From b7c8c8a058c225072025d55f3e4d5f7f48af73f4 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 29 Jul 2017 12:53:35 +0100 Subject: [PATCH] Improve the docstrings for automagic. --- volatility/framework/automagic/construct_layers.py | 4 +++- volatility/framework/automagic/linux.py | 1 + volatility/framework/automagic/linux_symbol_cache.py | 2 +- volatility/framework/automagic/nlpdtbfinder.py | 8 +++++++- volatility/framework/automagic/pdbscan.py | 4 +++- volatility/framework/automagic/stacker.py | 2 +- volatility/framework/automagic/windows.py | 5 +++-- 7 files changed, 19 insertions(+), 7 deletions(-) diff --git a/volatility/framework/automagic/construct_layers.py b/volatility/framework/automagic/construct_layers.py index e761c507e..17faa067b 100644 --- a/volatility/framework/automagic/construct_layers.py +++ b/volatility/framework/automagic/construct_layers.py @@ -10,7 +10,9 @@ vollog = logging.getLogger(__name__) class ConstructionMagic(interfaces.automagic.AutomagicInterface): - """Class to run through the requirement tree of the :class:`~volatility.framework.interfaces.configuration.ConfigurableInterface` + """Constructs underlying layers + + Class to run through the requirement tree of the :class:`~volatility.framework.interfaces.configuration.ConfigurableInterface` and from the bottom of the tree upwards, attempt to construct all :class:`~volatility.framework.interfaces.configuration.ConstructableRequirementInterface` based classes. diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index 3abfc35fa..65fb6cd6c 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -8,6 +8,7 @@ vollog = logging.getLogger(__name__) class LinuxSymbolFinder(interfaces.automagic.AutomagicInterface): + """Linux symbol loader based on uname signature strings""" priority = 40 def __init__(self, context, config_path): diff --git a/volatility/framework/automagic/linux_symbol_cache.py b/volatility/framework/automagic/linux_symbol_cache.py index 8c5bd7f30..a9e05c6f2 100644 --- a/volatility/framework/automagic/linux_symbol_cache.py +++ b/volatility/framework/automagic/linux_symbol_cache.py @@ -11,7 +11,7 @@ vollog = logging.getLogger(__name__) class LinuxSymbolCache(interfaces.automagic.AutomagicInterface): - """Class to run through all Linux symbols tables and cache their banners""" + """Runs through all Linux symbols tables and caches their banners""" @classmethod def load_linux_banners(cls): diff --git a/volatility/framework/automagic/nlpdtbfinder.py b/volatility/framework/automagic/nlpdtbfinder.py index 10bf8855f..00eff3955 100644 --- a/volatility/framework/automagic/nlpdtbfinder.py +++ b/volatility/framework/automagic/nlpdtbfinder.py @@ -35,7 +35,7 @@ class NlpDtbScanner(interfaces.layers.ScannerInterface): def test_entries(self, valid_entries): """Scans through valid_entries, descending to see whether one can be successfully mapped to completion - + Returns the first valid DTB or None is no valid DTBs could be found """ for _, entry in valid_entries: @@ -131,6 +131,12 @@ class NlpDtbScanner(interfaces.layers.ScannerInterface): class NlpDtbfinder(interfaces.automagic.AutomagicInterface): + """Operating-system agnostic DirectoryTableBase scanner + + Checks a page for references off to other pages. + """ + priority = 11 + def __call__(self, context, config_path, requirement, progress_callback = None): results = {} sub_config_path = interfaces.configuration.path_join(config_path, requirement.name) diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index d2e0eedc7..aa7d77f23 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -104,7 +104,9 @@ def scan(ctx, layer_name, page_size, progress_callback = None, start = None, end class KernelPDBScanner(interfaces.automagic.AutomagicInterface): - """An Automagic object that looks for all Intel translation layers and scans each of them for a pdb signature. + """Windows symbol loader based on PDB signatures + + An Automagic object that looks for all Intel translation layers and scans each of them for a pdb signature. When found, a search for a corresponding Intermediate Format data file is carried out and if found an appropriate symbol space is automatically loaded. diff --git a/volatility/framework/automagic/stacker.py b/volatility/framework/automagic/stacker.py index 2a9e372d7..87be48af3 100644 --- a/volatility/framework/automagic/stacker.py +++ b/volatility/framework/automagic/stacker.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class LayerStacker(interfaces.automagic.AutomagicInterface): - """Class that attempts to build up layers in a single stack + """Builds up layers in a single stack This class mimics the volatility 2 style of stacking address spaces. It builds up various layers based on separate :class:`~volatility.framework.interfaces.automagic.StackerLayerInterface` classes. These classes are diff --git a/volatility/framework/automagic/windows.py b/volatility/framework/automagic/windows.py index 37e550085..76becb1ff 100644 --- a/volatility/framework/automagic/windows.py +++ b/volatility/framework/automagic/windows.py @@ -209,13 +209,14 @@ class PageMapScanner(interfaces.layers.ScannerInterface): class WintelHelper(interfaces.automagic.AutomagicInterface): - """This class adheres to the :class:`~volatility.framework.interfaces.automagic.AutomagicInterface` interface + """Windows DTB finder based on self-referential pointers + + This class adheres to the :class:`~volatility.framework.interfaces.automagic.AutomagicInterface` interface and both determines the directory table base of an intel layer if one hasn't been specified, and constructs the intel layer if necessary (for example when reconstructing a pre-existing configuration). It will scan for existing TranslationLayers that do not have a DTB using the :class:`PageMapScanner""" priority = 20 - stack_order = 90 tests = [DtbTest32bit(), DtbTest64bit(), DtbTestPae()] def __call__(self, context, config_path, requirement, progress_callback = None):