func
+
+            find_address = passthrough
 
         functions = ntkrnlmp.object(type_name = "array", offset = kvo + service_table_address,
                                     subtype = ntkrnlmp.get_type(array_subtype),

volatility/plugins/windows/vaddump.py

@@ -62,7 +62,7 @@ class VadDump(interfaces_plugins.PluginInterface):
 
                     self.produce_file(filedata)
                     result_text = "Stored {}".format(filedata.preferred_filename)
-                except Exception:
+                except exceptions.InvalidAddressException:
                     result_text = "Unable to dump {0:#x} - {1:#x}".format(vad.get_start(), vad.get_end())
 
                 yield (0, (proc.UniqueProcessId,

volatility/plugins/windows/vadinfo.py

@@ -76,9 +76,15 @@ class VadInfo(interfaces_plugins.PluginInterface):
 
     def _generator(self, procs):
 
-        filter_func = lambda _: False
+        def passthrough(_):
+            return False
+
+        filter_func = passthrough
         if self.config.get('address', None) is not None:
-            filter_func = lambda x: x.get_start() not in [self.config['address']]
+            def filter_function(x):
+                return x.get_start() not in [self.config['address']]
+
+            filter_func = filter_function
 
         for proc in procs:
             process_name = utility.array_to_string(proc.ImageFileName)

volatility/plugins/windows/verinfo.py

@@ -41,6 +41,7 @@ class VerInfo(interfaces_plugins.PluginInterface):
         """Get File and Product version information from PE files
 
         Args:
+            context: volatility context on which to operate
             pe_table_name: name of the PE table
             layer_name: name of the layer containing the PE file
             base_address: base address of the PE (where MZ is found)
@@ -69,7 +70,7 @@ class VerInfo(interfaces_plugins.PluginInterface):
 
         pe_data.close()
 
-        return (major, minor, product, build)
+        return major, minor, product, build
 
     def _generator(self,
                    procs: Generator[interfaces.objects.ObjectInterface, None, None],
@@ -80,7 +81,7 @@ class VerInfo(interfaces_plugins.PluginInterface):
         Args:
             procs: <generator> of processes
             mods: <generator> of modules
-            moddump_plugin: <moddump.ModDump>
+            session_layers: <generator> of layers in the session to be checked
         """
 
         pe_table_name = PEIntermedSymbols.create(self.context,