WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 21:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Documentation: minor fixes/updates

Browse Source
This commit is contained in:
Mike Auty
2023-07-01 17:01:33 +01:00
parent 5aa0a64cfa
commit a9698e4e73
4 changed files with 121 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/source/conf.py
+99 -45
View File
@@ -21,57 +21,72 @@ import sphinx.ext.apidoc
def setup(app):
volatility_directory = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..', 'volatility3'))
volatility_directory = os.path.abspath(
os.path.join(os.path.dirname(__file__), "..", "..", "volatility3")
)
source_dir = os.path.abspath(os.path.dirname(__file__))
sphinx.ext.apidoc.main(argv = ['-e', '-M', '-f', '-T', '-o', source_dir, volatility_directory])
sphinx.ext.apidoc.main(
argv=["-e", "-M", "-f", "-T", "-o", source_dir, volatility_directory]
)
# Go through the volatility3.framework.plugins files and change them to volatility3.plugins
for dir, _, files in os.walk(os.path.dirname(__file__)):
for filename in files:
if filename.startswith('volatility3.framework.plugins') and filename != 'volatility3.framework.plugins.rst':
if (
filename.startswith("volatility3.framework.plugins")
and filename != "volatility3.framework.plugins.rst"
):
# Change all volatility3.framework.plugins to volatility3.plugins in the file
# Rename the file
new_filename = filename.replace('volatility3.framework.plugins', 'volatility3.plugins')
new_filename = filename.replace(
"volatility3.framework.plugins", "volatility3.plugins"
)
replace_string = b"Submodules\n----------\n\n.. toctree::\n\n"
submodules = replace_string
# If file already exists, read out the subpackages entries from it add them to the new list
if os.path.exists(os.path.join(dir, new_filename)):
with open(os.path.join(dir, new_filename), 'rb') as newfile:
with open(os.path.join(dir, new_filename), "rb") as newfile:
data = newfile.read()
index = data.find(replace_string)
if index > -1:
submodules = data[index:]
with open(os.path.join(dir, new_filename), 'wb') as newfile:
with open(os.path.join(dir, new_filename), "wb") as newfile:
with open(os.path.join(dir, filename), "rb") as oldfile:
line = oldfile.read()
correct_plugins = line.replace(b'volatility3.framework.plugins', b'volatility3.plugins')
correct_submodules = correct_plugins.replace(replace_string, submodules)
correct_plugins = line.replace(
b"volatility3.framework.plugins", b"volatility3.plugins"
)
correct_submodules = correct_plugins.replace(
replace_string, submodules
)
newfile.write(correct_submodules)
os.remove(os.path.join(dir, filename))
elif filename == 'volatility3.framework.rst':
elif filename == "volatility3.framework.rst":
with open(os.path.join(dir, filename), "rb") as contents:
lines = contents.readlines()
plugins_seen = False
with open(os.path.join(dir, filename), "wb") as contents:
for line in lines:
if b'volatility3.framework.plugins' in line:
if b"volatility3.framework.plugins" in line:
plugins_seen = True
if plugins_seen and line == b'':
contents.write(b' volatility3.plugins')
if plugins_seen and line == b"":
contents.write(b" volatility3.plugins")
contents.write(line)
elif filename == 'volatility3.plugins.rst':
elif filename == "volatility3.plugins.rst":
with open(os.path.join(dir, filename), "rb") as contents:
lines = contents.readlines()
with open(os.path.join(dir, 'volatility3.framework.plugins.rst'), "rb") as contents:
with open(
os.path.join(dir, "volatility3.framework.plugins.rst"), "rb"
) as contents:
real_lines = contents.readlines()
# Process real_lines
for line_index in range(len(real_lines)):
if b'Submodules' in real_lines[line_index]:
if b"Submodules" in real_lines[line_index]:
break
else:
line_index = len(real_lines)
@@ -82,36 +97,52 @@ def setup(app):
for line in lines:
contents.write(line)
for line in submodule_lines:
contents.write(line.replace(b'volatility3.framework.plugins', b'volatility3.plugins'))
contents.write(
line.replace(
b"volatility3.framework.plugins", b"volatility3.plugins"
)
)
# Clear up the framework.plugins page
with open(os.path.join(os.path.dirname(__file__), 'volatility3.framework.plugins.rst'), "rb") as contents:
with open(
os.path.join(os.path.dirname(__file__), "volatility3.framework.plugins.rst"),
"rb",
) as contents:
real_lines = contents.readlines()
with open(os.path.join(os.path.dirname(__file__), 'volatility3.framework.plugins.rst'), "wb") as contents:
with open(
os.path.join(os.path.dirname(__file__), "volatility3.framework.plugins.rst"),
"wb",
) as contents:
for line in real_lines:
if b'volatility3.framework.plugins.' not in line:
if b"volatility3.framework.plugins." not in line:
contents.write(line)
# If extensions (or modules to document with autodoc) are in another directory,
# add these directories to sys.path here. If the directory is relative to the
# documentation root, use os.path.abspath to make it absolute, like shown here.
sys.path.insert(0, os.path.abspath('../..'))
sys.path.insert(0, os.path.abspath("../.."))
from volatility3.framework import constants
# -- General configuration ------------------------------------------------
# If your documentation needs a minimal Sphinx version, state it here.
needs_sphinx = '2.0'
needs_sphinx = "2.0"
# Add any Sphinx extension module names here, as strings. They can be
# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
# ones.
extensions = [
'sphinx.ext.autodoc', 'sphinx.ext.doctest', 'sphinx.ext.napoleon', 'sphinx.ext.intersphinx', 'sphinx.ext.todo',
'sphinx.ext.coverage', 'sphinx.ext.viewcode', 'sphinx.ext.autosectionlabel'
"sphinx.ext.autodoc",
"sphinx.ext.doctest",
"sphinx.ext.napoleon",
"sphinx.ext.intersphinx",
"sphinx.ext.todo",
"sphinx.ext.coverage",
"sphinx.ext.viewcode",
"sphinx.ext.autosectionlabel",
]
autosectionlabel_prefix_document = True
@@ -119,7 +150,7 @@ autosectionlabel_prefix_document = True
try:
import sphinx_autodoc_typehints
extensions.append('sphinx_autodoc_typehints')
extensions.append("sphinx_autodoc_typehints")
except ImportError:
# If the autodoc typehints extension isn't available, carry on regardless
pass
@@ -128,17 +159,17 @@ except ImportError:
# templates_path = ['tools/templates']
# The suffix of source filenames.
source_suffix = '.rst'
source_suffix = ".rst"
# The encoding of source files.
# source_encoding = 'utf-8-sig'
# The master toctree document.
master_doc = 'index'
master_doc = "index"
# General information about the project.
project = 'Volatility 3'
copyright = '2012-2022, Volatility Foundation'
project = "Volatility 3"
copyright = "2012-2022, Volatility Foundation"
# The version info for the project you're documenting, acts as replacement for
# |version| and |release|, also used in various other places throughout the
@@ -147,7 +178,7 @@ copyright = '2012-2022, Volatility Foundation'
# The full version, including alpha/beta/rc tags.
release = constants.PACKAGE_VERSION
# The short X.Y version.
version = ".".join(release.split('.')[0:2])
version = ".".join(release.split(".")[0:2])
# The language for content autogenerated by Sphinx. Refer to documentation
# for a list of supported languages.
@@ -180,7 +211,7 @@ add_module_names = False
# show_authors = False
# The name of the Pygments (syntax highlighting) style to use.
pygments_style = 'sphinx'
pygments_style = "sphinx"
# A list of ignored prefixes for module index sorting.
# modindex_common_prefix = []
@@ -196,8 +227,8 @@ pygments_style = 'sphinx'
# html_theme = 'pydoctheme'
# html_theme_options = {'collapsiblesidebar': True}
# html_theme_path = ['tools']
html_theme = 'sphinx_rtd_theme'
html_theme_options = {'logo_only': True}
html_theme = "sphinx_rtd_theme"
html_theme_options = {"logo_only": True}
# Theme options are theme-specific and customize the look and feel of a theme
# further. For a list of options available for each theme, see the
@@ -216,17 +247,17 @@ html_theme_options = {'logo_only': True}
# The name of an image file (relative to this directory) to place at the top
# of the sidebar.
html_logo = '_static/vol.png'
html_logo = "_static/vol.png"
# The name of an image file (within the static path) to use as favicon of the
# docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32
# pixels large.
html_favicon = '_static/favicon.ico'
html_favicon = "_static/favicon.ico"
# Add any paths that contain custom static files (such as style sheets) here,
# relative to this directory. They are copied after the builtin static files,
# so a file named "default.css" will overwrite the builtin "default.css".
html_static_path = ['_static']
html_static_path = ["_static"]
# Add any extra paths that contain custom files (such as robots.txt or
# .htaccess) here, relative to this directory. These files are copied
@@ -275,17 +306,15 @@ html_static_path = ['_static']
# html_file_suffix = None
# Output file base name for HTML help builder.
htmlhelp_basename = 'Volatilitydoc'
htmlhelp_basename = "Volatilitydoc"
# -- Options for LaTeX output ---------------------------------------------
latex_elements = {
# The paper size ('letterpaper' or 'a4paper').
# 'papersize': 'letterpaper',
# The font size ('10pt', '11pt' or '12pt').
# 'pointsize': '10pt',
# Additional stuff for the LaTeX preamble.
# 'preamble': '',
}
@@ -294,7 +323,13 @@ latex_elements = {
# (source start file, target name, title,
# author, documentclass [howto, manual, or own class]).
latex_documents = [
('index', 'Volatility.tex', 'Volatility 3 Documentation', 'Volatility Foundation', 'manual'),
(
"index",
"Volatility.tex",
"Volatility 3 Documentation",
"Volatility Foundation",
"manual",
),
]
# The name of an image file (relative to this directory) to place at the top of
@@ -321,7 +356,15 @@ latex_documents = [
# One entry per manual page. List of tuples
# (source start file, name, description, authors, manual section).
man_pages = [('vol-cli', 'volatility', 'Volatility 3 Documentation', ['Volatility Foundation'], 1)]
man_pages = [
(
"vol-cli",
"volatility",
"Volatility 3 Documentation",
["Volatility Foundation"],
1,
)
]
# If true, show URL addresses after external links.
# man_show_urls = False
@@ -332,8 +375,15 @@ man_pages = [('vol-cli', 'volatility', 'Volatility 3 Documentation', ['Volatilit
# (source start file, target name, title, author,
# dir menu entry, description, category)
texinfo_documents = [
('index', 'Volatility', 'Volatility 3 Documentation', 'Volatility Foundation', 'Volatility',
'Memory forensics framework.', 'Miscellaneous'),
(
"index",
"Volatility",
"Volatility 3 Documentation",
"Volatility Foundation",
"Volatility",
"Memory forensics framework.",
"Miscellaneous",
),
]
# Documents to append as an appendix to all manuals.
@@ -349,10 +399,14 @@ texinfo_documents = [
# texinfo_no_detailmenu = False
# Example configuration for intersphinx: refer to the Python standard library.
intersphinx_mapping = {'http://docs.python.org/': None}
intersphinx_mapping = {"python": ("http://docs.python.org/", None)}
# -- Autodoc options -------------------------------------------------------
# autodoc_member_order = 'groupwise'
autodoc_default_options = {'members': True, 'inherited-members': True, 'show-inheritance': True}
autoclass_content = 'both'
autodoc_default_options = {
"members": True,
"inherited-members": True,
"show-inheritance": True,
}
autoclass_content = "both"
doc/source/getting-started-mac-tutorial.rst
+4 -4
View File
@@ -78,10 +78,10 @@ Thanks go to `stuxnet <https://github.com/stuxnet999/>`_ for providing this memo
The above command helps us to find the memory dump's Darwin kernel version. Now using the above banner we can search for the needed ISF file.
If ISF file cannot be found then, follow the instructions on :ref:`getting-started-macos-tutorial:Procedure to create symbol tables for macOS`. After that, place the ISF file under the ``volatility3/symbols`` directory.
If ISF file cannot be found then, follow the instructions on :ref:`getting-started-mac-tutorial:Procedure to create symbol tables for macOS`. After that, place the ISF file under the ``volatility3/symbols`` directory.
mac.pslist
~~~~~~~~~~~~
~~~~~~~~~~
.. code-block:: shell-session
@@ -107,7 +107,7 @@ mac.pslist
``mac.pslist`` helps us to list the processes which are running, their PIDs and PPIDs.
mac.pstree
~~~~~~~~~~~~
~~~~~~~~~~
.. code-block:: shell-session
@@ -128,7 +128,7 @@ mac.pstree
``mac.pstree`` helps us to display the parent child relationships between processes.
mac.ifconfig
~~~~~~~~~~
~~~~~~~~~~~~
.. code-block:: shell-session
volatility3/framework/plugins/linux/sockstat.py
+2 -3
View File
@@ -83,7 +83,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface):
sock: Kernel generic `sock` object
Returns a tuple with:
sock: The respective kernel's *_sock object for that socket family
sock: The respective kernel's \*_sock object for that socket family
sock_stat: A tuple with the source and destination (address and port) along with its state string
socket_filter: A dictionary with information about the socket filter
"""
@@ -501,8 +501,7 @@ class Sockstat(plugins.PluginInterface):
family: Socket family string (AF_UNIX, AF_INET, etc)
sock_type: Socket type string (STREAM, DGRAM, etc)
protocol: Protocol string (UDP, TCP, etc)
sock_fields: A tuple with the *_sock object, the sock stats and the
extended info dictionary
sock_fields: A tuple with the \*_sock object, the sock stats and the extended info dictionary
"""
vmlinux = context.modules[symbol_table]
volatility3/framework/symbols/linux/extensions/__init__.py
+16 -16
View File
@@ -794,7 +794,7 @@ class mount(objects.StructType):
"""Gets the fs where we are mounted on
Returns:
A 'mount *'
A mount pointer
"""
return self.mnt_parent
@@ -802,7 +802,7 @@ class mount(objects.StructType):
"""Gets the dentry of the mountpoint
Returns:
A 'dentry *'
A dentry pointer
"""
return self.mnt_mountpoint
@@ -839,7 +839,7 @@ class mount(objects.StructType):
"""Returns the root of the mounted tree
Returns:
A 'dentry *'
A dentry pointer
"""
vfsmnt = self.get_vfsmnt_current()
dentry = vfsmnt.mnt_root
@@ -850,7 +850,7 @@ class mount(objects.StructType):
"""Returns the parent root of the mounted tree
Returns:
A 'dentry *'
A dentry pointer
"""
return self.get_mnt_parent().get_dentry_current()
@@ -970,17 +970,17 @@ class vfsmount(objects.StructType):
"""Helper to make sure it is comparing two pointers to 'vfsmount'.
Depending on the kernel version, the calling object (self) could be
a 'vfsmount *' (<3.3.8) or a 'vfsmount' (>=3.3.8). This way we trust
a 'vfsmount \*' (<3.3.8) or a 'vfsmount' (>=3.3.8). This way we trust
in the framework "auto" dereferencing ability to assure that when we
reach this point 'self' will be a 'vfsmount' already and self.vol.offset
a 'vfsmount *' and not a 'vfsmount **'. The argument must be a 'vfsmount *'.
a 'vfsmount \*' and not a 'vfsmount \*\*'. The argument must be a 'vfsmount \*'.
Typically, it's called from do_get_path().
Args:
vfsmount_ptr (vfsmount *): A pointer to a 'vfsmount'
vfsmount_ptr (vfsmount \*): A pointer to a 'vfsmount'
Raises:
exceptions.VolatilityException: If vfsmount_ptr is not a 'vfsmount *'
exceptions.VolatilityException: If vfsmount_ptr is not a 'vfsmount \*'
Returns:
bool: 'True' if the given argument points to the the same 'vfsmount'
@@ -1010,7 +1010,7 @@ class vfsmount(objects.StructType):
"""Returns the current fs where we are mounted on
Returns:
A 'vfsmount *'
A vfsmount pointer
"""
return self.get_mnt_parent()
@@ -1018,8 +1018,8 @@ class vfsmount(objects.StructType):
"""Gets the parent fs (vfsmount) to where it's mounted on
Returns:
For kernels < 3.3.8: A 'vfsmount *'
For kernels >= 3.3.8: A 'vfsmount'
For kernels < 3.3.8: A vfsmount pointer
For kernels >= 3.3.8: A vfsmount object
"""
if self._is_kernel_prior_to_struct_mount():
return self.get_mnt_parent()
@@ -1030,7 +1030,7 @@ class vfsmount(objects.StructType):
"""Returns the root of the mounted tree
Returns:
A 'dentry *'
A dentry pointer
"""
if self._is_kernel_prior_to_struct_mount():
return self.get_mnt_mountpoint()
@@ -1041,7 +1041,7 @@ class vfsmount(objects.StructType):
"""Returns the parent root of the mounted tree
Returns:
A 'dentry *'
A dentry pointer
"""
if self._is_kernel_prior_to_struct_mount():
return self.get_mnt_mountpoint()
@@ -1052,8 +1052,8 @@ class vfsmount(objects.StructType):
"""Gets the mnt_parent member.
Returns:
For kernels < 3.3.8: A 'vfsmount *'
For kernels >= 3.3.8: A 'mount *'
For kernels < 3.3.8: A vfsmount pointer
For kernels >= 3.3.8: A mount pointer
"""
if self._is_kernel_prior_to_struct_mount():
return self.mnt_parent
@@ -1064,7 +1064,7 @@ class vfsmount(objects.StructType):
"""Gets the dentry of the mountpoint
Returns:
A 'dentry *'
A dentry pointer
"""
if self.has_member("mnt_mountpoint"):
return self.mnt_mountpoint