From 9ac622afa017b02c91dc2161f26ee4439085ce76 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 1 Oct 2019 23:46:02 +0100 Subject: [PATCH] Fix up import style to be consistent. --- volatility/framework/interfaces/objects.py | 5 ++--- volatility/framework/interfaces/plugins.py | 12 +++++------- volatility/framework/interfaces/symbols.py | 6 +++--- volatility/framework/plugins/linux/malfind.py | 8 +++----- volatility/framework/plugins/linux/pslist.py | 3 +-- volatility/framework/plugins/mac/malfind.py | 16 ++++++++-------- volatility/framework/plugins/mac/proc_maps.py | 11 +++++------ .../framework/plugins/windows/callbacks.py | 3 +-- volatility/framework/plugins/windows/cmdline.py | 3 +-- volatility/framework/plugins/windows/dlldump.py | 8 +++----- volatility/framework/plugins/windows/dlllist.py | 3 +-- volatility/framework/plugins/windows/handles.py | 3 +-- volatility/framework/plugins/windows/procdump.py | 10 +++------- volatility/framework/plugins/windows/vaddump.py | 5 ++--- volatility/framework/plugins/windows/verinfo.py | 4 ++-- 15 files changed, 41 insertions(+), 59 deletions(-) diff --git a/volatility/framework/interfaces/objects.py b/volatility/framework/interfaces/objects.py index 194febde1..fbac76aa5 100644 --- a/volatility/framework/interfaces/objects.py +++ b/volatility/framework/interfaces/objects.py @@ -11,7 +11,6 @@ from abc import ABCMeta, abstractmethod from typing import Any, Dict, List, Mapping, Optional from volatility.framework import constants, interfaces -from volatility.framework.interfaces import context as interfaces_context vollog = logging.getLogger(__name__) @@ -87,7 +86,7 @@ class ObjectInterface(metaclass = ABCMeta): """A base object required to be the ancestor of every object used in volatility.""" - def __init__(self, context: 'interfaces_context.ContextInterface', type_name: str, object_info: 'ObjectInformation', + def __init__(self, context: 'interfaces.context.ContextInterface', type_name: str, object_info: 'ObjectInformation', **kwargs) -> None: """Constructs an Object adhering to the ObjectInterface. @@ -303,6 +302,6 @@ class Template: return self._vol[attr] raise AttributeError("{} object has no attribute {}".format(self.__class__.__name__, attr)) - def __call__(self, context: 'interfaces_context.ContextInterface', + def __call__(self, context: 'interfaces.context.ContextInterface', object_info: ObjectInformation) -> ObjectInterface: """Constructs the object.""" diff --git a/volatility/framework/interfaces/plugins.py b/volatility/framework/interfaces/plugins.py index 88e21638d..2692b9754 100644 --- a/volatility/framework/interfaces/plugins.py +++ b/volatility/framework/interfaces/plugins.py @@ -14,9 +14,7 @@ from abc import ABCMeta, abstractmethod from typing import List, Optional, Tuple from volatility import classproperty -from volatility.framework import exceptions, constants -from volatility.framework.interfaces import configuration as interfaces_configuration, \ - renderers as interfaces_renderers, context as interfaces_context +from volatility.framework import exceptions, constants, interfaces vollog = logging.getLogger(__name__) @@ -69,7 +67,7 @@ class FileConsumerInterface(object): # The plugin runs and produces a TreeGrid output -class PluginInterface(interfaces_configuration.ConfigurableInterface, metaclass = ABCMeta): +class PluginInterface(interfaces.configuration.ConfigurableInterface, metaclass = ABCMeta): """Class that defines the basic interface that all Plugins must maintain. The constructor must only take a `context` and `config_path`, so @@ -83,7 +81,7 @@ class PluginInterface(interfaces_configuration.ConfigurableInterface, metaclass """The _version variable is a quick way for plugins to define their current interface, it should follow SemVer rules""" def __init__(self, - context: interfaces_context.ContextInterface, + context: interfaces.context.ContextInterface, config_path: str, progress_callback: constants.ProgressCallback = None) -> None: """ @@ -128,12 +126,12 @@ class PluginInterface(interfaces_configuration.ConfigurableInterface, metaclass return cls._version @classmethod - def get_requirements(cls) -> List[interfaces_configuration.RequirementInterface]: + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: """Returns a list of Requirement objects for this plugin.""" return [] @abstractmethod - def run(self) -> interfaces_renderers.TreeGrid: + def run(self) -> interfaces.renderers.TreeGrid: """Executes the functionality of the code. .. note:: This method expects `self.validate` to have been called to ensure all necessary options have been provided diff --git a/volatility/framework/interfaces/symbols.py b/volatility/framework/interfaces/symbols.py index 95f238765..3224633fa 100644 --- a/volatility/framework/interfaces/symbols.py +++ b/volatility/framework/interfaces/symbols.py @@ -7,8 +7,8 @@ import collections.abc from abc import abstractmethod, ABC from typing import Any, Dict, Iterable, List, Optional, Tuple, Type -from volatility.framework import constants, exceptions -from volatility.framework.interfaces import configuration, objects, context as interfaces_context +from volatility.framework import constants, exceptions, interfaces +from volatility.framework.interfaces import configuration, objects class SymbolInterface: @@ -261,7 +261,7 @@ class SymbolTableInterface(BaseSymbolTableInterface, configuration.ConfigurableI # FIXME: native_types and table_mapping aren't recorded in the configuration def __init__(self, - context: 'interfaces_context.ContextInterface', + context: 'interfaces.context.ContextInterface', config_path: str, name: str, native_types: 'NativeTableInterface', diff --git a/volatility/framework/plugins/linux/malfind.py b/volatility/framework/plugins/linux/malfind.py index 72a8090fb..b16f30c59 100644 --- a/volatility/framework/plugins/linux/malfind.py +++ b/volatility/framework/plugins/linux/malfind.py @@ -4,8 +4,6 @@ from typing import List -import volatility.framework.interfaces.plugins as interfaces_plugins -import volatility.framework.interfaces.renderers as interfaces_renderers import volatility.plugins.linux.pslist as pslist from volatility.framework import constants, interfaces from volatility.framework import renderers @@ -14,7 +12,7 @@ from volatility.framework.objects import utility from volatility.framework.renderers import format_hints -class Malfind(interfaces_plugins.PluginInterface): +class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" @classmethod @@ -57,7 +55,7 @@ class Malfind(interfaces_plugins.PluginInterface): else: architecture = "intel64" - disasm = interfaces_renderers.Disassembly(data, vma.vm_start, architecture) + disasm = interfaces.renderers.Disassembly(data, vma.vm_start, architecture) yield (0, (task.pid, process_name, format_hints.Hex(vma.vm_start), format_hints.Hex(vma.vm_end), vma.get_protection(), format_hints.HexBytes(data), disasm)) @@ -67,7 +65,7 @@ class Malfind(interfaces_plugins.PluginInterface): return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), ("Protection", str), ("Hexdump", format_hints.HexBytes), - ("Disasm", interfaces_renderers.Disassembly)], + ("Disasm", interfaces.renderers.Disassembly)], self._generator( pslist.PsList.list_tasks(self.context, self.config['primary'], diff --git a/volatility/framework/plugins/linux/pslist.py b/volatility/framework/plugins/linux/pslist.py index 18e16cc3b..9040bb934 100644 --- a/volatility/framework/plugins/linux/pslist.py +++ b/volatility/framework/plugins/linux/pslist.py @@ -4,14 +4,13 @@ from typing import Callable, Iterable, List, Any -import volatility.framework.interfaces.plugins as interfaces_plugins from volatility.framework import renderers, interfaces, contexts from volatility.framework.automagic import linux from volatility.framework.configuration import requirements from volatility.framework.objects import utility -class PsList(interfaces_plugins.PluginInterface): +class PsList(interfaces.plugins.PluginInterface): """Lists the processes present in a particular linux memory image.""" _version = (1, 0, 0) diff --git a/volatility/framework/plugins/mac/malfind.py b/volatility/framework/plugins/mac/malfind.py index d32ae9398..d58589020 100644 --- a/volatility/framework/plugins/mac/malfind.py +++ b/volatility/framework/plugins/mac/malfind.py @@ -2,17 +2,17 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import volatility.framework.interfaces.plugins as interfaces_plugins -import volatility.framework.interfaces.renderers as interfaces_renderers import volatility.plugins.mac.tasks as tasks + from volatility.framework import constants +from volatility.framework import interfaces from volatility.framework import renderers from volatility.framework.configuration import requirements from volatility.framework.objects import utility from volatility.framework.renderers import format_hints -class Malfind(interfaces_plugins.PluginInterface): +class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" @classmethod @@ -55,7 +55,7 @@ class Malfind(interfaces_plugins.PluginInterface): else: architecture = "intel64" - disasm = interfaces_renderers.Disassembly(data, vma.links.start, architecture) + disasm = interfaces.renderers.Disassembly(data, vma.links.start, architecture) yield (0, (task.p_pid, process_name, format_hints.Hex(vma.links.start), format_hints.Hex(vma.links.end), vma.get_perms(), format_hints.HexBytes(data), disasm)) @@ -65,9 +65,9 @@ class Malfind(interfaces_plugins.PluginInterface): return renderers.TreeGrid([("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), ("Protection", str), ("Hexdump", format_hints.HexBytes), - ("Disasm", interfaces_renderers.Disassembly)], + ("Disasm", interfaces.renderers.Disassembly)], self._generator( tasks.Tasks.list_tasks(self.context, - self.config['primary'], - self.config['darwin'], - filter_func = filter_func))) + self.config['primary'], + self.config['darwin'], + filter_func = filter_func))) diff --git a/volatility/framework/plugins/mac/proc_maps.py b/volatility/framework/plugins/mac/proc_maps.py index 8a51fa447..232f7cc95 100644 --- a/volatility/framework/plugins/mac/proc_maps.py +++ b/volatility/framework/plugins/mac/proc_maps.py @@ -4,14 +4,13 @@ import volatility.plugins.mac.tasks as tasks -import volatility.framework.interfaces.plugins as interfaces_plugins -from volatility.framework import renderers +from volatility.framework import renderers, interfaces from volatility.framework.configuration import requirements from volatility.framework.objects import utility from volatility.framework.renderers import format_hints -class Maps(interfaces_plugins.PluginInterface): +class Maps(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" @classmethod @@ -44,6 +43,6 @@ class Maps(interfaces_plugins.PluginInterface): ("End", format_hints.Hex), ("Protection", str), ("Map Name", str)], self._generator( tasks.Tasks.list_tasks(self.context, - self.config['primary'], - self.config['darwin'], - filter_func = filter_func))) + self.config['primary'], + self.config['darwin'], + filter_func = filter_func))) diff --git a/volatility/framework/plugins/windows/callbacks.py b/volatility/framework/plugins/windows/callbacks.py index f24ed3631..1f8dc6d05 100644 --- a/volatility/framework/plugins/windows/callbacks.py +++ b/volatility/framework/plugins/windows/callbacks.py @@ -5,7 +5,6 @@ import logging from typing import List, Iterable, Tuple, Optional, Union -import volatility.framework.interfaces.plugins as interfaces_plugins from volatility.framework import constants, exceptions, renderers, interfaces, symbols from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints @@ -16,7 +15,7 @@ from volatility.plugins.windows import svcscan vollog = logging.getLogger(__name__) -class Callbacks(interfaces_plugins.PluginInterface): +class Callbacks(interfaces.plugins.PluginInterface): """Lists kernel callbacks and notification routines.""" _version = (1, 0, 0) diff --git a/volatility/framework/plugins/windows/cmdline.py b/volatility/framework/plugins/windows/cmdline.py index 3fbe54e1d..109a21d4b 100644 --- a/volatility/framework/plugins/windows/cmdline.py +++ b/volatility/framework/plugins/windows/cmdline.py @@ -4,14 +4,13 @@ from typing import List -import volatility.framework.interfaces.plugins as interfaces_plugins from volatility.framework import constants, exceptions, renderers, interfaces from volatility.framework.configuration import requirements from volatility.framework.objects import utility from volatility.plugins.windows import pslist -class CmdLine(interfaces_plugins.PluginInterface): +class CmdLine(interfaces.plugins.PluginInterface): """Lists process command line arguments.""" @classmethod diff --git a/volatility/framework/plugins/windows/dlldump.py b/volatility/framework/plugins/windows/dlldump.py index e2ffd8a75..870c4b01a 100644 --- a/volatility/framework/plugins/windows/dlldump.py +++ b/volatility/framework/plugins/windows/dlldump.py @@ -9,9 +9,7 @@ from typing import List import volatility.plugins.windows.pslist as pslist import volatility.plugins.windows.vadinfo as vadinfo -import volatility.framework.constants as constants -import volatility.framework.interfaces.plugins as interfaces_plugins -from volatility.framework import interfaces +from volatility.framework import interfaces, constants from volatility.framework import renderers from volatility.framework.configuration import requirements from volatility.framework.objects import utility @@ -21,7 +19,7 @@ from volatility.framework.symbols.windows import extensions vollog = logging.getLogger(__name__) -class DllDump(interfaces_plugins.PluginInterface): +class DllDump(interfaces.plugins.PluginInterface): """Dumps process memory ranges as DLLs.""" @classmethod @@ -80,7 +78,7 @@ class DllDump(interfaces_plugins.PluginInterface): continue try: - filedata = interfaces_plugins.FileInterface("pid.{0}.{1}.{2:#x}.dmp".format( + filedata = interfaces.plugins.FileInterface("pid.{0}.{1}.{2:#x}.dmp".format( proc.UniqueProcessId, ntpath.basename(vad.get_file_name()), vad.get_start())) dos_header = self.context.object(pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", diff --git a/volatility/framework/plugins/windows/dlllist.py b/volatility/framework/plugins/windows/dlllist.py index 97c577744..099be360d 100644 --- a/volatility/framework/plugins/windows/dlllist.py +++ b/volatility/framework/plugins/windows/dlllist.py @@ -4,14 +4,13 @@ from typing import List -import volatility.framework.interfaces.plugins as interfaces_plugins from volatility.framework import exceptions, renderers, interfaces from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints from volatility.plugins.windows import pslist -class DllList(interfaces_plugins.PluginInterface): +class DllList(interfaces.plugins.PluginInterface): """Lists the loaded modules in a particular windows memory image.""" @classmethod diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index d69c22ea7..e2d1ae161 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -7,7 +7,6 @@ from typing import List, Optional, Dict import volatility.plugins.windows.pslist as pslist -import volatility.framework.interfaces.plugins as interfaces_plugins from volatility.framework import constants, exceptions, renderers, interfaces from volatility.framework.configuration import requirements from volatility.framework.objects import utility @@ -23,7 +22,7 @@ except ImportError: has_capstone = False -class Handles(interfaces_plugins.PluginInterface): +class Handles(interfaces.plugins.PluginInterface): """Lists process open handles.""" def __init__(self, *args, **kwargs): diff --git a/volatility/framework/plugins/windows/procdump.py b/volatility/framework/plugins/windows/procdump.py index 000a9125b..76da1f17e 100644 --- a/volatility/framework/plugins/windows/procdump.py +++ b/volatility/framework/plugins/windows/procdump.py @@ -7,11 +7,7 @@ from typing import List import volatility.plugins.windows.pslist as pslist -import volatility.framework.constants as constants -import volatility.framework.exceptions as exceptions -import volatility.framework.interfaces.plugins as interfaces_plugins -import volatility.framework.renderers as renderers -from volatility.framework import interfaces +from volatility.framework import interfaces, exceptions, constants, renderers from volatility.framework.configuration import requirements from volatility.framework.objects import utility from volatility.framework.symbols import intermed @@ -20,7 +16,7 @@ from volatility.framework.symbols.windows.extensions import pe vollog = logging.getLogger(__name__) -class ProcDump(interfaces_plugins.PluginInterface): +class ProcDump(interfaces.plugins.PluginInterface): """Dumps process executable images.""" @classmethod @@ -58,7 +54,7 @@ class ProcDump(interfaces_plugins.PluginInterface): offset = peb.ImageBaseAddress, layer_name = proc_layer_name) - filedata = interfaces_plugins.FileInterface("pid.{0}.{1:#x}.dmp".format( + filedata = interfaces.plugins.FileInterface("pid.{0}.{1:#x}.dmp".format( proc.UniqueProcessId, peb.ImageBaseAddress)) for offset, data in dos_header.reconstruct(): diff --git a/volatility/framework/plugins/windows/vaddump.py b/volatility/framework/plugins/windows/vaddump.py index 61d74125c..ed36d44b7 100644 --- a/volatility/framework/plugins/windows/vaddump.py +++ b/volatility/framework/plugins/windows/vaddump.py @@ -8,7 +8,6 @@ from typing import List import volatility.plugins.windows.pslist as pslist import volatility.plugins.windows.vadinfo as vadinfo -import volatility.framework.interfaces.plugins as interfaces_plugins from volatility.framework import renderers, interfaces, exceptions from volatility.framework.configuration import requirements from volatility.framework.objects import utility @@ -16,7 +15,7 @@ from volatility.framework.objects import utility vollog = logging.getLogger(__name__) -class VadDump(interfaces_plugins.PluginInterface): +class VadDump(interfaces.plugins.PluginInterface): """Dumps process memory ranges.""" @classmethod @@ -54,7 +53,7 @@ class VadDump(interfaces_plugins.PluginInterface): for vad in vadinfo.VadInfo.list_vads(proc, filter_func = filter_func): try: - filedata = interfaces_plugins.FileInterface("pid.{0}.vad.{1:#x}-{2:#x}.dmp".format( + filedata = interfaces.plugins.FileInterface("pid.{0}.vad.{1:#x}-{2:#x}.dmp".format( proc.UniqueProcessId, vad.get_start(), vad.get_end())) offset = vad.get_start() diff --git a/volatility/framework/plugins/windows/verinfo.py b/volatility/framework/plugins/windows/verinfo.py index 329b20f31..de1e5ed54 100644 --- a/volatility/framework/plugins/windows/verinfo.py +++ b/volatility/framework/plugins/windows/verinfo.py @@ -6,9 +6,9 @@ import io import logging from typing import Generator, List, Tuple, Union -import volatility.framework.interfaces.plugins as interfaces_plugins import volatility.plugins.windows.moddump as moddump import volatility.plugins.windows.modules as modules + from volatility.framework import exceptions, renderers, constants, interfaces from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints @@ -25,7 +25,7 @@ except ImportError: raise -class VerInfo(interfaces_plugins.PluginInterface): +class VerInfo(interfaces.plugins.PluginInterface): """Lists version information from PE files.""" @classmethod