diff --git a/volatility/cli/text_renderer.py b/volatility/cli/text_renderer.py index bb666608a..438d71dd5 100644 --- a/volatility/cli/text_renderer.py +++ b/volatility/cli/text_renderer.py @@ -10,7 +10,6 @@ import sys from functools import wraps from typing import Any, List, Tuple, Dict -from volatility.framework.interfaces.renderers import Column from volatility.framework.renderers import format_hints vollog = logging.getLogger(__name__) @@ -242,7 +241,8 @@ class PrettyTextRenderer(CLIRenderer): tree_indent_column = ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(20)) max_column_widths = dict([(column.name, len(column.name)) for column in grid.columns]) - def visitor(node, accumulator: List[Tuple[int, Dict[Column, bytes]]]) -> List[Tuple[int, Dict[Column, bytes]]]: + def visitor(node, accumulator: List[Tuple[int, Dict[interfaces.renderers.Column, bytes]]] + ) -> List[Tuple[int, Dict[interfaces.renderers.Column, bytes]]]: # Nodes always have a path value, giving them a path_depth of at least 1, we use max just in case max_column_widths[tree_indent_column] = max(max_column_widths.get(tree_indent_column, 0), node.path_depth) line = {} @@ -256,7 +256,7 @@ class PrettyTextRenderer(CLIRenderer): accumulator.append((node.path_depth, line)) return accumulator - final_output = [] # type: List[Tuple[int, Dict[Column, bytes]]] + final_output = [] # type: List[Tuple[int, Dict[interfaces.renderers.Column, bytes]]] if not grid.populated: grid.populate(visitor, final_output) else: diff --git a/volatility/framework/configuration/requirements.py b/volatility/framework/configuration/requirements.py index ab970dd2d..20bb16336 100644 --- a/volatility/framework/configuration/requirements.py +++ b/volatility/framework/configuration/requirements.py @@ -13,34 +13,33 @@ import logging from typing import Any, ClassVar, List, Optional, Type, Dict, Tuple from volatility.framework import constants, interfaces -from volatility.framework.interfaces import configuration vollog = logging.getLogger(__name__) -class MultiRequirement(configuration.RequirementInterface): +class MultiRequirement(interfaces.configuration.RequirementInterface): """Class to hold multiple requirements. Technically the Interface could handle this, but it's an interface, so this is a concrete implementation. """ - def unsatisfied(self, context: configuration.ContextInterface, - config_path: str) -> Dict[str, configuration.RequirementInterface]: + def unsatisfied(self, context: interfaces.context.ContextInterface, + config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]: return self.unsatisfied_children(context, config_path) -class BooleanRequirement(configuration.SimpleTypeRequirement): +class BooleanRequirement(interfaces.configuration.SimpleTypeRequirement): """A requirement type that contains a boolean value.""" # Note, this must be a separate class in order to differentiate between Booleans and other instance requirements -class IntRequirement(configuration.SimpleTypeRequirement): +class IntRequirement(interfaces.configuration.SimpleTypeRequirement): """A requirement type that contains a single integer.""" instance_type = int # type: ClassVar[Type] -class StringRequirement(configuration.SimpleTypeRequirement): +class StringRequirement(interfaces.configuration.SimpleTypeRequirement): """A requirement type that contains a single unicode string.""" # TODO: Maybe add string length limits? instance_type = str # type: ClassVar[Type] @@ -52,12 +51,12 @@ class URIRequirement(StringRequirement): # TODO: Maybe a a check that to unsatisfied that the path really is a URL? -class BytesRequirement(configuration.SimpleTypeRequirement): +class BytesRequirement(interfaces.configuration.SimpleTypeRequirement): """A requirement type that contains a byte string.""" instance_type = bytes # type: ClassVar[Type] -class ListRequirement(configuration.RequirementInterface): +class ListRequirement(interfaces.configuration.RequirementInterface): """Allows for a list of a specific type of requirement (all of which must be met for this requirement to be met) to be specified. @@ -69,7 +68,7 @@ class ListRequirement(configuration.RequirementInterface): """ def __init__(self, - element_type: Type[configuration.SimpleTypes] = str, + element_type: Type[interfaces.configuration.SimpleTypes] = str, max_elements: Optional[int] = 0, min_elements: Optional[int] = None, *args, @@ -82,17 +81,17 @@ class ListRequirement(configuration.RequirementInterface): min_elements: The minimum number of acceptable elements this list can contain """ super().__init__(*args, **kwargs) - if not issubclass(element_type, configuration.BasicTypes): + if not issubclass(element_type, interfaces.configuration.BasicTypes): raise TypeError("ListRequirements can only be populated with simple InstanceRequirements") self.element_type = element_type # type: Type self.min_elements = min_elements or 0 # type: int self.max_elements = max_elements # type: Optional[int] def unsatisfied(self, context: interfaces.context.ContextInterface, - config_path: str) -> Dict[str, configuration.RequirementInterface]: + config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]: """Check the types on each of the returned values and their number and then call the element type's check for each one.""" - config_path = configuration.path_join(config_path, self.name) + config_path = interfaces.configuration.path_join(config_path, self.name) default = None value = self.config_value(context, config_path, default) if not value and self.min_elements > 0: @@ -117,7 +116,7 @@ class ListRequirement(configuration.RequirementInterface): return {} -class ChoiceRequirement(configuration.RequirementInterface): +class ChoiceRequirement(interfaces.configuration.RequirementInterface): """Allows one from a choice of strings.""" def __init__(self, choices: List[str], *args, **kwargs) -> None: @@ -132,10 +131,10 @@ class ChoiceRequirement(configuration.RequirementInterface): self.choices = choices def unsatisfied(self, context: interfaces.context.ContextInterface, - config_path: str) -> Dict[str, configuration.RequirementInterface]: + config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]: """Validates the provided value to ensure it is one of the available choices.""" - config_path = configuration.path_join(config_path, self.name) + config_path = interfaces.configuration.path_join(config_path, self.name) value = self.config_value(context, config_path) if value not in self.choices: vollog.log(constants.LOGLEVEL_V, "ValueError - Value is not within the set of available choices") @@ -143,24 +142,26 @@ class ChoiceRequirement(configuration.RequirementInterface): return {} -class ComplexListRequirement(MultiRequirement, configuration.ConfigurableRequirementInterface, metaclass = abc.ABCMeta): +class ComplexListRequirement(MultiRequirement, + interfaces.configuration.ConfigurableRequirementInterface, + metaclass = abc.ABCMeta): """Allows a variable length list of requirements.""" def unsatisfied(self, context: interfaces.context.ContextInterface, - config_path: str) -> Dict[str, configuration.RequirementInterface]: + config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]: """Validates the provided value to ensure it is one of the available choices.""" - config_path = configuration.path_join(config_path, self.name) + config_path = interfaces.configuration.path_join(config_path, self.name) ret_list = super().unsatisfied(context, config_path) if ret_list: return ret_list if (self.config_value(context, config_path, None) is None - or self.config_value(context, configuration.path_join(config_path, 'number_of_elements'))): + or self.config_value(context, interfaces.configuration.path_join(config_path, 'number_of_elements'))): return {config_path: self} return {} @classmethod - def get_requirements(cls) -> List[configuration.RequirementInterface]: + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # This is not optional for the stacker to run, so optional must be marked as False return [ IntRequirement("number_of_elements", @@ -174,20 +175,20 @@ class ComplexListRequirement(MultiRequirement, configuration.ConfigurableRequire from subrequirements.""" @abc.abstractmethod - def new_requirement(self, index) -> configuration.RequirementInterface: + def new_requirement(self, index) -> interfaces.configuration.RequirementInterface: """Builds a new requirement based on the specified index.""" def build_configuration(self, context: interfaces.context.ContextInterface, config_path: str, - _: Any) -> configuration.HierarchicalDict: - result = configuration.HierarchicalDict() - num_elem_config_path = configuration.path_join(config_path, self.name, 'number_of_elements') + _: Any) -> interfaces.configuration.HierarchicalDict: + result = interfaces.configuration.HierarchicalDict() + num_elem_config_path = interfaces.configuration.path_join(config_path, self.name, 'number_of_elements') num_elements = context.config.get(num_elem_config_path, None) if num_elements is not None: result["number_of_elements"] = num_elements for i in range(num_elements): req = self.new_requirement(i) self.add_requirement(req) - value_path = configuration.path_join(config_path, self.name, req.name) + value_path = interfaces.configuration.path_join(config_path, self.name, req.name) value = context.config.get(value_path, None) if value is not None: result.splice(req.name, context.layers[value].build_configuration()) @@ -201,8 +202,8 @@ class LayerListRequirement(ComplexListRequirement): def construct(self, context: interfaces.context.ContextInterface, config_path: str) -> None: """Method for constructing within the context any required elements from subrequirements.""" - new_config_path = configuration.path_join(config_path, self.name) - num_layers_path = configuration.path_join(new_config_path, "number_of_elements") + new_config_path = interfaces.configuration.path_join(config_path, self.name) + num_layers_path = interfaces.configuration.path_join(new_config_path, "number_of_elements") number_of_layers = context.config[num_layers_path] # Build all the layers that can be built @@ -211,22 +212,22 @@ class LayerListRequirement(ComplexListRequirement): if layer_req is not None and isinstance(layer_req, TranslationLayerRequirement): layer_req.construct(context, new_config_path) - def new_requirement(self, index) -> configuration.RequirementInterface: + def new_requirement(self, index) -> interfaces.configuration.RequirementInterface: """Constructs a new requirement based on the specified index.""" return TranslationLayerRequirement(name = self.name + str(index), description = "Layer for swap space", optional = False) -class TranslationLayerRequirement(configuration.ConstructableRequirementInterface, - configuration.ConfigurableRequirementInterface): +class TranslationLayerRequirement(interfaces.configuration.ConstructableRequirementInterface, + interfaces.configuration.ConfigurableRequirementInterface): """Class maintaining the limitations on what sort of translation layers are acceptable.""" def __init__(self, name: str, description: str = None, - default: configuration.ConfigSimpleType = None, + default: interfaces.configuration.ConfigSimpleType = None, optional: bool = False, oses: List = None, architectures: List = None) -> None: @@ -251,10 +252,10 @@ class TranslationLayerRequirement(configuration.ConstructableRequirementInterfac super().__init__(name, description, default, optional) def unsatisfied(self, context: interfaces.context.ContextInterface, - config_path: str) -> Dict[str, configuration.RequirementInterface]: + config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]: """Validate that the value is a valid layer name and that the layer adheres to the requirements.""" - config_path = configuration.path_join(config_path, self.name) + config_path = interfaces.configuration.path_join(config_path, self.name) value = self.config_value(context, config_path, None) if isinstance(value, str): if value not in context.layers: @@ -278,14 +279,14 @@ class TranslationLayerRequirement(configuration.ConstructableRequirementInterfac ### NOTE: This validate method has side effects (the dependencies can change)!!! - self._validate_class(context, configuration.parent_path(config_path)) + self._validate_class(context, interfaces.configuration.parent_path(config_path)) vollog.log(constants.LOGLEVEL_V, "IndexError - No configuration provided: {}".format(config_path)) return {config_path: self} def construct(self, context: interfaces.context.ContextInterface, config_path: str) -> None: """Constructs the appropriate layer and adds it based on the class parameter.""" - config_path = configuration.path_join(config_path, self.name) + config_path = interfaces.configuration.path_join(config_path, self.name) # Determine the layer name name = self.name @@ -308,22 +309,22 @@ class TranslationLayerRequirement(configuration.ConstructableRequirementInterfac return None def build_configuration(self, context: interfaces.context.ContextInterface, _: str, - value: Any) -> configuration.HierarchicalDict: + value: Any) -> interfaces.configuration.HierarchicalDict: """Builds the appropriate configuration for the specified requirement.""" return context.layers[value].build_configuration() -class SymbolTableRequirement(configuration.ConstructableRequirementInterface, - configuration.ConfigurableRequirementInterface): +class SymbolTableRequirement(interfaces.configuration.ConstructableRequirementInterface, + interfaces.configuration.ConfigurableRequirementInterface): """Class maintaining the limitations on what sort of symbol spaces are acceptable.""" def unsatisfied(self, context: interfaces.context.ContextInterface, - config_path: str) -> Dict[str, configuration.RequirementInterface]: + config_path: str) -> Dict[str, interfaces.configuration.RequirementInterface]: """Validate that the value is a valid within the symbol space of the provided context.""" - config_path = configuration.path_join(config_path, self.name) + config_path = interfaces.configuration.path_join(config_path, self.name) value = self.config_value(context, config_path, None) if not isinstance(value, str): vollog.log(constants.LOGLEVEL_V, @@ -339,7 +340,7 @@ class SymbolTableRequirement(configuration.ConstructableRequirementInterface, def construct(self, context: interfaces.context.ContextInterface, config_path: str) -> None: """Constructs the symbol space within the context based on the subrequirements.""" - config_path = configuration.path_join(config_path, self.name) + config_path = interfaces.configuration.path_join(config_path, self.name) # Determine the space name name = context.symbol_space.free_table_name(self.name) @@ -350,7 +351,7 @@ class SymbolTableRequirement(configuration.ConstructableRequirementInterface, return None # Fill out the parameter for class creation - if not isinstance(self.requirements["class"], configuration.ClassRequirement): + if not isinstance(self.requirements["class"], interfaces.configuration.ClassRequirement): raise ValueError("Class requirement is not of type ClassRequirement: {}".format( repr(self.requirements["class"]))) cls = self.requirements["class"].cls @@ -365,7 +366,7 @@ class SymbolTableRequirement(configuration.ConstructableRequirementInterface, return None def build_configuration(self, context: interfaces.context.ContextInterface, _: str, - value: Any) -> configuration.HierarchicalDict: + value: Any) -> interfaces.configuration.HierarchicalDict: """Builds the appropriate configuration for the specified requirement.""" return context.symbol_space[value].build_configuration() diff --git a/volatility/framework/interfaces/configuration.py b/volatility/framework/interfaces/configuration.py index 0a516b1f7..3a05795ab 100644 --- a/volatility/framework/interfaces/configuration.py +++ b/volatility/framework/interfaces/configuration.py @@ -26,7 +26,6 @@ from abc import ABCMeta, abstractmethod from typing import Any, ClassVar, Dict, Generator, List, Optional, Type, Union from volatility.framework import constants, interfaces -from volatility.framework.interfaces.context import ContextInterface CONFIG_SEPARATOR = "." """Use to specify the separator between configuration hierarchies""" @@ -342,7 +341,9 @@ class RequirementInterface(metaclass = ABCMeta): """Sets the optional value for a requirement.""" self._optional = bool(value) - def config_value(self, context: ContextInterface, config_path: str, + def config_value(self, + context: 'interfaces.context.ContextInterface', + config_path: str, default: ConfigSimpleType = None) -> ConfigSimpleType: """Returns the value for this Requirement from its config path. @@ -376,7 +377,8 @@ class RequirementInterface(metaclass = ABCMeta): """ del self._requirements[requirement.name] - def unsatisfied_children(self, context: ContextInterface, config_path: str) -> Dict[str, 'RequirementInterface']: + def unsatisfied_children(self, context: 'interfaces.context.ContextInterface', + config_path: str) -> Dict[str, 'RequirementInterface']: """Method that will validate all child requirements. Args: @@ -395,7 +397,8 @@ class RequirementInterface(metaclass = ABCMeta): # Validation routines @abstractmethod - def unsatisfied(self, context: ContextInterface, config_path: str) -> Dict[str, 'RequirementInterface']: + def unsatisfied(self, context: 'interfaces.context.ContextInterface', + config_path: str) -> Dict[str, 'RequirementInterface']: """Method to validate the value stored at config_path for the configuration object against a context. @@ -425,7 +428,8 @@ class SimpleTypeRequirement(RequirementInterface): children.""" raise TypeError("Instance Requirements cannot have subrequirements") - def unsatisfied(self, context: ContextInterface, config_path: str) -> Dict[str, RequirementInterface]: + def unsatisfied(self, context: 'interfaces.context.ContextInterface', + config_path: str) -> Dict[str, RequirementInterface]: """Validates the instance requirement based upon its `instance_type`.""" config_path = path_join(config_path, self.name) @@ -458,7 +462,8 @@ class ClassRequirement(RequirementInterface): class name.""" return self._cls - def unsatisfied(self, context: ContextInterface, config_path: str) -> Dict[str, RequirementInterface]: + def unsatisfied(self, context: 'interfaces.context.ContextInterface', + config_path: str) -> Dict[str, RequirementInterface]: """Checks to see if a class can be recovered.""" config_path = path_join(config_path, self.name) @@ -500,7 +505,7 @@ class ConstructableRequirementInterface(RequirementInterface): self._current_class_requirements = set() @abstractmethod - def construct(self, context: ContextInterface, config_path: str) -> None: + def construct(self, context: 'interfaces.context.ContextInterface', config_path: str) -> None: """Method for constructing within the context any required elements from subrequirements. @@ -509,7 +514,7 @@ class ConstructableRequirementInterface(RequirementInterface): config_path: The configuration path for the specific instance of this constructable """ - def _validate_class(self, context: ContextInterface, config_path: str) -> None: + def _validate_class(self, context: 'interfaces.context.ContextInterface', config_path: str) -> None: """Method to check if the class Requirement is valid and if so populate the other requirements (but no need to validate, since we're invalid already) @@ -532,7 +537,9 @@ class ConstructableRequirementInterface(RequirementInterface): self._current_class_requirements.add(requirement.name) self.add_requirement(requirement) - def _construct_class(self, context: ContextInterface, config_path: str, + def _construct_class(self, + context: 'interfaces.context.ContextInterface', + config_path: str, requirement_dict: Dict[str, object] = None) -> Optional['interfaces.objects.ObjectInterface']: """Constructs the class, handing args and the subrequirements as parameters to __init__""" @@ -563,7 +570,8 @@ class ConstructableRequirementInterface(RequirementInterface): class ConfigurableRequirementInterface(RequirementInterface): """Simple Abstract class to provide build_required_config.""" - def build_configuration(self, context: ContextInterface, config_path: str, value: Any) -> HierarchicalDict: + def build_configuration(self, context: 'interfaces.context.ContextInterface', config_path: str, + value: Any) -> HierarchicalDict: """Proxies to a ConfigurableInterface if necessary.""" @@ -571,7 +579,7 @@ class ConfigurableInterface(metaclass = ABCMeta): """Class to allow objects to have requirements and read configuration data from the context config tree.""" - def __init__(self, context: ContextInterface, config_path: str) -> None: + def __init__(self, context: 'interfaces.context.ContextInterface', config_path: str) -> None: """Basic initializer that allows configurables to access their own config settings.""" super().__init__() @@ -580,7 +588,7 @@ class ConfigurableInterface(metaclass = ABCMeta): self._config_cache = None # type: Optional[HierarchicalDict] @property - def context(self) -> ContextInterface: + def context(self) -> 'interfaces.context.ContextInterface': """The context object that this configurable belongs to/configuration is stored in.""" return self._context @@ -631,7 +639,8 @@ class ConfigurableInterface(metaclass = ABCMeta): return [] @classmethod - def unsatisfied(cls, context: ContextInterface, config_path: str) -> Dict[str, RequirementInterface]: + def unsatisfied(cls, context: 'interfaces.context.ContextInterface', + config_path: str) -> Dict[str, RequirementInterface]: """Returns a list of the names of all unsatisfied requirements. Since a satisfied set of requirements will return [], it can be used in tests as follows: @@ -650,7 +659,7 @@ class ConfigurableInterface(metaclass = ABCMeta): return result @classmethod - def make_subconfig(cls, context: interfaces.context.ContextInterface, base_config_path: str, **kwargs) -> str: + def make_subconfig(cls, context: 'interfaces.context.ContextInterface', base_config_path: str, **kwargs) -> str: """Convenience function to allow constructing a new randomly generated sub-configuration path, containing each element from kwargs. diff --git a/volatility/framework/layers/segmented.py b/volatility/framework/layers/segmented.py index 6f6429b0f..838dd19b7 100644 --- a/volatility/framework/layers/segmented.py +++ b/volatility/framework/layers/segmented.py @@ -1,7 +1,6 @@ # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import functools from abc import ABCMeta, abstractmethod from bisect import bisect_right from typing import Any, Dict, Iterable, List, Optional, Tuple @@ -19,7 +18,7 @@ class SegmentedLayer(linear.LinearlyMappedLayer, metaclass = ABCMeta): """ def __init__(self, - context: interfaces.configuration.ContextInterface, + context: interfaces.context.ContextInterface, config_path: str, name: str, metadata: Optional[Dict[str, Any]] = None) -> None: diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index 443a07ce9..13989f9b9 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -9,7 +9,6 @@ from collections import abc from typing import Any, ClassVar, Dict, List, Iterable, Optional, Tuple, Type, Union as TUnion, overload from volatility.framework import interfaces -from volatility.framework.interfaces.objects import ObjectInformation from volatility.framework.objects import templates, utility vollog = logging.getLogger(__name__) @@ -132,7 +131,7 @@ class PrimitiveObject(interfaces.objects.ObjectInterface): @classmethod def _unmarshall(cls, context: interfaces.context.ContextInterface, data_format: DataFormatInfo, - object_info: ObjectInformation) -> TUnion[int, float, bool, bytes, str]: + object_info: interfaces.objects.ObjectInformation) -> TUnion[int, float, bool, bytes, str]: data = context.layers.read(object_info.layer_name, object_info.offset, data_format.length) return convert_data_to_value(data, cls._struct_type, data_format) @@ -270,7 +269,7 @@ class Pointer(Integer): @classmethod def _unmarshall(cls, context: interfaces.context.ContextInterface, data_format: DataFormatInfo, - object_info: ObjectInformation) -> Any: + object_info: interfaces.objects.ObjectInformation) -> Any: """Ensure that pointer values always fall within the domain of the layer they're constructed on. @@ -560,10 +559,11 @@ class Array(interfaces.objects.ObjectInterface, abc.Sequence): return_list = False series = [series] for index in series: - object_info = ObjectInformation(layer_name = self.vol.layer_name, - offset = mask & (self.vol.offset + (self.vol.subtype.size * index)), - parent = self, - native_layer_name = self.vol.native_layer_name) + object_info = interfaces.objects.ObjectInformation( + layer_name = self.vol.layer_name, + offset = mask & (self.vol.offset + (self.vol.subtype.size * index)), + parent = self, + native_layer_name = self.vol.native_layer_name) result += [self.vol.subtype(context = self._context, object_info = object_info)] if not return_list: return result[0] diff --git a/volatility/framework/plugins/windows/driverirp.py b/volatility/framework/plugins/windows/driverirp.py index b51618bd5..a21d0d1e6 100644 --- a/volatility/framework/plugins/windows/driverirp.py +++ b/volatility/framework/plugins/windows/driverirp.py @@ -2,9 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import volatility.framework.interfaces.plugins as plugins from volatility.framework import constants -from volatility.framework import renderers, exceptions +from volatility.framework import renderers, exceptions, interfaces from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints from volatility.plugins.windows import ssdt, driverscan @@ -20,7 +19,7 @@ MAJOR_FUNCTIONS = [ ] -class DriverIrp(plugins.PluginInterface): +class DriverIrp(interfaces.plugins.PluginInterface): """List IRPs for drivers in a particular windows memory image.""" @classmethod diff --git a/volatility/framework/plugins/windows/driverscan.py b/volatility/framework/plugins/windows/driverscan.py index 710ae7cca..6470ebce6 100644 --- a/volatility/framework/plugins/windows/driverscan.py +++ b/volatility/framework/plugins/windows/driverscan.py @@ -6,13 +6,12 @@ from typing import Iterable import volatility.plugins.windows.poolscanner as poolscanner -import volatility.framework.interfaces.plugins as plugins from volatility.framework import renderers, interfaces, exceptions from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints -class DriverScan(plugins.PluginInterface): +class DriverScan(interfaces.plugins.PluginInterface): """Scans for drivers present in a particular windows memory image.""" _version = (1, 0, 0) diff --git a/volatility/framework/plugins/windows/filescan.py b/volatility/framework/plugins/windows/filescan.py index 73ba1b4fd..fd5f6f880 100644 --- a/volatility/framework/plugins/windows/filescan.py +++ b/volatility/framework/plugins/windows/filescan.py @@ -6,13 +6,12 @@ from typing import Iterable import volatility.plugins.windows.poolscanner as poolscanner -import volatility.framework.interfaces.plugins as plugins from volatility.framework import renderers, interfaces, exceptions from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints -class FileScan(plugins.PluginInterface): +class FileScan(interfaces.plugins.PluginInterface): """Scans for file objects present in a particular windows memory image.""" @classmethod diff --git a/volatility/framework/plugins/windows/modscan.py b/volatility/framework/plugins/windows/modscan.py index 35d6de968..d99538fe9 100644 --- a/volatility/framework/plugins/windows/modscan.py +++ b/volatility/framework/plugins/windows/modscan.py @@ -4,15 +4,13 @@ from typing import Iterable -import volatility.plugins.windows.poolscanner as poolscanner - -import volatility.framework.interfaces.plugins as plugins from volatility.framework import renderers, interfaces, exceptions from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints +from volatility.plugins.windows import poolscanner -class ModScan(plugins.PluginInterface): +class ModScan(interfaces.plugins.PluginInterface): """Scans for modules present in a particular windows memory image.""" @classmethod diff --git a/volatility/framework/plugins/windows/mutantscan.py b/volatility/framework/plugins/windows/mutantscan.py index 78a9e6d5d..9c19e6e87 100644 --- a/volatility/framework/plugins/windows/mutantscan.py +++ b/volatility/framework/plugins/windows/mutantscan.py @@ -6,13 +6,12 @@ from typing import Iterable import volatility.plugins.windows.poolscanner as poolscanner -import volatility.framework.interfaces.plugins as plugins from volatility.framework import renderers, interfaces, exceptions from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints -class MutantScan(plugins.PluginInterface): +class MutantScan(interfaces.plugins.PluginInterface): """Scans for mutexes present in a particular windows memory image.""" @classmethod diff --git a/volatility/framework/plugins/windows/pslist.py b/volatility/framework/plugins/windows/pslist.py index 11267151f..bc62b543b 100644 --- a/volatility/framework/plugins/windows/pslist.py +++ b/volatility/framework/plugins/windows/pslist.py @@ -5,7 +5,6 @@ import datetime from typing import Callable, Iterable, List -import volatility.framework.interfaces.plugins as plugins from volatility.framework import renderers, interfaces, layers from volatility.framework.configuration import requirements from volatility.framework.objects import utility @@ -13,7 +12,7 @@ from volatility.framework.renderers import format_hints from volatility.plugins import timeliner -class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): +class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the processes present in a particular windows memory image.""" _version = (1, 0, 0) diff --git a/volatility/framework/plugins/windows/psscan.py b/volatility/framework/plugins/windows/psscan.py index fdec44dd1..2a5cfe48c 100644 --- a/volatility/framework/plugins/windows/psscan.py +++ b/volatility/framework/plugins/windows/psscan.py @@ -5,15 +5,14 @@ import datetime from typing import Iterable -import volatility.framework.interfaces.plugins as plugins from volatility.framework import renderers, interfaces from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints from volatility.plugins import timeliner -import volatility.plugins.windows.poolscanner as poolscanner +from volatility.plugins.windows import poolscanner -class PsScan(plugins.PluginInterface, timeliner.TimeLinerInterface): +class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for processes present in a particular windows memory image.""" @classmethod diff --git a/volatility/framework/plugins/windows/registry/hivelist.py b/volatility/framework/plugins/windows/registry/hivelist.py index c46bc53c3..52ea1b34f 100644 --- a/volatility/framework/plugins/windows/registry/hivelist.py +++ b/volatility/framework/plugins/windows/registry/hivelist.py @@ -4,7 +4,6 @@ import logging from typing import Iterator, List, Tuple, Iterable, Optional -import volatility.framework.interfaces.plugins as plugins from volatility.framework import renderers, interfaces, exceptions from volatility.framework.configuration import requirements from volatility.framework.layers import registry @@ -13,7 +12,7 @@ from volatility.framework.renderers import format_hints vollog = logging.getLogger(__name__) -class HiveList(plugins.PluginInterface): +class HiveList(interfaces.plugins.PluginInterface): """Lists the registry hives present in a particular memory image.""" _version = (1, 0, 0) diff --git a/volatility/framework/plugins/windows/registry/hivescan.py b/volatility/framework/plugins/windows/registry/hivescan.py index 49cb3ce4d..f1de5f962 100644 --- a/volatility/framework/plugins/windows/registry/hivescan.py +++ b/volatility/framework/plugins/windows/registry/hivescan.py @@ -6,13 +6,12 @@ from typing import Iterable import volatility.plugins.windows.poolscanner as poolscanner -import volatility.framework.interfaces.plugins as plugins -from volatility.framework import renderers, interfaces, exceptions +from volatility.framework import renderers, interfaces from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints -class HiveScan(plugins.PluginInterface): +class HiveScan(interfaces.plugins.PluginInterface): """Scans for registry hives present in a particular windows memory image.""" diff --git a/volatility/framework/plugins/windows/symlinkscan.py b/volatility/framework/plugins/windows/symlinkscan.py index c597eb731..ee41f3d84 100644 --- a/volatility/framework/plugins/windows/symlinkscan.py +++ b/volatility/framework/plugins/windows/symlinkscan.py @@ -2,17 +2,17 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from typing import Iterable import datetime -import volatility.framework.interfaces.plugins as plugins -from volatility.framework import renderers, interfaces, exceptions +from typing import Iterable + +from volatility.framework import renderers, exceptions, interfaces from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints -import volatility.plugins.windows.poolscanner as poolscanner from volatility.plugins import timeliner +from volatility.plugins.windows import poolscanner -class SymlinkScan(plugins.PluginInterface, timeliner.TimeLinerInterface): +class SymlinkScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for links present in a particular windows memory image.""" @classmethod @@ -26,9 +26,9 @@ class SymlinkScan(plugins.PluginInterface, timeliner.TimeLinerInterface): @classmethod def scan_symlinks(cls, - context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str) -> \ + context: interfaces.context.ContextInterface, + layer_name: str, + symbol_table: str) -> \ Iterable[interfaces.objects.ObjectInterface]: """Scans for links using the poolscanner module and constraints.