Plugins: Bump required_framework_version and yapf

volatility/framework/constants/__init__.py

@@ -38,9 +38,9 @@ BANG = "!"
 """Constant used to delimit table names from type names when referring to a symbol"""
 
 # We use the SemVer 2.0.0 versioning scheme
-VERSION_MAJOR = 1  # Number of releases of the library with a breaking change
-VERSION_MINOR = 2  # Number of changes that only add to the interface
-VERSION_PATCH = 1  # Number of changes that do not change the interface
+VERSION_MAJOR = 2  # Number of releases of the library with a breaking change
+VERSION_MINOR = 0  # Number of changes that only add to the interface
+VERSION_PATCH = 0  # Number of changes that do not change the interface
 VERSION_SUFFIX = "-beta.1"
 
 PACKAGE_VERSION = ".".join([str(x) for x in [VERSION_MAJOR, VERSION_MINOR, VERSION_PATCH]]) + VERSION_SUFFIX

volatility/framework/plugins/configwriter.py

@@ -17,6 +17,8 @@ class ConfigWriter(plugins.PluginInterface):
     """Runs the automagics and both prints and outputs configuration in the
     output directory."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [

volatility/framework/plugins/frameworkinfo.py

@@ -8,6 +8,8 @@ from volatility.framework.interfaces import plugins
 class FrameworkInfo(plugins.PluginInterface):
     """Plugin to list the various modular components of Volatility"""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return []
@@ -24,9 +26,9 @@ class FrameworkInfo(plugins.PluginInterface):
         }
 
         for category, module_interface in categories.items():
-            yield (0, (category, ))
+            yield (0, (category,))
             for clazz in framework.class_subclasses(module_interface):
-                yield (1, (clazz.__name__, ))
+                yield (1, (clazz.__name__,))
 
     def run(self):
         return renderers.TreeGrid([("Data", str)], self._generator())

volatility/framework/plugins/layerwriter.py

@@ -19,6 +19,7 @@ class LayerWriter(plugins.PluginInterface):
     default_output_name = "output.raw"
     default_block_size = 0x500000
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod
@@ -72,9 +73,9 @@ class LayerWriter(plugins.PluginInterface):
 
     def _generator(self):
         if self.config['primary'] not in self.context.layers:
-            yield 0, ('Layer Name does not exist', )
+            yield 0, ('Layer Name does not exist',)
         elif os.path.exists(self.config.get('output', self.default_output_name)):
-            yield 0, ('Refusing to overwrite existing output file', )
+            yield 0, ('Refusing to overwrite existing output file',)
         else:
             output_name = self.config.get('output', self.default_output_name)
             try:
@@ -83,9 +84,9 @@ class LayerWriter(plugins.PluginInterface):
                                             self._progress_callback)
                 self.produce_file(filedata)
             except IOError as excp:
-                yield 0, ('Layer cannot be written to {}: {}'.format(self.config['output_name'], excp), )
+                yield 0, ('Layer cannot be written to {}: {}'.format(self.config['output_name'], excp),)
 
-            yield 0, ('Layer has been written to {}'.format(output_name), )
+            yield 0, ('Layer has been written to {}'.format(output_name),)
 
     def run(self):
         return renderers.TreeGrid([("Status", str)], self._generator())

volatility/framework/plugins/linux/bash.py

@@ -21,6 +21,8 @@ from volatility.plugins.linux import pslist
 class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
     """Recovers bash command history from memory."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [

volatility/framework/plugins/linux/check_afinfo.py

@@ -18,6 +18,8 @@ vollog = logging.getLogger(__name__)
 class Check_afinfo(plugins.PluginInterface):
     """Verifies the operation function pointers of network protocols."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [

volatility/framework/plugins/linux/check_creds.py

@@ -14,6 +14,8 @@ vollog = logging.getLogger(__name__)
 class Check_creds(interfaces.plugins.PluginInterface):
     """Checks if any processes are sharing credential structures"""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/linux/check_idt.py

@@ -17,6 +17,8 @@ vollog = logging.getLogger(__name__)
 class Check_idt(interfaces.plugins.PluginInterface):
     """ Checks if the IDT has been altered """
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [

volatility/framework/plugins/linux/check_modules.py

@@ -18,6 +18,8 @@ vollog = logging.getLogger(__name__)
 class Check_modules(plugins.PluginInterface):
     """Compares module list to sysfs info, if available"""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [

volatility/framework/plugins/linux/check_syscall.py

@@ -25,6 +25,8 @@ except ImportError:
 class Check_syscall(plugins.PluginInterface):
     """Check system call table for hooks."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [

volatility/framework/plugins/linux/elfs.py

@@ -17,6 +17,8 @@ from volatility.plugins.linux import pslist
 class Elfs(plugins.PluginInterface):
     """Lists all memory mapped ELF files for all processes."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [

volatility/framework/plugins/linux/keyboard_notifiers.py

@@ -16,6 +16,8 @@ vollog = logging.getLogger(__name__)
 class Keyboard_notifiers(interfaces.plugins.PluginInterface):
     """Parses the keyboard notifier call chain"""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/linux/lsmod.py

@@ -9,7 +9,6 @@ from typing import List, Iterable
 
 from volatility.framework import contexts
 from volatility.framework import exceptions, renderers, constants, interfaces
-from volatility.framework.automagic import linux
 from volatility.framework.configuration import requirements
 from volatility.framework.interfaces import plugins
 from volatility.framework.objects import utility
@@ -21,6 +20,7 @@ vollog = logging.getLogger(__name__)
 class Lsmod(plugins.PluginInterface):
     """Lists loaded kernel modules."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/linux/lsof.py

@@ -19,6 +19,8 @@ vollog = logging.getLogger(__name__)
 class Lsof(plugins.PluginInterface):
     """Lists all memory maps for all processes."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [

volatility/framework/plugins/linux/malfind.py

@@ -15,6 +15,8 @@ from volatility.plugins.linux import pslist
 class Malfind(interfaces.plugins.PluginInterface):
     """Lists process memory ranges that potentially contain injected code."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [

volatility/framework/plugins/linux/proc.py

@@ -15,6 +15,8 @@ from volatility.plugins.linux import pslist
 class Maps(plugins.PluginInterface):
     """Lists all memory maps for all processes."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         # Since we're calling the plugin, make sure we have the plugin's requirements

volatility/framework/plugins/linux/pslist.py

@@ -12,6 +12,8 @@ from volatility.framework.objects import utility
 class PsList(interfaces.plugins.PluginInterface):
     """Lists the processes present in a particular linux memory image."""
 
+    _required_framework_version = (2, 0, 0)
+
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/linux/pstree.py

@@ -10,6 +10,8 @@ class PsTree(pslist.PsList):
     """Plugin for listing processes in a tree based on their parent process
     ID."""
 
+    _required_framework_version = (2, 0, 0)
+
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self._processes = {}

volatility/framework/plugins/linux/tty_check.py

@@ -19,6 +19,8 @@ vollog = logging.getLogger(__name__)
 class tty_check(plugins.PluginInterface):
     """Checks tty devices for hooks"""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [

volatility/framework/plugins/mac/bash.py

@@ -20,6 +20,8 @@ from volatility.plugins.mac import pslist
 class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
     """Recovers bash command history from memory."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/mac/check_syscall.py

@@ -18,6 +18,8 @@ vollog = logging.getLogger(__name__)
 class Check_syscall(plugins.PluginInterface):
     """Check system call table for hooks."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [

volatility/framework/plugins/mac/check_sysctl.py

@@ -20,6 +20,8 @@ vollog = logging.getLogger(__name__)
 class Check_sysctl(plugins.PluginInterface):
     """Check sysctl handlers for hooks."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [

volatility/framework/plugins/mac/check_trap_table.py

@@ -19,6 +19,8 @@ vollog = logging.getLogger(__name__)
 class Check_trap_table(plugins.PluginInterface):
     """Check mach trap table for hooks."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [

volatility/framework/plugins/mac/ifconfig.py

@@ -11,6 +11,8 @@ from volatility.framework.symbols import mac
 class Ifconfig(plugins.PluginInterface):
     """Lists loaded kernel modules"""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/mac/lsmod.py

@@ -13,6 +13,8 @@ from volatility.framework.renderers import format_hints
 class Lsmod(plugins.PluginInterface):
     """Lists loaded kernel modules."""
 
+    _required_framework_version = (2, 0, 0)
+
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/mac/lsof.py

@@ -16,6 +16,8 @@ vollog = logging.getLogger(__name__)
 class Lsof(plugins.PluginInterface):
     """Lists all open file descriptors for all processes."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/mac/malfind.py

@@ -14,6 +14,8 @@ from volatility.plugins.mac import pslist
 class Malfind(interfaces.plugins.PluginInterface):
     """Lists process memory ranges that potentially contain injected code."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/mac/mount.py

@@ -7,7 +7,6 @@ from volatility.framework import renderers, interfaces, contexts
 from volatility.framework.configuration import requirements
 from volatility.framework.interfaces import plugins
 from volatility.framework.objects import utility
-from volatility.framework.renderers import format_hints
 from volatility.framework.symbols import mac
 
 
@@ -15,6 +14,8 @@ class Mount(plugins.PluginInterface):
     """A module containing a collection of plugins that produce data typically
     foundin Mac's mount command"""
 
+    _required_framework_version = (2, 0, 0)
+
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/mac/netstat.py

@@ -19,6 +19,8 @@ vollog = logging.getLogger(__name__)
 class Netstat(plugins.PluginInterface):
     """Lists all network connections for all processes."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/mac/proc_maps.py

@@ -12,6 +12,8 @@ from volatility.plugins.mac import pslist
 class Maps(interfaces.plugins.PluginInterface):
     """Lists process memory ranges that potentially contain injected code."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/mac/psaux.py

@@ -14,6 +14,8 @@ from volatility.plugins.mac import pslist
 class Psaux(plugins.PluginInterface):
     """Recovers program command line arguments."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [

volatility/framework/plugins/mac/pslist.py

@@ -16,6 +16,7 @@ vollog = logging.getLogger(__name__)
 class PsList(interfaces.plugins.PluginInterface):
     """Lists the processes present in a particular mac memory image."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (2, 0, 0)
     pslist_methods = ['tasks', 'allproc', 'process_group', 'sessions', 'pid_hash_table']
 
@@ -40,7 +41,7 @@ class PsList(interfaces.plugins.PluginInterface):
 
     @classmethod
     def get_list_tasks(
-        cls, method: str
+            cls, method: str
     ) -> Callable[[interfaces.context.ContextInterface, str, str, Callable[[int], bool]],
                   Iterable[interfaces.objects.ObjectInterface]]:
         """Returns the list_tasks method based on the selector

volatility/framework/plugins/mac/pstree.py

@@ -13,6 +13,8 @@ class PsTree(plugins.PluginInterface):
     """Plugin for listing processes in a tree based on their parent process
     ID."""
 
+    _required_framework_version = (2, 0, 0)
+
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self._processes = {}

volatility/framework/plugins/mac/timers.py

@@ -18,6 +18,8 @@ vollog = logging.getLogger(__name__)
 class Timers(plugins.PluginInterface):
     """Check for malicious kernel timers."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [

volatility/framework/plugins/mac/trustedbsd.py

@@ -20,6 +20,8 @@ vollog = logging.getLogger(__name__)
 class Trustedbsd(plugins.PluginInterface):
     """Checks for malicious trustedbsd modules"""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         return [

volatility/framework/plugins/timeliner.py

@@ -42,6 +42,8 @@ class Timeliner(interfaces.plugins.PluginInterface):
     """Runs all relevant plugins that provide time related information and
     orders the results by time."""
 
+    _required_framework_version = (2, 0, 0)
+
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.timeline = {}
@@ -183,7 +185,7 @@ class Timeliner(interfaces.plugins.PluginInterface):
                 automagics = automagic.choose_automagic(self.automagics, plugin_class)
 
                 plugin = plugins.construct_plugin(self.context, automagics, plugin_class, self.config_path,
-                                                  self._progress_callback, self._file_consumer)
+                                                  self._progress_callback, self._file_template)
 
                 if isinstance(plugin, TimeLinerInterface):
                     if not len(filter_list) or any(

volatility/framework/plugins/windows/bigpools.py

@@ -19,6 +19,7 @@ vollog = logging.getLogger(__name__)
 class BigPools(interfaces.plugins.PluginInterface):
     """List big page pools."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/cachedump.py

@@ -17,6 +17,7 @@ from volatility.plugins.windows.registry import hivelist
 class Cachedump(interfaces.plugins.PluginInterface):
     """Dumps lsa secrets from memory"""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/callbacks.py

@@ -19,6 +19,7 @@ vollog = logging.getLogger(__name__)
 class Callbacks(interfaces.plugins.PluginInterface):
     """Lists kernel callbacks and notification routines."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/cmdline.py

@@ -15,6 +15,7 @@ vollog = logging.getLogger(__name__)
 class CmdLine(interfaces.plugins.PluginInterface):
     """Lists process command line arguments."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/dlllist.py

@@ -20,6 +20,7 @@ vollog = logging.getLogger(__name__)
 class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
     """Lists the loaded modules in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/driverirp.py

@@ -22,6 +22,8 @@ MAJOR_FUNCTIONS = [
 class DriverIrp(interfaces.plugins.PluginInterface):
     """List IRPs for drivers in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/windows/driverscan.py

@@ -13,6 +13,7 @@ from volatility.plugins.windows import poolscanner
 class DriverScan(interfaces.plugins.PluginInterface):
     """Scans for drivers present in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/filescan.py

@@ -13,6 +13,8 @@ from volatility.plugins.windows import poolscanner
 class FileScan(interfaces.plugins.PluginInterface):
     """Scans for file objects present in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/windows/handles.py

@@ -24,6 +24,7 @@ except ImportError:
 class Handles(interfaces.plugins.PluginInterface):
     """Lists process open handles."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     def __init__(self, *args, **kwargs):

volatility/framework/plugins/windows/hashdump.py

@@ -21,6 +21,8 @@ vollog = logging.getLogger(__name__)
 class Hashdump(interfaces.plugins.PluginInterface):
     """Dumps user hashes from memory"""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/windows/info.py

@@ -17,6 +17,7 @@ from volatility.framework.symbols.windows.extensions import kdbg
 class Info(plugins.PluginInterface):
     """Show OS & kernel details of the memory sample being analyzed."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/lsadump.py

@@ -19,6 +19,7 @@ vollog = logging.getLogger(__name__)
 class Lsadump(interfaces.plugins.PluginInterface):
     """Dumps lsa secrets from memory"""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/malfind.py

@@ -17,6 +17,8 @@ vollog = logging.getLogger(__name__)
 class Malfind(interfaces.plugins.PluginInterface):
     """Lists process memory ranges that potentially contain injected code."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         # Since we're calling the plugin, make sure we have the plugin's requirements
@@ -103,8 +105,8 @@ class Malfind(interfaces.plugins.PluginInterface):
                 continue
 
             if (vad.get_private_memory() == 1
-                    and vad.get_tag() == "VadS") or (vad.get_private_memory() == 0
-                                                     and protection_string != "PAGE_EXECUTE_WRITECOPY"):
+                and vad.get_tag() == "VadS") or (vad.get_private_memory() == 0
+                                                 and protection_string != "PAGE_EXECUTE_WRITECOPY"):
                 if cls.is_vad_empty(proc_layer, vad):
                     continue
 

volatility/framework/plugins/windows/memmap.py

@@ -15,6 +15,8 @@ vollog = logging.getLogger(__name__)
 class Memmap(interfaces.plugins.PluginInterface):
     """Prints the memory map"""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         # Since we're calling the plugin, make sure we have the plugin's requirements

volatility/framework/plugins/windows/modscan.py

@@ -15,6 +15,8 @@ from volatility.plugins.windows import poolscanner, dlllist
 class ModScan(interfaces.plugins.PluginInterface):
     """Scans for modules present in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/windows/modules.py

@@ -19,6 +19,7 @@ vollog = logging.getLogger(__name__)
 class Modules(interfaces.plugins.PluginInterface):
     """Lists the loaded kernel modules."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 1, 0)
 
     @classmethod

volatility/framework/plugins/windows/mutantscan.py

@@ -13,6 +13,8 @@ from volatility.plugins.windows import poolscanner
 class MutantScan(interfaces.plugins.PluginInterface):
     """Scans for mutexes present in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/windows/netscan.py

@@ -20,6 +20,7 @@ vollog = logging.getLogger(__name__)
 class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
     """Scans for network objects present in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/poolscanner.py

@@ -115,7 +115,7 @@ class PoolScanner(plugins.PluginInterface):
     """A generic pool scanner plugin."""
 
     _version = (1, 0, 0)
-    _required_framework_version = (1, 2, 0)
+    _required_framework_version = (2, 0, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:

volatility/framework/plugins/windows/pslist.py

@@ -20,6 +20,7 @@ vollog = logging.getLogger(__name__)
 class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
     """Lists the processes present in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 1, 0)
     PHYSICAL_DEFAULT = False
 

volatility/framework/plugins/windows/psscan.py

@@ -22,6 +22,7 @@ vollog = logging.getLogger(__name__)
 class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
     """Scans for processes present in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 1, 0)
 
     @classmethod
@@ -31,7 +32,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
                                                      description = 'Memory layer for the kernel',
                                                      architectures = ["Intel32", "Intel64"]),
             requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
-            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)),
+            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
             requirements.VersionRequirement(name = 'info', component = info.Info, version = (1, 0, 0)),
             requirements.ListRequirement(name = 'pid',
                                          element_type = int,

volatility/framework/plugins/windows/pstree.py

@@ -14,6 +14,8 @@ class PsTree(interfaces.plugins.PluginInterface):
     """Plugin for listing processes in a tree based on their parent process
     ID."""
 
+    _required_framework_version = (2, 0, 0)
+
     def __init__(self, *args, **kwargs) -> None:
         super().__init__(*args, **kwargs)
         self._processes = {}  # type: Dict[int, interfaces.objects.ObjectInterface]

volatility/framework/plugins/windows/registry/hivelist.py

@@ -18,6 +18,8 @@ class HiveGenerator:
     """Walks the registry HiveList linked list in a given direction and stores an invalid offset
     if it's unable to fully walk the list"""
 
+    _required_framework_version = (2, 0, 0)
+
     def __init__(self, cmhive, forward = True):
         self._cmhive = cmhive
         self._forward = forward

volatility/framework/plugins/windows/registry/hivescan.py

@@ -15,6 +15,7 @@ class HiveScan(interfaces.plugins.PluginInterface):
     """Scans for registry hives present in a particular windows memory
     image."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/registry/printkey.py

@@ -19,8 +19,8 @@ vollog = logging.getLogger(__name__)
 class PrintKey(interfaces.plugins.PluginInterface):
     """Lists the registry keys under a hive or specific key value."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
-    _required_framework_version = (1, 1, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:

volatility/framework/plugins/windows/registry/userassist.py

@@ -23,6 +23,8 @@ vollog = logging.getLogger(__name__)
 class UserAssist(interfaces.plugins.PluginInterface):
     """Print userassist registry keys and information."""
 
+    _required_framework_version = (2, 0, 0)
+
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self._userassist_size = 0

volatility/framework/plugins/windows/ssdt.py

@@ -18,6 +18,7 @@ from volatility.plugins.windows import modules
 class SSDT(plugins.PluginInterface):
     """Lists the system call table."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/strings.py

@@ -19,6 +19,7 @@ vollog = logging.getLogger(__name__)
 class Strings(interfaces.plugins.PluginInterface):
     """Reads output from the strings command and indicates which process(es) each string belongs to."""
 
+    _required_framework_version = (2, 0, 0)
     strings_pattern = re.compile(rb"(?:\W*)([0-9]+)(?:\W*)(\w[\w\W]+)\n?")
 
     @classmethod

volatility/framework/plugins/windows/svcscan.py

@@ -20,6 +20,7 @@ vollog = logging.getLogger(__name__)
 class SvcScan(interfaces.plugins.PluginInterface):
     """Scans for windows services."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/symlinkscan.py

@@ -15,6 +15,8 @@ from volatility.plugins.windows import poolscanner
 class SymlinkScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
     """Scans for links present in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/windows/vadinfo.py

@@ -33,6 +33,7 @@ winnt_protections = {
 class VadInfo(interfaces.plugins.PluginInterface):
     """Lists process memory ranges."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 1, 0)
     MAXSIZE_DEFAULT = 0
 

volatility/framework/plugins/windows/vadyarascan.py

@@ -21,6 +21,8 @@ except ImportError:
 
 class VadYaraScan(interfaces.plugins.PluginInterface):
     """Scans all the Virtual Address Descriptor memory maps using yara."""
+
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/verinfo.py

@@ -25,6 +25,8 @@ except ImportError:
 class VerInfo(interfaces.plugins.PluginInterface):
     """Lists version information from PE files."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         ## TODO: we might add a regex option on the name later, but otherwise we're good

volatility/framework/plugins/windows/virtmap.py

@@ -16,8 +16,7 @@ vollog = logging.getLogger(__name__)
 class VirtMap(interfaces.plugins.PluginInterface):
     """Lists virtual mapped sections."""
 
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
+    _required_framework_version = (2, 0, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:

volatility/framework/plugins/yarascan.py

@@ -37,6 +37,7 @@ class YaraScanner(interfaces.layers.ScannerInterface):
 class YaraScan(plugins.PluginInterface):
     """Scans kernel memory using yara rules (string or file)."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod