diff --git a/volatility/framework/plugins/linux/check_idt.py b/volatility/framework/plugins/linux/check_idt.py index ad3530c19..722b8c029 100644 --- a/volatility/framework/plugins/linux/check_idt.py +++ b/volatility/framework/plugins/linux/check_idt.py @@ -5,7 +5,7 @@ import logging from typing import List -from volatility.framework import interfaces, renderers, constants, contexts, exceptions, symbols +from volatility.framework import interfaces, renderers, contexts, symbols from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints from volatility.framework.symbols import linux @@ -25,7 +25,7 @@ class Check_idt(interfaces.plugins.PluginInterface): architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), - + requirements.VersionRequirement(name = 'linuxutils', component = linux.LinuxUtilities, version = (1, 0, 0)), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] @@ -34,8 +34,8 @@ class Check_idt(interfaces.plugins.PluginInterface): modules = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['vmlinux']) - handlers = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'], self.config['vmlinux'], modules) - + handlers = linux.LinuxUtilities.generate_kernel_handler_info(self.context, self.config['primary'], + self.config['vmlinux'], modules) is_32bit = not symbols.symbol_table_is_64bit(self.context, self.config["vmlinux"]) @@ -61,7 +61,8 @@ class Check_idt(interfaces.plugins.PluginInterface): addrs = vmlinux.object_from_symbol("idt_table") - table = vmlinux.object(object_type = 'array', offset = addrs.vol.offset, subtype = vmlinux.get_type(idt_type), count = idt_table_size) + table = vmlinux.object(object_type = 'array', offset = addrs.vol.offset, subtype = vmlinux.get_type(idt_type), + count = idt_table_size) for i in check_idxs: ent = table[i] @@ -86,8 +87,9 @@ class Check_idt(interfaces.plugins.PluginInterface): module_name, symbol_name = linux.LinuxUtilities.lookup_module_address(self.context, handlers, idt_addr) - yield(0, [format_hints.Hex(i), format_hints.Hex(idt_addr), module_name, symbol_name]) - + yield (0, [format_hints.Hex(i), format_hints.Hex(idt_addr), module_name, symbol_name]) def run(self): - return renderers.TreeGrid([("Index", format_hints.Hex), ("Address", format_hints.Hex), ("Module", str), ("Symbol", str)], self._generator()) + return renderers.TreeGrid( + [("Index", format_hints.Hex), ("Address", format_hints.Hex), ("Module", str), ("Symbol", str)], + self._generator()) diff --git a/volatility/framework/plugins/linux/keyboard_notifiers.py b/volatility/framework/plugins/linux/keyboard_notifiers.py index 5d7f2d3ac..d7cdb7cc7 100644 --- a/volatility/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility/framework/plugins/linux/keyboard_notifiers.py @@ -4,10 +4,10 @@ import logging -from volatility.framework import interfaces, renderers, constants, contexts, exceptions -from volatility.framework.symbols import linux +from volatility.framework import interfaces, renderers, contexts, exceptions from volatility.framework.configuration import requirements from volatility.framework.renderers import format_hints +from volatility.framework.symbols import linux from volatility.plugins.linux import lsmod vollog = logging.getLogger(__name__) @@ -23,7 +23,8 @@ class Keyboard_notifiers(interfaces.plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), - requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) + requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)), + requirements.VersionRequirement(name = 'linuxutils', component = linux.LinuxUtilities, version = (1, 0, 0)) ] def _generator(self): diff --git a/volatility/framework/plugins/linux/lsof.py b/volatility/framework/plugins/linux/lsof.py index f1b8d1c71..ad864435d 100644 --- a/volatility/framework/plugins/linux/lsof.py +++ b/volatility/framework/plugins/linux/lsof.py @@ -27,6 +27,7 @@ class Lsof(plugins.PluginInterface): architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), + requirements.VersionRequirement(name = 'linuxutils', component = linux.LinuxUtilities, version = (1, 0, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, diff --git a/volatility/framework/plugins/linux/tty_check.py b/volatility/framework/plugins/linux/tty_check.py index d07a78bab..d9caa45da 100644 --- a/volatility/framework/plugins/linux/tty_check.py +++ b/volatility/framework/plugins/linux/tty_check.py @@ -6,12 +6,12 @@ import logging from typing import List from volatility.framework import interfaces, renderers, exceptions, constants, contexts -from volatility.framework.symbols import linux from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins from volatility.framework.objects import utility -from volatility.plugins.linux import lsmod from volatility.framework.renderers import format_hints +from volatility.framework.symbols import linux +from volatility.plugins.linux import lsmod vollog = logging.getLogger(__name__) @@ -26,7 +26,8 @@ class tty_check(plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), - requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) + requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)), + requirements.VersionRequirement(name = 'linuxutils', component = linux.LinuxUtilities, version = (1, 0, 0)) ] def _generator(self): diff --git a/volatility/framework/plugins/mac/check_syscall.py b/volatility/framework/plugins/mac/check_syscall.py index 46dd1f736..4b5c7b375 100644 --- a/volatility/framework/plugins/mac/check_syscall.py +++ b/volatility/framework/plugins/mac/check_syscall.py @@ -25,6 +25,7 @@ class Check_syscall(plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), + requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] diff --git a/volatility/framework/plugins/mac/check_sysctl.py b/volatility/framework/plugins/mac/check_sysctl.py index ac3b102ec..c274efae0 100644 --- a/volatility/framework/plugins/mac/check_sysctl.py +++ b/volatility/framework/plugins/mac/check_sysctl.py @@ -27,6 +27,7 @@ class Check_sysctl(plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), + requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] diff --git a/volatility/framework/plugins/mac/check_trap_table.py b/volatility/framework/plugins/mac/check_trap_table.py index f6a8542c1..bd78db317 100644 --- a/volatility/framework/plugins/mac/check_trap_table.py +++ b/volatility/framework/plugins/mac/check_trap_table.py @@ -26,7 +26,8 @@ class Check_trap_table(plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), - requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) + requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)), + requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)), ] def _generator(self): diff --git a/volatility/framework/plugins/mac/ifconfig.py b/volatility/framework/plugins/mac/ifconfig.py index e972876dc..da2d83396 100644 --- a/volatility/framework/plugins/mac/ifconfig.py +++ b/volatility/framework/plugins/mac/ifconfig.py @@ -17,7 +17,8 @@ class Ifconfig(plugins.PluginInterface): requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), - requirements.SymbolTableRequirement(name = "darwin", description = "Linux kernel symbols") + requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), + requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)) ] def _generator(self): diff --git a/volatility/framework/plugins/mac/lsof.py b/volatility/framework/plugins/mac/lsof.py index 55a88d20f..1dfacd881 100644 --- a/volatility/framework/plugins/mac/lsof.py +++ b/volatility/framework/plugins/mac/lsof.py @@ -23,6 +23,7 @@ class Lsof(plugins.PluginInterface): description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel"), + requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', diff --git a/volatility/framework/plugins/mac/mount.py b/volatility/framework/plugins/mac/mount.py index 36b368cfe..d2025ef1f 100644 --- a/volatility/framework/plugins/mac/mount.py +++ b/volatility/framework/plugins/mac/mount.py @@ -10,6 +10,7 @@ from volatility.framework.objects import utility from volatility.framework.renderers import format_hints from volatility.framework.symbols import mac + class Mount(plugins.PluginInterface): """A module containing a collection of plugins that produce data typically foundin Mac's mount command""" @@ -22,6 +23,7 @@ class Mount(plugins.PluginInterface): requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), + requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols") ] @@ -43,13 +45,13 @@ class Mount(plugins.PluginInterface): for mount in mac.MacUtilities.walk_tailq(list_head, "mnt_list"): yield mount - + def _generator(self): for mount in self.list_mounts(self.context, self.config['primary'], self.config['darwin']): vfs = mount.mnt_vfsstat device_name = utility.array_to_string(vfs.f_mntonname) mount_point = utility.array_to_string(vfs.f_mntfromname) - mount_type = utility.array_to_string(vfs.f_fstypename) + mount_type = utility.array_to_string(vfs.f_fstypename) yield 0, (device_name, mount_point, mount_type) diff --git a/volatility/framework/plugins/mac/netstat.py b/volatility/framework/plugins/mac/netstat.py index b2e9b629e..5df103b34 100644 --- a/volatility/framework/plugins/mac/netstat.py +++ b/volatility/framework/plugins/mac/netstat.py @@ -27,6 +27,7 @@ class Netstat(plugins.PluginInterface): architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), + requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, diff --git a/volatility/framework/plugins/mac/timers.py b/volatility/framework/plugins/mac/timers.py index 9da84326a..863220156 100644 --- a/volatility/framework/plugins/mac/timers.py +++ b/volatility/framework/plugins/mac/timers.py @@ -25,6 +25,7 @@ class Timers(plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), + requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] diff --git a/volatility/framework/plugins/mac/trustedbsd.py b/volatility/framework/plugins/mac/trustedbsd.py index 23b43276f..149f41967 100644 --- a/volatility/framework/plugins/mac/trustedbsd.py +++ b/volatility/framework/plugins/mac/trustedbsd.py @@ -27,6 +27,7 @@ class Trustedbsd(plugins.PluginInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), + requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)), requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] diff --git a/volatility/framework/symbols/linux/__init__.py b/volatility/framework/symbols/linux/__init__.py index c8179b0f4..e79feb0e6 100644 --- a/volatility/framework/symbols/linux/__init__.py +++ b/volatility/framework/symbols/linux/__init__.py @@ -36,9 +36,11 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.set_type_class('mount', extensions.mount) -class LinuxUtilities(object): +class LinuxUtilities(interfaces.configuration.VersionableInterface): """Class with multiple useful linux functions.""" + _verison = (1, 0, 0) + # based on __d_path from the Linux kernel @classmethod def _do_get_path(cls, rdentry, rmnt, dentry, vfsmnt) -> str: diff --git a/volatility/framework/symbols/mac/__init__.py b/volatility/framework/symbols/mac/__init__.py index a089ade6a..2a9ace7e5 100644 --- a/volatility/framework/symbols/mac/__init__.py +++ b/volatility/framework/symbols/mac/__init__.py @@ -28,9 +28,11 @@ class MacKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.set_type_class('sysctl_oid', extensions.sysctl_oid) -class MacUtilities(object): +class MacUtilities(interfaces.configuration.VersionableInterface): """Class with multiple useful mac functions.""" + _version = (1, 0, 0) + @classmethod def mask_mods_list(cls, context: interfaces.context.ContextInterface, layer_name: str, mods: Iterator[Any]) -> List[Tuple[interfaces.objects.ObjectInterface, Any, Any]]: