WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 20:57:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix linting issues

Browse Source
This commit is contained in:
Eve
2022-12-21 06:42:02 +00:00
parent 92c7b3e550
commit a553a69efd
1 changed files with 22 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/linux/envars.py
+22 -10
View File
@@ -12,6 +12,7 @@ from volatility3.plugins.linux import pslist
vollog = logging.getLogger(__name__)
class Envars(plugins.PluginInterface):
"""Lists processes with their environment variables"""
@@ -51,7 +52,9 @@ class Envars(plugins.PluginInterface):
try:
ppid = task.parent.pid
except exceptions.InvalidAddressException:
vollog.debug(f"Unable to read parent pid for task {pid} {name}, setting ppid to 0.")
vollog.debug(
f"Unable to read parent pid for task {pid} {name}, setting ppid to 0."
)
ppid = 0
# kernel threads never have an mm as they do not have userland mappings
@@ -59,7 +62,9 @@ class Envars(plugins.PluginInterface):
mm = task.mm
except exceptions.InvalidAddressException:
# no mm so cannot get envars
vollog.debug(f"Unable to access mm for task {pid} {name} it is likely a kernel thread, will not extract any envars.")
vollog.debug(
f"Unable to access mm for task {pid} {name} it is likely a kernel thread, will not extract any envars."
)
mm = None
continue
@@ -69,31 +74,38 @@ class Envars(plugins.PluginInterface):
# get process layer to read envars from
proc_layer_name = task.add_process_layer()
if proc_layer_name is None:
vollog.debug(f"Unable to construct process layer for task {pid} {name}, will not extract any envars.")
vollog.debug(
f"Unable to construct process layer for task {pid} {name}, will not extract any envars."
)
continue
proc_layer = self.context.layers[proc_layer_name]
# get the size of the envars with sanity checking
envars_size = task.mm.env_end - task.mm.env_start
if not (0 < envars_size <= 8192):
vollog.debug(f"Task {pid} {name} appears to have envars of size {envars_size} bytes which fails the sanity checking, will not extract any envars.")
vollog.debug(
f"Task {pid} {name} appears to have envars of size {envars_size} bytes which fails the sanity checking, will not extract any envars."
)
continue
# attempt to read all envars data
try:
envar_data = proc_layer.read(task.mm.env_start, envars_size)
except exceptions.InvalidAddressException:
vollog.debug(f"Unable to read full envars for {pid} {name} starting at virtual offset {hex(task.mm.env_start)} for {envars_size} bytes, will not extract any envars.")
vollog.debug(
f"Unable to read full envars for {pid} {name} starting at virtual offset {hex(task.mm.env_start)} for {envars_size} bytes, will not extract any envars."
)
continue
# parse envar data, envars are null terminated, keys and values are separated by '='
envar_data = envar_data.rstrip(b'\x00')
for envar_pair in envar_data.split(b'\x00'):
envar_data = envar_data.rstrip(b"\x00")
for envar_pair in envar_data.split(b"\x00"):
try:
key, value = envar_pair.decode().split('=', 1)
key, value = envar_pair.decode().split("=", 1)
except ValueError:
vollog.debug(f"Unable to extract envars for {pid} {name} starting at virtual offset {hex(task.mm.env_start)}, they don't appear to be '=' separated")
vollog.debug(
f"Unable to extract envars for {pid} {name} starting at virtual offset {hex(task.mm.env_start)}, they don't appear to be '=' separated"
)
continue
yield (0, (pid, ppid, name, key, value))