WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 10:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ensure consistency of importing interfaces.

Browse Source
This commit is contained in:
Mike Auty
2019-10-02 01:18:46 +01:00
parent 8e10f4e3d1
commit 9a17beb77f
15 changed files with 100 additions and 101 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/cli/text_renderer.py
+3 -3
View File
@@ -10,7 +10,6 @@ import sys
from functools import wraps
from typing import Any, List, Tuple, Dict
from volatility.framework.interfaces.renderers import Column
from volatility.framework.renderers import format_hints
vollog = logging.getLogger(__name__)
@@ -242,7 +241,8 @@ class PrettyTextRenderer(CLIRenderer):
tree_indent_column = ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(20))
max_column_widths = dict([(column.name, len(column.name)) for column in grid.columns])
def visitor(node, accumulator: List[Tuple[int, Dict[Column, bytes]]]) -> List[Tuple[int, Dict[Column, bytes]]]:
def visitor(node, accumulator: List[Tuple[int, Dict[interfaces.renderers.Column, bytes]]]
) -> List[Tuple[int, Dict[interfaces.renderers.Column, bytes]]]:
# Nodes always have a path value, giving them a path_depth of at least 1, we use max just in case
max_column_widths[tree_indent_column] = max(max_column_widths.get(tree_indent_column, 0), node.path_depth)
line = {}
@@ -256,7 +256,7 @@ class PrettyTextRenderer(CLIRenderer):
accumulator.append((node.path_depth, line))
return accumulator
final_output = [] # type: List[Tuple[int, Dict[Column, bytes]]]
final_output = [] # type: List[Tuple[int, Dict[interfaces.renderers.Column, bytes]]]
if not grid.populated:
grid.populate(visitor, final_output)
else:
volatility/framework/configuration/requirements.py
+45 -44
View File
@@ -13,34 +13,33 @@ import logging
from typing import Any, ClassVar, List, Optional, Type, Dict, Tuple
from volatility.framework import constants, interfaces
from volatility.framework.interfaces import configuration
vollog = logging.getLogger(__name__)
class MultiRequirement(configuration.RequirementInterface):
class MultiRequirement(interfaces.configuration.RequirementInterface):
"""Class to hold multiple requirements.
Technically the Interface could handle this, but it's an interface,
so this is a concrete implementation.
"""
def unsatisfied(self, context: configuration.ContextInterface,
config_path: str) -> Dict[str, configuration.RequirementInterface]:
def unsatisfied(self, context: interfaces.context.ContextInterface,
config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]:
return self.unsatisfied_children(context, config_path)
class BooleanRequirement(configuration.SimpleTypeRequirement):
class BooleanRequirement(interfaces.configuration.SimpleTypeRequirement):
"""A requirement type that contains a boolean value."""
# Note, this must be a separate class in order to differentiate between Booleans and other instance requirements
class IntRequirement(configuration.SimpleTypeRequirement):
class IntRequirement(interfaces.configuration.SimpleTypeRequirement):
"""A requirement type that contains a single integer."""
instance_type = int # type: ClassVar[Type]
class StringRequirement(configuration.SimpleTypeRequirement):
class StringRequirement(interfaces.configuration.SimpleTypeRequirement):
"""A requirement type that contains a single unicode string."""
# TODO: Maybe add string length limits?
instance_type = str # type: ClassVar[Type]
@@ -52,12 +51,12 @@ class URIRequirement(StringRequirement):
# TODO: Maybe a a check that to unsatisfied that the path really is a URL?
class BytesRequirement(configuration.SimpleTypeRequirement):
class BytesRequirement(interfaces.configuration.SimpleTypeRequirement):
"""A requirement type that contains a byte string."""
instance_type = bytes # type: ClassVar[Type]
class ListRequirement(configuration.RequirementInterface):
class ListRequirement(interfaces.configuration.RequirementInterface):
"""Allows for a list of a specific type of requirement (all of which must
be met for this requirement to be met) to be specified.
@@ -69,7 +68,7 @@ class ListRequirement(configuration.RequirementInterface):
"""
def __init__(self,
element_type: Type[configuration.SimpleTypes] = str,
element_type: Type[interfaces.configuration.SimpleTypes] = str,
max_elements: Optional[int] = 0,
min_elements: Optional[int] = None,
*args,
@@ -82,17 +81,17 @@ class ListRequirement(configuration.RequirementInterface):
min_elements: The minimum number of acceptable elements this list can contain
"""
super().__init__(*args, **kwargs)
if not issubclass(element_type, configuration.BasicTypes):
if not issubclass(element_type, interfaces.configuration.BasicTypes):
raise TypeError("ListRequirements can only be populated with simple InstanceRequirements")
self.element_type = element_type # type: Type
self.min_elements = min_elements or 0 # type: int
self.max_elements = max_elements # type: Optional[int]
def unsatisfied(self, context: interfaces.context.ContextInterface,
config_path: str) -> Dict[str, configuration.RequirementInterface]:
config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]:
"""Check the types on each of the returned values and their number and
then call the element type's check for each one."""
config_path = configuration.path_join(config_path, self.name)
config_path = interfaces.configuration.path_join(config_path, self.name)
default = None
value = self.config_value(context, config_path, default)
if not value and self.min_elements > 0:
@@ -117,7 +116,7 @@ class ListRequirement(configuration.RequirementInterface):
return {}
class ChoiceRequirement(configuration.RequirementInterface):
class ChoiceRequirement(interfaces.configuration.RequirementInterface):
"""Allows one from a choice of strings."""
def __init__(self, choices: List[str], *args, **kwargs) -> None:
@@ -132,10 +131,10 @@ class ChoiceRequirement(configuration.RequirementInterface):
self.choices = choices
def unsatisfied(self, context: interfaces.context.ContextInterface,
config_path: str) -> Dict[str, configuration.RequirementInterface]:
config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]:
"""Validates the provided value to ensure it is one of the available
choices."""
config_path = configuration.path_join(config_path, self.name)
config_path = interfaces.configuration.path_join(config_path, self.name)
value = self.config_value(context, config_path)
if value not in self.choices:
vollog.log(constants.LOGLEVEL_V, "ValueError - Value is not within the set of available choices")
@@ -143,24 +142,26 @@ class ChoiceRequirement(configuration.RequirementInterface):
return {}
class ComplexListRequirement(MultiRequirement, configuration.ConfigurableRequirementInterface, metaclass = abc.ABCMeta):
class ComplexListRequirement(MultiRequirement,
interfaces.configuration.ConfigurableRequirementInterface,
metaclass = abc.ABCMeta):
"""Allows a variable length list of requirements."""
def unsatisfied(self, context: interfaces.context.ContextInterface,
config_path: str) -> Dict[str, configuration.RequirementInterface]:
config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]:
"""Validates the provided value to ensure it is one of the available
choices."""
config_path = configuration.path_join(config_path, self.name)
config_path = interfaces.configuration.path_join(config_path, self.name)
ret_list = super().unsatisfied(context, config_path)
if ret_list:
return ret_list
if (self.config_value(context, config_path, None) is None
or self.config_value(context, configuration.path_join(config_path, 'number_of_elements'))):
or self.config_value(context, interfaces.configuration.path_join(config_path, 'number_of_elements'))):
return {config_path: self}
return {}
@classmethod
def get_requirements(cls) -> List[configuration.RequirementInterface]:
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
# This is not optional for the stacker to run, so optional must be marked as False
return [
IntRequirement("number_of_elements",
@@ -174,20 +175,20 @@ class ComplexListRequirement(MultiRequirement, configuration.ConfigurableRequire
from subrequirements."""
@abc.abstractmethod
def new_requirement(self, index) -> configuration.RequirementInterface:
def new_requirement(self, index) -> interfaces.configuration.RequirementInterface:
"""Builds a new requirement based on the specified index."""
def build_configuration(self, context: interfaces.context.ContextInterface, config_path: str,
_: Any) -> configuration.HierarchicalDict:
result = configuration.HierarchicalDict()
num_elem_config_path = configuration.path_join(config_path, self.name, 'number_of_elements')
_: Any) -> interfaces.configuration.HierarchicalDict:
result = interfaces.configuration.HierarchicalDict()
num_elem_config_path = interfaces.configuration.path_join(config_path, self.name, 'number_of_elements')
num_elements = context.config.get(num_elem_config_path, None)
if num_elements is not None:
result["number_of_elements"] = num_elements
for i in range(num_elements):
req = self.new_requirement(i)
self.add_requirement(req)
value_path = configuration.path_join(config_path, self.name, req.name)
value_path = interfaces.configuration.path_join(config_path, self.name, req.name)
value = context.config.get(value_path, None)
if value is not None:
result.splice(req.name, context.layers[value].build_configuration())
@@ -201,8 +202,8 @@ class LayerListRequirement(ComplexListRequirement):
def construct(self, context: interfaces.context.ContextInterface, config_path: str) -> None:
"""Method for constructing within the context any required elements
from subrequirements."""
new_config_path = configuration.path_join(config_path, self.name)
num_layers_path = configuration.path_join(new_config_path, "number_of_elements")
new_config_path = interfaces.configuration.path_join(config_path, self.name)
num_layers_path = interfaces.configuration.path_join(new_config_path, "number_of_elements")
number_of_layers = context.config[num_layers_path]
# Build all the layers that can be built
@@ -211,22 +212,22 @@ class LayerListRequirement(ComplexListRequirement):
if layer_req is not None and isinstance(layer_req, TranslationLayerRequirement):
layer_req.construct(context, new_config_path)
def new_requirement(self, index) -> configuration.RequirementInterface:
def new_requirement(self, index) -> interfaces.configuration.RequirementInterface:
"""Constructs a new requirement based on the specified index."""
return TranslationLayerRequirement(name = self.name + str(index),
description = "Layer for swap space",
optional = False)
class TranslationLayerRequirement(configuration.ConstructableRequirementInterface,
configuration.ConfigurableRequirementInterface):
class TranslationLayerRequirement(interfaces.configuration.ConstructableRequirementInterface,
interfaces.configuration.ConfigurableRequirementInterface):
"""Class maintaining the limitations on what sort of translation layers are
acceptable."""
def __init__(self,
name: str,
description: str = None,
default: configuration.ConfigSimpleType = None,
default: interfaces.configuration.ConfigSimpleType = None,
optional: bool = False,
oses: List = None,
architectures: List = None) -> None:
@@ -251,10 +252,10 @@ class TranslationLayerRequirement(configuration.ConstructableRequirementInterfac
super().__init__(name, description, default, optional)
def unsatisfied(self, context: interfaces.context.ContextInterface,
config_path: str) -> Dict[str, configuration.RequirementInterface]:
config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]:
"""Validate that the value is a valid layer name and that the layer
adheres to the requirements."""
config_path = configuration.path_join(config_path, self.name)
config_path = interfaces.configuration.path_join(config_path, self.name)
value = self.config_value(context, config_path, None)
if isinstance(value, str):
if value not in context.layers:
@@ -278,14 +279,14 @@ class TranslationLayerRequirement(configuration.ConstructableRequirementInterfac
### NOTE: This validate method has side effects (the dependencies can change)!!!
self._validate_class(context, configuration.parent_path(config_path))
self._validate_class(context, interfaces.configuration.parent_path(config_path))
vollog.log(constants.LOGLEVEL_V, "IndexError - No configuration provided: {}".format(config_path))
return {config_path: self}
def construct(self, context: interfaces.context.ContextInterface, config_path: str) -> None:
"""Constructs the appropriate layer and adds it based on the class
parameter."""
config_path = configuration.path_join(config_path, self.name)
config_path = interfaces.configuration.path_join(config_path, self.name)
# Determine the layer name
name = self.name
@@ -308,22 +309,22 @@ class TranslationLayerRequirement(configuration.ConstructableRequirementInterfac
return None
def build_configuration(self, context: interfaces.context.ContextInterface, _: str,
value: Any) -> configuration.HierarchicalDict:
value: Any) -> interfaces.configuration.HierarchicalDict:
"""Builds the appropriate configuration for the specified
requirement."""
return context.layers[value].build_configuration()
class SymbolTableRequirement(configuration.ConstructableRequirementInterface,
configuration.ConfigurableRequirementInterface):
class SymbolTableRequirement(interfaces.configuration.ConstructableRequirementInterface,
interfaces.configuration.ConfigurableRequirementInterface):
"""Class maintaining the limitations on what sort of symbol spaces are
acceptable."""
def unsatisfied(self, context: interfaces.context.ContextInterface,
config_path: str) -> Dict[str, configuration.RequirementInterface]:
config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]:
"""Validate that the value is a valid within the symbol space of the
provided context."""
config_path = configuration.path_join(config_path, self.name)
config_path = interfaces.configuration.path_join(config_path, self.name)
value = self.config_value(context, config_path, None)
if not isinstance(value, str):
vollog.log(constants.LOGLEVEL_V,
@@ -339,7 +340,7 @@ class SymbolTableRequirement(configuration.ConstructableRequirementInterface,
def construct(self, context: interfaces.context.ContextInterface, config_path: str) -> None:
"""Constructs the symbol space within the context based on the
subrequirements."""
config_path = configuration.path_join(config_path, self.name)
config_path = interfaces.configuration.path_join(config_path, self.name)
# Determine the space name
name = context.symbol_space.free_table_name(self.name)
@@ -350,7 +351,7 @@ class SymbolTableRequirement(configuration.ConstructableRequirementInterface,
return None
# Fill out the parameter for class creation
if not isinstance(self.requirements["class"], configuration.ClassRequirement):
if not isinstance(self.requirements["class"], interfaces.configuration.ClassRequirement):
raise ValueError("Class requirement is not of type ClassRequirement: {}".format(
repr(self.requirements["class"])))
cls = self.requirements["class"].cls
@@ -365,7 +366,7 @@ class SymbolTableRequirement(configuration.ConstructableRequirementInterface,
return None
def build_configuration(self, context: interfaces.context.ContextInterface, _: str,
value: Any) -> configuration.HierarchicalDict:
value: Any) -> interfaces.configuration.HierarchicalDict:
"""Builds the appropriate configuration for the specified
requirement."""
return context.symbol_space[value].build_configuration()
volatility/framework/interfaces/configuration.py
+23 -14
View File
@@ -26,7 +26,6 @@ from abc import ABCMeta, abstractmethod
from typing import Any, ClassVar, Dict, Generator, List, Optional, Type, Union
from volatility.framework import constants, interfaces
from volatility.framework.interfaces.context import ContextInterface
CONFIG_SEPARATOR = "."
"""Use to specify the separator between configuration hierarchies"""
@@ -342,7 +341,9 @@ class RequirementInterface(metaclass = ABCMeta):
"""Sets the optional value for a requirement."""
self._optional = bool(value)
def config_value(self, context: ContextInterface, config_path: str,
def config_value(self,
context: 'interfaces.context.ContextInterface',
config_path: str,
default: ConfigSimpleType = None) -> ConfigSimpleType:
"""Returns the value for this Requirement from its config path.
@@ -376,7 +377,8 @@ class RequirementInterface(metaclass = ABCMeta):
"""
del self._requirements[requirement.name]
def unsatisfied_children(self, context: ContextInterface, config_path: str) -> Dict[str, 'RequirementInterface']:
def unsatisfied_children(self, context: 'interfaces.context.ContextInterface',
config_path: str) -> Dict[str, 'RequirementInterface']:
"""Method that will validate all child requirements.
Args:
@@ -395,7 +397,8 @@ class RequirementInterface(metaclass = ABCMeta):
# Validation routines
@abstractmethod
def unsatisfied(self, context: ContextInterface, config_path: str) -> Dict[str, 'RequirementInterface']:
def unsatisfied(self, context: 'interfaces.context.ContextInterface',
config_path: str) -> Dict[str, 'RequirementInterface']:
"""Method to validate the value stored at config_path for the
configuration object against a context.
@@ -425,7 +428,8 @@ class SimpleTypeRequirement(RequirementInterface):
children."""
raise TypeError("Instance Requirements cannot have subrequirements")
def unsatisfied(self, context: ContextInterface, config_path: str) -> Dict[str, RequirementInterface]:
def unsatisfied(self, context: 'interfaces.context.ContextInterface',
config_path: str) -> Dict[str, RequirementInterface]:
"""Validates the instance requirement based upon its
`instance_type`."""
config_path = path_join(config_path, self.name)
@@ -458,7 +462,8 @@ class ClassRequirement(RequirementInterface):
class name."""
return self._cls
def unsatisfied(self, context: ContextInterface, config_path: str) -> Dict[str, RequirementInterface]:
def unsatisfied(self, context: 'interfaces.context.ContextInterface',
config_path: str) -> Dict[str, RequirementInterface]:
"""Checks to see if a class can be recovered."""
config_path = path_join(config_path, self.name)
@@ -500,7 +505,7 @@ class ConstructableRequirementInterface(RequirementInterface):
self._current_class_requirements = set()
@abstractmethod
def construct(self, context: ContextInterface, config_path: str) -> None:
def construct(self, context: 'interfaces.context.ContextInterface', config_path: str) -> None:
"""Method for constructing within the context any required elements
from subrequirements.
@@ -509,7 +514,7 @@ class ConstructableRequirementInterface(RequirementInterface):
config_path: The configuration path for the specific instance of this constructable
"""
def _validate_class(self, context: ContextInterface, config_path: str) -> None:
def _validate_class(self, context: 'interfaces.context.ContextInterface', config_path: str) -> None:
"""Method to check if the class Requirement is valid and if so populate
the other requirements (but no need to validate, since we're invalid
already)
@@ -532,7 +537,9 @@ class ConstructableRequirementInterface(RequirementInterface):
self._current_class_requirements.add(requirement.name)
self.add_requirement(requirement)
def _construct_class(self, context: ContextInterface, config_path: str,
def _construct_class(self,
context: 'interfaces.context.ContextInterface',
config_path: str,
requirement_dict: Dict[str, object] = None) -> Optional['interfaces.objects.ObjectInterface']:
"""Constructs the class, handing args and the subrequirements as
parameters to __init__"""
@@ -563,7 +570,8 @@ class ConstructableRequirementInterface(RequirementInterface):
class ConfigurableRequirementInterface(RequirementInterface):
"""Simple Abstract class to provide build_required_config."""
def build_configuration(self, context: ContextInterface, config_path: str, value: Any) -> HierarchicalDict:
def build_configuration(self, context: 'interfaces.context.ContextInterface', config_path: str,
value: Any) -> HierarchicalDict:
"""Proxies to a ConfigurableInterface if necessary."""
@@ -571,7 +579,7 @@ class ConfigurableInterface(metaclass = ABCMeta):
"""Class to allow objects to have requirements and read configuration data
from the context config tree."""
def __init__(self, context: ContextInterface, config_path: str) -> None:
def __init__(self, context: 'interfaces.context.ContextInterface', config_path: str) -> None:
"""Basic initializer that allows configurables to access their own
config settings."""
super().__init__()
@@ -580,7 +588,7 @@ class ConfigurableInterface(metaclass = ABCMeta):
self._config_cache = None # type: Optional[HierarchicalDict]
@property
def context(self) -> ContextInterface:
def context(self) -> 'interfaces.context.ContextInterface':
"""The context object that this configurable belongs to/configuration
is stored in."""
return self._context
@@ -631,7 +639,8 @@ class ConfigurableInterface(metaclass = ABCMeta):
return []
@classmethod
def unsatisfied(cls, context: ContextInterface, config_path: str) -> Dict[str, RequirementInterface]:
def unsatisfied(cls, context: 'interfaces.context.ContextInterface',
config_path: str) -> Dict[str, RequirementInterface]:
"""Returns a list of the names of all unsatisfied requirements.
Since a satisfied set of requirements will return [], it can be used in tests as follows:
@@ -650,7 +659,7 @@ class ConfigurableInterface(metaclass = ABCMeta):
return result
@classmethod
def make_subconfig(cls, context: interfaces.context.ContextInterface, base_config_path: str, **kwargs) -> str:
def make_subconfig(cls, context: 'interfaces.context.ContextInterface', base_config_path: str, **kwargs) -> str:
"""Convenience function to allow constructing a new randomly generated
sub-configuration path, containing each element from kwargs.
volatility/framework/layers/segmented.py
+1 -2
View File
@@ -1,7 +1,6 @@
# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
import functools
from abc import ABCMeta, abstractmethod
from bisect import bisect_right
from typing import Any, Dict, Iterable, List, Optional, Tuple
@@ -19,7 +18,7 @@ class SegmentedLayer(linear.LinearlyMappedLayer, metaclass = ABCMeta):
"""
def __init__(self,
context: interfaces.configuration.ContextInterface,
context: interfaces.context.ContextInterface,
config_path: str,
name: str,
metadata: Optional[Dict[str, Any]] = None) -> None:
volatility/framework/objects/__init__.py
+7 -7
View File
@@ -9,7 +9,6 @@ from collections import abc
from typing import Any, ClassVar, Dict, List, Iterable, Optional, Tuple, Type, Union as TUnion, overload
from volatility.framework import interfaces
from volatility.framework.interfaces.objects import ObjectInformation
from volatility.framework.objects import templates, utility
vollog = logging.getLogger(__name__)
@@ -132,7 +131,7 @@ class PrimitiveObject(interfaces.objects.ObjectInterface):
@classmethod
def _unmarshall(cls, context: interfaces.context.ContextInterface, data_format: DataFormatInfo,
object_info: ObjectInformation) -> TUnion[int, float, bool, bytes, str]:
object_info: interfaces.objects.ObjectInformation) -> TUnion[int, float, bool, bytes, str]:
data = context.layers.read(object_info.layer_name, object_info.offset, data_format.length)
return convert_data_to_value(data, cls._struct_type, data_format)
@@ -270,7 +269,7 @@ class Pointer(Integer):
@classmethod
def _unmarshall(cls, context: interfaces.context.ContextInterface, data_format: DataFormatInfo,
object_info: ObjectInformation) -> Any:
object_info: interfaces.objects.ObjectInformation) -> Any:
"""Ensure that pointer values always fall within the domain of the
layer they're constructed on.
@@ -560,10 +559,11 @@ class Array(interfaces.objects.ObjectInterface, abc.Sequence):
return_list = False
series = [series]
for index in series:
object_info = ObjectInformation(layer_name = self.vol.layer_name,
offset = mask & (self.vol.offset + (self.vol.subtype.size * index)),
parent = self,
native_layer_name = self.vol.native_layer_name)
object_info = interfaces.objects.ObjectInformation(
layer_name = self.vol.layer_name,
offset = mask & (self.vol.offset + (self.vol.subtype.size * index)),
parent = self,
native_layer_name = self.vol.native_layer_name)
result += [self.vol.subtype(context = self._context, object_info = object_info)]
if not return_list:
return result[0]
volatility/framework/plugins/windows/driverirp.py
+2 -3
View File
@@ -2,9 +2,8 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
import volatility.framework.interfaces.plugins as plugins
from volatility.framework import constants
from volatility.framework import renderers, exceptions
from volatility.framework import renderers, exceptions, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
from volatility.plugins.windows import ssdt, driverscan
@@ -20,7 +19,7 @@ MAJOR_FUNCTIONS = [
]
class DriverIrp(plugins.PluginInterface):
class DriverIrp(interfaces.plugins.PluginInterface):
"""List IRPs for drivers in a particular windows memory image."""
@classmethod
volatility/framework/plugins/windows/driverscan.py
+1 -2
View File
@@ -6,13 +6,12 @@ from typing import Iterable
import volatility.plugins.windows.poolscanner as poolscanner
import volatility.framework.interfaces.plugins as plugins
from volatility.framework import renderers, interfaces, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
class DriverScan(plugins.PluginInterface):
class DriverScan(interfaces.plugins.PluginInterface):
"""Scans for drivers present in a particular windows memory image."""
_version = (1, 0, 0)
volatility/framework/plugins/windows/filescan.py
+1 -2
View File
@@ -6,13 +6,12 @@ from typing import Iterable
import volatility.plugins.windows.poolscanner as poolscanner
import volatility.framework.interfaces.plugins as plugins
from volatility.framework import renderers, interfaces, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
class FileScan(plugins.PluginInterface):
class FileScan(interfaces.plugins.PluginInterface):
"""Scans for file objects present in a particular windows memory image."""
@classmethod
volatility/framework/plugins/windows/modscan.py
+2 -4
View File
@@ -4,15 +4,13 @@
from typing import Iterable
import volatility.plugins.windows.poolscanner as poolscanner
import volatility.framework.interfaces.plugins as plugins
from volatility.framework import renderers, interfaces, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
from volatility.plugins.windows import poolscanner
class ModScan(plugins.PluginInterface):
class ModScan(interfaces.plugins.PluginInterface):
"""Scans for modules present in a particular windows memory image."""
@classmethod
volatility/framework/plugins/windows/mutantscan.py
+1 -2
View File
@@ -6,13 +6,12 @@ from typing import Iterable
import volatility.plugins.windows.poolscanner as poolscanner
import volatility.framework.interfaces.plugins as plugins
from volatility.framework import renderers, interfaces, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
class MutantScan(plugins.PluginInterface):
class MutantScan(interfaces.plugins.PluginInterface):
"""Scans for mutexes present in a particular windows memory image."""
@classmethod
volatility/framework/plugins/windows/pslist.py
+1 -2
View File
@@ -5,7 +5,6 @@
import datetime
from typing import Callable, Iterable, List
import volatility.framework.interfaces.plugins as plugins
from volatility.framework import renderers, interfaces, layers
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
@@ -13,7 +12,7 @@ from volatility.framework.renderers import format_hints
from volatility.plugins import timeliner
class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface):
class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
"""Lists the processes present in a particular windows memory image."""
_version = (1, 0, 0)
volatility/framework/plugins/windows/psscan.py
+2 -3
View File
@@ -5,15 +5,14 @@
import datetime
from typing import Iterable
import volatility.framework.interfaces.plugins as plugins
from volatility.framework import renderers, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
from volatility.plugins import timeliner
import volatility.plugins.windows.poolscanner as poolscanner
from volatility.plugins.windows import poolscanner
class PsScan(plugins.PluginInterface, timeliner.TimeLinerInterface):
class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
"""Scans for processes present in a particular windows memory image."""
@classmethod
volatility/framework/plugins/windows/registry/hivelist.py
+1 -2
View File
@@ -4,7 +4,6 @@
import logging
from typing import Iterator, List, Tuple, Iterable, Optional
import volatility.framework.interfaces.plugins as plugins
from volatility.framework import renderers, interfaces, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.layers import registry
@@ -13,7 +12,7 @@ from volatility.framework.renderers import format_hints
vollog = logging.getLogger(__name__)
class HiveList(plugins.PluginInterface):
class HiveList(interfaces.plugins.PluginInterface):
"""Lists the registry hives present in a particular memory image."""
_version = (1, 0, 0)
volatility/framework/plugins/windows/registry/hivescan.py
+2 -3
View File
@@ -6,13 +6,12 @@ from typing import Iterable
import volatility.plugins.windows.poolscanner as poolscanner
import volatility.framework.interfaces.plugins as plugins
from volatility.framework import renderers, interfaces, exceptions
from volatility.framework import renderers, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
class HiveScan(plugins.PluginInterface):
class HiveScan(interfaces.plugins.PluginInterface):
"""Scans for registry hives present in a particular windows memory
image."""
volatility/framework/plugins/windows/symlinkscan.py
+8 -8
View File
@@ -2,17 +2,17 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
from typing import Iterable
import datetime
import volatility.framework.interfaces.plugins as plugins
from volatility.framework import renderers, interfaces, exceptions
from typing import Iterable
from volatility.framework import renderers, exceptions, interfaces
from volatility.framework.configuration import requirements
from volatility.framework.renderers import format_hints
import volatility.plugins.windows.poolscanner as poolscanner
from volatility.plugins import timeliner
from volatility.plugins.windows import poolscanner
class SymlinkScan(plugins.PluginInterface, timeliner.TimeLinerInterface):
class SymlinkScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
"""Scans for links present in a particular windows memory image."""
@classmethod
@@ -26,9 +26,9 @@ class SymlinkScan(plugins.PluginInterface, timeliner.TimeLinerInterface):
@classmethod
def scan_symlinks(cls,
context: interfaces.context.ContextInterface,
layer_name: str,
symbol_table: str) -> \
context: interfaces.context.ContextInterface,
layer_name: str,
symbol_table: str) -> \
Iterable[interfaces.objects.ObjectInterface]:
"""Scans for links using the poolscanner module and constraints.