Packaging: Refactor JSON data handling

This changes the way that JSON resources required for plugins are
handled within the volatility3 package. Instead of operating directly on
paths, it uses Python's builtin `importlib.resources` module to identify
a data directory with JSON files as a resource location. This greatly
simplifies how resources are found within the plugins.

References:

https://docs.python.org/3/library/importlib.resources.html#module-importlib.resources
This commit is contained in:
David McDonald
2025-03-14 22:32:39 -05:00
parent 023fdfd293
commit aedacea603
5 changed files with 14 additions and 58 deletions
View File
@@ -4,11 +4,11 @@
import hashlib
import json
import logging
import os
import struct
from importlib import resources
from typing import List
from volatility3.framework import renderers, interfaces, constants, exceptions
from volatility3.framework import renderers, interfaces, exceptions
from volatility3.framework.configuration import requirements
from volatility3.framework.layers import registry
from volatility3.plugins.windows.registry import hivelist
@@ -39,24 +39,9 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface):
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
# Find the sids json path (or raise error if its not in the plugin directory).
for plugin_dir in constants.PLUGINS_PATH:
sids_json_file_name = os.path.join(
plugin_dir, os.path.join("windows", "sids_and_privileges.json")
)
if os.path.exists(sids_json_file_name):
break
else:
vollog.log(
constants.LOGLEVEL_VVV,
"sids_and_privileges.json file is missing plugin error",
)
raise RuntimeError(
"The sids_and_privileges.json file missed from you plugin directory"
)
# Get service sids dictionary (we need only the service sids).
with open(sids_json_file_name) as file_handle:
with resources.open_text(
"volatility3.data", "sids_and_privileges.json"
) as file_handle:
self.servicesids = json.load(file_handle)["service sids"]
@classmethod
@@ -4,16 +4,15 @@
import json
import logging
import ntpath
import os
import re
from typing import List, Dict, Union
from importlib import resources
from volatility3.framework import (
renderers,
interfaces,
objects,
exceptions,
constants,
layers,
)
from volatility3.framework.configuration import requirements
@@ -42,23 +41,10 @@ class GetSIDs(interfaces.plugins.PluginInterface):
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
for plugin_dir in constants.PLUGINS_PATH:
sids_json_file_name = os.path.join(
plugin_dir, os.path.join("windows", "sids_and_privileges.json")
)
if os.path.exists(sids_json_file_name):
break
else:
vollog.log(
constants.LOGLEVEL_VVV,
"sids_and_privileges.json file is missing plugin error",
)
raise RuntimeError(
"The sids_and_privileges.json file missed from you plugin directory"
)
# Get all the sids from the json file.
with open(sids_json_file_name) as file_handle:
with resources.open_text(
"volatility3.data", "sids_and_privileges.json"
) as file_handle:
sids_json_data = json.load(file_handle)
self.servicesids = sids_json_data["service sids"]
self.well_known_sids = sids_json_data["well known"]
@@ -3,10 +3,10 @@
import json
import logging
import os
from importlib import resources
from typing import List
from volatility3.framework import renderers, interfaces, objects, exceptions, constants
from volatility3.framework import constants, exceptions, interfaces, objects, renderers
from volatility3.framework.configuration import requirements
from volatility3.plugins.windows import pslist
@@ -22,24 +22,9 @@ class Privs(interfaces.plugins.PluginInterface):
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
# Find the sids json path (or raise error if its not in the plugin directory).
for plugin_dir in constants.PLUGINS_PATH:
sids_json_file_name = os.path.join(
plugin_dir, os.path.join("windows", "sids_and_privileges.json")
)
if os.path.exists(sids_json_file_name):
break
else:
vollog.log(
constants.LOGLEVEL_VVV,
"sids_and_privileges.json file is missing plugin error",
)
raise RuntimeError(
"The sids_and_privileges.json file missed from you plugin directory"
)
# Get service sids dictionary (we need only the service sids).
with open(sids_json_file_name) as file_handle:
with resources.open_text(
"volatility3.data", "sids_and_privileges.json"
) as file_handle:
temp_json = json.load(file_handle)["privileges"]
self.privilege_info = {
int(priv_num): temp_json[priv_num] for priv_num in temp_json