From ae5375a622c82177f6b29adfb8b0f410ecb03059 Mon Sep 17 00:00:00 2001
From: Brandon Barnacle <bbarnacle@volexity.com>
Date: Wed, 17 Jan 2024 09:49:39 -0500
Subject: [PATCH] PR comment changes

Change the --regex flag to --filter. Add a check so that --filter
cannot be used with --physaddr or --virtaddr. Change
self.config["filter"] check to check if file_re has been set.
---
 .../framework/plugins/windows/dumpfiles.py    | 21 +++++++++++--------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py
index 4aef660da..8865007d8 100755
--- a/volatility3/framework/plugins/windows/dumpfiles.py
+++ b/volatility3/framework/plugins/windows/dumpfiles.py
@@ -55,11 +55,11 @@ class DumpFiles(interfaces.plugins.PluginInterface):
                 optional=True,
             ),
             requirements.StringRequirement(
-                name="regex", description="Dump files matching REGEX", optional=True
+                name="filter", description="Dump files matching regular expression FILTER", optional=True
             ),
             requirements.BooleanRequirement(
                 name="ignore-case",
-                description="Ignore case in pattern match",
+                description="Ignore case in filter match",
                 default=False,
                 optional=True,
             ),
@@ -218,11 +218,11 @@ class DumpFiles(interfaces.plugins.PluginInterface):
 
     def _generator(self, procs: List, offsets: List):
         kernel = self.context.modules[self.config["kernel"]]
-        if self.config["regex"]:
-            if self.config["ignore-case"]:
-                file_re = re.compile(self.config["regex"], re.I)
-            else:
-                file_re = re.compile(self.config["regex"])
+        file_re = None
+        if self.config["filter"]:
+            flags = re.I if self.config["ignore-case"] else 0
+            file_re = re.compile(self.config["filter"], flags)
+
 
         if procs:
             # The handles plugin doesn't expose any staticmethod/classmethod, and it also requires stashing
@@ -259,7 +259,7 @@ class DumpFiles(interfaces.plugins.PluginInterface):
                         if obj_type == "File":
                             file_obj = entry.Body.cast("_FILE_OBJECT")
 
-                            if self.config["regex"]:
+                            if file_re:
                                 name = file_obj.file_name_with_device()
                                 if isinstance(name, UnreadableValue):
                                     continue
@@ -295,7 +295,7 @@ class DumpFiles(interfaces.plugins.PluginInterface):
                         if not file_obj.is_valid():
                             continue
 
-                        if self.config["regex"]:
+                        if file_re:
                             name = file_obj.file_name_with_device()
                             if isinstance(name, UnreadableValue):
                                 continue
@@ -345,6 +345,9 @@ class DumpFiles(interfaces.plugins.PluginInterface):
         procs = list()
         kernel = self.context.modules[self.config["kernel"]]
 
+        if self.config["filter"] and (self.config["virtaddr"] or self.config["physaddr"]):
+            raise ValueError("Cannot use filter flag with an address flag")
+
         if self.config.get("virtaddr", None) is not None:
             offsets.append((self.config["virtaddr"], True))
         elif self.config.get("physaddr", None) is not None: