diff --git a/volatility/framework/constants/__init__.py b/volatility/framework/constants/__init__.py index a38c5ba4e..b39fc2b7a 100644 --- a/volatility/framework/constants/__init__.py +++ b/volatility/framework/constants/__init__.py @@ -38,9 +38,9 @@ BANG = "!" """Constant used to delimit table names from type names when referring to a symbol""" # We use the SemVer 2.0.0 versioning scheme -VERSION_MAJOR = 1 # Number of releases of the library with a breaking change -VERSION_MINOR = 2 # Number of changes that only add to the interface -VERSION_PATCH = 1 # Number of changes that do not change the interface +VERSION_MAJOR = 2 # Number of releases of the library with a breaking change +VERSION_MINOR = 0 # Number of changes that only add to the interface +VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "-beta.1" PACKAGE_VERSION = ".".join([str(x) for x in [VERSION_MAJOR, VERSION_MINOR, VERSION_PATCH]]) + VERSION_SUFFIX diff --git a/volatility/framework/plugins/configwriter.py b/volatility/framework/plugins/configwriter.py index 8b9e01816..479dc3230 100644 --- a/volatility/framework/plugins/configwriter.py +++ b/volatility/framework/plugins/configwriter.py @@ -17,6 +17,8 @@ class ConfigWriter(plugins.PluginInterface): """Runs the automagics and both prints and outputs configuration in the output directory.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ diff --git a/volatility/framework/plugins/frameworkinfo.py b/volatility/framework/plugins/frameworkinfo.py index 835ad199c..8a95ecdff 100644 --- a/volatility/framework/plugins/frameworkinfo.py +++ b/volatility/framework/plugins/frameworkinfo.py @@ -8,6 +8,8 @@ from volatility.framework.interfaces import plugins class FrameworkInfo(plugins.PluginInterface): """Plugin to list the various modular components of Volatility""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [] @@ -24,9 +26,9 @@ class FrameworkInfo(plugins.PluginInterface): } for category, module_interface in categories.items(): - yield (0, (category, )) + yield (0, (category,)) for clazz in framework.class_subclasses(module_interface): - yield (1, (clazz.__name__, )) + yield (1, (clazz.__name__,)) def run(self): return renderers.TreeGrid([("Data", str)], self._generator()) diff --git a/volatility/framework/plugins/layerwriter.py b/volatility/framework/plugins/layerwriter.py index ad07cfa8d..68839bb6b 100644 --- a/volatility/framework/plugins/layerwriter.py +++ b/volatility/framework/plugins/layerwriter.py @@ -19,6 +19,7 @@ class LayerWriter(plugins.PluginInterface): default_output_name = "output.raw" default_block_size = 0x500000 + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod @@ -72,9 +73,9 @@ class LayerWriter(plugins.PluginInterface): def _generator(self): if self.config['primary'] not in self.context.layers: - yield 0, ('Layer Name does not exist', ) + yield 0, ('Layer Name does not exist',) elif os.path.exists(self.config.get('output', self.default_output_name)): - yield 0, ('Refusing to overwrite existing output file', ) + yield 0, ('Refusing to overwrite existing output file',) else: output_name = self.config.get('output', self.default_output_name) try: @@ -83,9 +84,9 @@ class LayerWriter(plugins.PluginInterface): self._progress_callback) self.produce_file(filedata) except IOError as excp: - yield 0, ('Layer cannot be written to {}: {}'.format(self.config['output_name'], excp), ) + yield 0, ('Layer cannot be written to {}: {}'.format(self.config['output_name'], excp),) - yield 0, ('Layer has been written to {}'.format(output_name), ) + yield 0, ('Layer has been written to {}'.format(output_name),) def run(self): return renderers.TreeGrid([("Status", str)], self._generator()) diff --git a/volatility/framework/plugins/linux/bash.py b/volatility/framework/plugins/linux/bash.py index 00ca475fd..82fdd90dc 100644 --- a/volatility/framework/plugins/linux/bash.py +++ b/volatility/framework/plugins/linux/bash.py @@ -21,6 +21,8 @@ from volatility.plugins.linux import pslist class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): """Recovers bash command history from memory.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ diff --git a/volatility/framework/plugins/linux/check_afinfo.py b/volatility/framework/plugins/linux/check_afinfo.py index 7f3f4379e..c3361b966 100644 --- a/volatility/framework/plugins/linux/check_afinfo.py +++ b/volatility/framework/plugins/linux/check_afinfo.py @@ -18,6 +18,8 @@ vollog = logging.getLogger(__name__) class Check_afinfo(plugins.PluginInterface): """Verifies the operation function pointers of network protocols.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ diff --git a/volatility/framework/plugins/linux/check_creds.py b/volatility/framework/plugins/linux/check_creds.py index 65af61de6..d2300debb 100644 --- a/volatility/framework/plugins/linux/check_creds.py +++ b/volatility/framework/plugins/linux/check_creds.py @@ -14,6 +14,8 @@ vollog = logging.getLogger(__name__) class Check_creds(interfaces.plugins.PluginInterface): """Checks if any processes are sharing credential structures""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls): return [ diff --git a/volatility/framework/plugins/linux/check_idt.py b/volatility/framework/plugins/linux/check_idt.py index c7430e256..4da33e8d8 100644 --- a/volatility/framework/plugins/linux/check_idt.py +++ b/volatility/framework/plugins/linux/check_idt.py @@ -17,6 +17,8 @@ vollog = logging.getLogger(__name__) class Check_idt(interfaces.plugins.PluginInterface): """ Checks if the IDT has been altered """ + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ diff --git a/volatility/framework/plugins/linux/check_modules.py b/volatility/framework/plugins/linux/check_modules.py index 5ec7b26a9..470ce0a2f 100644 --- a/volatility/framework/plugins/linux/check_modules.py +++ b/volatility/framework/plugins/linux/check_modules.py @@ -18,6 +18,8 @@ vollog = logging.getLogger(__name__) class Check_modules(plugins.PluginInterface): """Compares module list to sysfs info, if available""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ diff --git a/volatility/framework/plugins/linux/check_syscall.py b/volatility/framework/plugins/linux/check_syscall.py index 63f227b2f..30843077a 100644 --- a/volatility/framework/plugins/linux/check_syscall.py +++ b/volatility/framework/plugins/linux/check_syscall.py @@ -25,6 +25,8 @@ except ImportError: class Check_syscall(plugins.PluginInterface): """Check system call table for hooks.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ diff --git a/volatility/framework/plugins/linux/elfs.py b/volatility/framework/plugins/linux/elfs.py index 55627ee79..da9281ec3 100644 --- a/volatility/framework/plugins/linux/elfs.py +++ b/volatility/framework/plugins/linux/elfs.py @@ -17,6 +17,8 @@ from volatility.plugins.linux import pslist class Elfs(plugins.PluginInterface): """Lists all memory mapped ELF files for all processes.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ diff --git a/volatility/framework/plugins/linux/keyboard_notifiers.py b/volatility/framework/plugins/linux/keyboard_notifiers.py index d7cdb7cc7..7580b368b 100644 --- a/volatility/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility/framework/plugins/linux/keyboard_notifiers.py @@ -16,6 +16,8 @@ vollog = logging.getLogger(__name__) class Keyboard_notifiers(interfaces.plugins.PluginInterface): """Parses the keyboard notifier call chain""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls): return [ diff --git a/volatility/framework/plugins/linux/lsmod.py b/volatility/framework/plugins/linux/lsmod.py index 2d6706088..ada3002a4 100644 --- a/volatility/framework/plugins/linux/lsmod.py +++ b/volatility/framework/plugins/linux/lsmod.py @@ -9,7 +9,6 @@ from typing import List, Iterable from volatility.framework import contexts from volatility.framework import exceptions, renderers, constants, interfaces -from volatility.framework.automagic import linux from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins from volatility.framework.objects import utility @@ -21,6 +20,7 @@ vollog = logging.getLogger(__name__) class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules.""" + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/linux/lsof.py b/volatility/framework/plugins/linux/lsof.py index ad864435d..1ea348b19 100644 --- a/volatility/framework/plugins/linux/lsof.py +++ b/volatility/framework/plugins/linux/lsof.py @@ -19,6 +19,8 @@ vollog = logging.getLogger(__name__) class Lsof(plugins.PluginInterface): """Lists all memory maps for all processes.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ diff --git a/volatility/framework/plugins/linux/malfind.py b/volatility/framework/plugins/linux/malfind.py index f3952bc77..0da89025f 100644 --- a/volatility/framework/plugins/linux/malfind.py +++ b/volatility/framework/plugins/linux/malfind.py @@ -15,6 +15,8 @@ from volatility.plugins.linux import pslist class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ diff --git a/volatility/framework/plugins/linux/proc.py b/volatility/framework/plugins/linux/proc.py index d9d5c611e..6b73f2352 100644 --- a/volatility/framework/plugins/linux/proc.py +++ b/volatility/framework/plugins/linux/proc.py @@ -15,6 +15,8 @@ from volatility.plugins.linux import pslist class Maps(plugins.PluginInterface): """Lists all memory maps for all processes.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls): # Since we're calling the plugin, make sure we have the plugin's requirements diff --git a/volatility/framework/plugins/linux/pslist.py b/volatility/framework/plugins/linux/pslist.py index 9848cf192..8a60d58c4 100644 --- a/volatility/framework/plugins/linux/pslist.py +++ b/volatility/framework/plugins/linux/pslist.py @@ -12,6 +12,8 @@ from volatility.framework.objects import utility class PsList(interfaces.plugins.PluginInterface): """Lists the processes present in a particular linux memory image.""" + _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/linux/pstree.py b/volatility/framework/plugins/linux/pstree.py index f287e2732..c1e832950 100644 --- a/volatility/framework/plugins/linux/pstree.py +++ b/volatility/framework/plugins/linux/pstree.py @@ -10,6 +10,8 @@ class PsTree(pslist.PsList): """Plugin for listing processes in a tree based on their parent process ID.""" + _required_framework_version = (2, 0, 0) + def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self._processes = {} diff --git a/volatility/framework/plugins/linux/tty_check.py b/volatility/framework/plugins/linux/tty_check.py index d9caa45da..90959d6a2 100644 --- a/volatility/framework/plugins/linux/tty_check.py +++ b/volatility/framework/plugins/linux/tty_check.py @@ -19,6 +19,8 @@ vollog = logging.getLogger(__name__) class tty_check(plugins.PluginInterface): """Checks tty devices for hooks""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ diff --git a/volatility/framework/plugins/mac/bash.py b/volatility/framework/plugins/mac/bash.py index 8f26a339e..9c923d33c 100644 --- a/volatility/framework/plugins/mac/bash.py +++ b/volatility/framework/plugins/mac/bash.py @@ -20,6 +20,8 @@ from volatility.plugins.mac import pslist class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): """Recovers bash command history from memory.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls): return [ diff --git a/volatility/framework/plugins/mac/check_syscall.py b/volatility/framework/plugins/mac/check_syscall.py index 4b5c7b375..f1e0dc5d1 100644 --- a/volatility/framework/plugins/mac/check_syscall.py +++ b/volatility/framework/plugins/mac/check_syscall.py @@ -18,6 +18,8 @@ vollog = logging.getLogger(__name__) class Check_syscall(plugins.PluginInterface): """Check system call table for hooks.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ diff --git a/volatility/framework/plugins/mac/check_sysctl.py b/volatility/framework/plugins/mac/check_sysctl.py index c274efae0..5923430bb 100644 --- a/volatility/framework/plugins/mac/check_sysctl.py +++ b/volatility/framework/plugins/mac/check_sysctl.py @@ -20,6 +20,8 @@ vollog = logging.getLogger(__name__) class Check_sysctl(plugins.PluginInterface): """Check sysctl handlers for hooks.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ diff --git a/volatility/framework/plugins/mac/check_trap_table.py b/volatility/framework/plugins/mac/check_trap_table.py index bd78db317..99b509f40 100644 --- a/volatility/framework/plugins/mac/check_trap_table.py +++ b/volatility/framework/plugins/mac/check_trap_table.py @@ -19,6 +19,8 @@ vollog = logging.getLogger(__name__) class Check_trap_table(plugins.PluginInterface): """Check mach trap table for hooks.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ diff --git a/volatility/framework/plugins/mac/ifconfig.py b/volatility/framework/plugins/mac/ifconfig.py index da2d83396..8bcfe7377 100644 --- a/volatility/framework/plugins/mac/ifconfig.py +++ b/volatility/framework/plugins/mac/ifconfig.py @@ -11,6 +11,8 @@ from volatility.framework.symbols import mac class Ifconfig(plugins.PluginInterface): """Lists loaded kernel modules""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls): return [ diff --git a/volatility/framework/plugins/mac/lsmod.py b/volatility/framework/plugins/mac/lsmod.py index 27439efdc..129dbda9a 100644 --- a/volatility/framework/plugins/mac/lsmod.py +++ b/volatility/framework/plugins/mac/lsmod.py @@ -13,6 +13,8 @@ from volatility.framework.renderers import format_hints class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules.""" + _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/mac/lsof.py b/volatility/framework/plugins/mac/lsof.py index 1dfacd881..0307b2217 100644 --- a/volatility/framework/plugins/mac/lsof.py +++ b/volatility/framework/plugins/mac/lsof.py @@ -16,6 +16,8 @@ vollog = logging.getLogger(__name__) class Lsof(plugins.PluginInterface): """Lists all open file descriptors for all processes.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls): return [ diff --git a/volatility/framework/plugins/mac/malfind.py b/volatility/framework/plugins/mac/malfind.py index 2470d8498..3a920a8a5 100644 --- a/volatility/framework/plugins/mac/malfind.py +++ b/volatility/framework/plugins/mac/malfind.py @@ -14,6 +14,8 @@ from volatility.plugins.mac import pslist class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls): return [ diff --git a/volatility/framework/plugins/mac/mount.py b/volatility/framework/plugins/mac/mount.py index d2025ef1f..55193fac4 100644 --- a/volatility/framework/plugins/mac/mount.py +++ b/volatility/framework/plugins/mac/mount.py @@ -7,7 +7,6 @@ from volatility.framework import renderers, interfaces, contexts from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints from volatility.framework.symbols import mac @@ -15,6 +14,8 @@ class Mount(plugins.PluginInterface): """A module containing a collection of plugins that produce data typically foundin Mac's mount command""" + _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/mac/netstat.py b/volatility/framework/plugins/mac/netstat.py index 5df103b34..dc3c03297 100644 --- a/volatility/framework/plugins/mac/netstat.py +++ b/volatility/framework/plugins/mac/netstat.py @@ -19,6 +19,8 @@ vollog = logging.getLogger(__name__) class Netstat(plugins.PluginInterface): """Lists all network connections for all processes.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls): return [ diff --git a/volatility/framework/plugins/mac/proc_maps.py b/volatility/framework/plugins/mac/proc_maps.py index 5d1c840ce..57a8d0215 100644 --- a/volatility/framework/plugins/mac/proc_maps.py +++ b/volatility/framework/plugins/mac/proc_maps.py @@ -12,6 +12,8 @@ from volatility.plugins.mac import pslist class Maps(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls): return [ diff --git a/volatility/framework/plugins/mac/psaux.py b/volatility/framework/plugins/mac/psaux.py index 048ea6d4b..2dca44da4 100644 --- a/volatility/framework/plugins/mac/psaux.py +++ b/volatility/framework/plugins/mac/psaux.py @@ -14,6 +14,8 @@ from volatility.plugins.mac import pslist class Psaux(plugins.PluginInterface): """Recovers program command line arguments.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ diff --git a/volatility/framework/plugins/mac/pslist.py b/volatility/framework/plugins/mac/pslist.py index 711e3d3f6..9124a3d1a 100644 --- a/volatility/framework/plugins/mac/pslist.py +++ b/volatility/framework/plugins/mac/pslist.py @@ -16,6 +16,7 @@ vollog = logging.getLogger(__name__) class PsList(interfaces.plugins.PluginInterface): """Lists the processes present in a particular mac memory image.""" + _required_framework_version = (2, 0, 0) _version = (2, 0, 0) pslist_methods = ['tasks', 'allproc', 'process_group', 'sessions', 'pid_hash_table'] @@ -40,7 +41,7 @@ class PsList(interfaces.plugins.PluginInterface): @classmethod def get_list_tasks( - cls, method: str + cls, method: str ) -> Callable[[interfaces.context.ContextInterface, str, str, Callable[[int], bool]], Iterable[interfaces.objects.ObjectInterface]]: """Returns the list_tasks method based on the selector diff --git a/volatility/framework/plugins/mac/pstree.py b/volatility/framework/plugins/mac/pstree.py index 0f033175c..7fda089f7 100644 --- a/volatility/framework/plugins/mac/pstree.py +++ b/volatility/framework/plugins/mac/pstree.py @@ -13,6 +13,8 @@ class PsTree(plugins.PluginInterface): """Plugin for listing processes in a tree based on their parent process ID.""" + _required_framework_version = (2, 0, 0) + def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self._processes = {} diff --git a/volatility/framework/plugins/mac/timers.py b/volatility/framework/plugins/mac/timers.py index 863220156..94502d800 100644 --- a/volatility/framework/plugins/mac/timers.py +++ b/volatility/framework/plugins/mac/timers.py @@ -18,6 +18,8 @@ vollog = logging.getLogger(__name__) class Timers(plugins.PluginInterface): """Check for malicious kernel timers.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ diff --git a/volatility/framework/plugins/mac/trustedbsd.py b/volatility/framework/plugins/mac/trustedbsd.py index 149f41967..73a313af4 100644 --- a/volatility/framework/plugins/mac/trustedbsd.py +++ b/volatility/framework/plugins/mac/trustedbsd.py @@ -20,6 +20,8 @@ vollog = logging.getLogger(__name__) class Trustedbsd(plugins.PluginInterface): """Checks for malicious trustedbsd modules""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ diff --git a/volatility/framework/plugins/timeliner.py b/volatility/framework/plugins/timeliner.py index 495ee543b..78aa622d2 100644 --- a/volatility/framework/plugins/timeliner.py +++ b/volatility/framework/plugins/timeliner.py @@ -42,6 +42,8 @@ class Timeliner(interfaces.plugins.PluginInterface): """Runs all relevant plugins that provide time related information and orders the results by time.""" + _required_framework_version = (2, 0, 0) + def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self.timeline = {} @@ -183,7 +185,7 @@ class Timeliner(interfaces.plugins.PluginInterface): automagics = automagic.choose_automagic(self.automagics, plugin_class) plugin = plugins.construct_plugin(self.context, automagics, plugin_class, self.config_path, - self._progress_callback, self._file_consumer) + self._progress_callback, self._file_template) if isinstance(plugin, TimeLinerInterface): if not len(filter_list) or any( diff --git a/volatility/framework/plugins/windows/bigpools.py b/volatility/framework/plugins/windows/bigpools.py index 4fe66112b..434d88df3 100644 --- a/volatility/framework/plugins/windows/bigpools.py +++ b/volatility/framework/plugins/windows/bigpools.py @@ -19,6 +19,7 @@ vollog = logging.getLogger(__name__) class BigPools(interfaces.plugins.PluginInterface): """List big page pools.""" + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/cachedump.py b/volatility/framework/plugins/windows/cachedump.py index eeb38b7dc..c96cd18e5 100644 --- a/volatility/framework/plugins/windows/cachedump.py +++ b/volatility/framework/plugins/windows/cachedump.py @@ -17,6 +17,7 @@ from volatility.plugins.windows.registry import hivelist class Cachedump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/callbacks.py b/volatility/framework/plugins/windows/callbacks.py index 64314ebc8..8f5280ad0 100644 --- a/volatility/framework/plugins/windows/callbacks.py +++ b/volatility/framework/plugins/windows/callbacks.py @@ -19,6 +19,7 @@ vollog = logging.getLogger(__name__) class Callbacks(interfaces.plugins.PluginInterface): """Lists kernel callbacks and notification routines.""" + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/cmdline.py b/volatility/framework/plugins/windows/cmdline.py index a5d32312b..30bca053b 100644 --- a/volatility/framework/plugins/windows/cmdline.py +++ b/volatility/framework/plugins/windows/cmdline.py @@ -15,6 +15,7 @@ vollog = logging.getLogger(__name__) class CmdLine(interfaces.plugins.PluginInterface): """Lists process command line arguments.""" + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/dlllist.py b/volatility/framework/plugins/windows/dlllist.py index bd8b36d05..c40ad1db9 100644 --- a/volatility/framework/plugins/windows/dlllist.py +++ b/volatility/framework/plugins/windows/dlllist.py @@ -20,6 +20,7 @@ vollog = logging.getLogger(__name__) class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the loaded modules in a particular windows memory image.""" + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/driverirp.py b/volatility/framework/plugins/windows/driverirp.py index 240a64dba..c77e0801d 100644 --- a/volatility/framework/plugins/windows/driverirp.py +++ b/volatility/framework/plugins/windows/driverirp.py @@ -22,6 +22,8 @@ MAJOR_FUNCTIONS = [ class DriverIrp(interfaces.plugins.PluginInterface): """List IRPs for drivers in a particular windows memory image.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls): return [ diff --git a/volatility/framework/plugins/windows/driverscan.py b/volatility/framework/plugins/windows/driverscan.py index 8cf097aef..e3d1bd5b2 100644 --- a/volatility/framework/plugins/windows/driverscan.py +++ b/volatility/framework/plugins/windows/driverscan.py @@ -13,6 +13,7 @@ from volatility.plugins.windows import poolscanner class DriverScan(interfaces.plugins.PluginInterface): """Scans for drivers present in a particular windows memory image.""" + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/filescan.py b/volatility/framework/plugins/windows/filescan.py index 292c7f9e5..3f59e02e5 100644 --- a/volatility/framework/plugins/windows/filescan.py +++ b/volatility/framework/plugins/windows/filescan.py @@ -13,6 +13,8 @@ from volatility.plugins.windows import poolscanner class FileScan(interfaces.plugins.PluginInterface): """Scans for file objects present in a particular windows memory image.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls): return [ diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index 6ed8eeaee..9bb008696 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -24,6 +24,7 @@ except ImportError: class Handles(interfaces.plugins.PluginInterface): """Lists process open handles.""" + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) def __init__(self, *args, **kwargs): diff --git a/volatility/framework/plugins/windows/hashdump.py b/volatility/framework/plugins/windows/hashdump.py index 90857de67..0da4ebcab 100644 --- a/volatility/framework/plugins/windows/hashdump.py +++ b/volatility/framework/plugins/windows/hashdump.py @@ -21,6 +21,8 @@ vollog = logging.getLogger(__name__) class Hashdump(interfaces.plugins.PluginInterface): """Dumps user hashes from memory""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls): return [ diff --git a/volatility/framework/plugins/windows/info.py b/volatility/framework/plugins/windows/info.py index cf764b256..efc2926d3 100644 --- a/volatility/framework/plugins/windows/info.py +++ b/volatility/framework/plugins/windows/info.py @@ -17,6 +17,7 @@ from volatility.framework.symbols.windows.extensions import kdbg class Info(plugins.PluginInterface): """Show OS & kernel details of the memory sample being analyzed.""" + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/lsadump.py b/volatility/framework/plugins/windows/lsadump.py index 75c1d2609..a0b674855 100644 --- a/volatility/framework/plugins/windows/lsadump.py +++ b/volatility/framework/plugins/windows/lsadump.py @@ -19,6 +19,7 @@ vollog = logging.getLogger(__name__) class Lsadump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/malfind.py b/volatility/framework/plugins/windows/malfind.py index c65398b7f..d485ebc19 100644 --- a/volatility/framework/plugins/windows/malfind.py +++ b/volatility/framework/plugins/windows/malfind.py @@ -17,6 +17,8 @@ vollog = logging.getLogger(__name__) class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls): # Since we're calling the plugin, make sure we have the plugin's requirements @@ -103,8 +105,8 @@ class Malfind(interfaces.plugins.PluginInterface): continue if (vad.get_private_memory() == 1 - and vad.get_tag() == "VadS") or (vad.get_private_memory() == 0 - and protection_string != "PAGE_EXECUTE_WRITECOPY"): + and vad.get_tag() == "VadS") or (vad.get_private_memory() == 0 + and protection_string != "PAGE_EXECUTE_WRITECOPY"): if cls.is_vad_empty(proc_layer, vad): continue diff --git a/volatility/framework/plugins/windows/memmap.py b/volatility/framework/plugins/windows/memmap.py index d668bcc60..1c91c51ef 100644 --- a/volatility/framework/plugins/windows/memmap.py +++ b/volatility/framework/plugins/windows/memmap.py @@ -15,6 +15,8 @@ vollog = logging.getLogger(__name__) class Memmap(interfaces.plugins.PluginInterface): """Prints the memory map""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements diff --git a/volatility/framework/plugins/windows/modscan.py b/volatility/framework/plugins/windows/modscan.py index b85404c3d..dbd8a5649 100644 --- a/volatility/framework/plugins/windows/modscan.py +++ b/volatility/framework/plugins/windows/modscan.py @@ -15,6 +15,8 @@ from volatility.plugins.windows import poolscanner, dlllist class ModScan(interfaces.plugins.PluginInterface): """Scans for modules present in a particular windows memory image.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls): return [ diff --git a/volatility/framework/plugins/windows/modules.py b/volatility/framework/plugins/windows/modules.py index 6b107f38d..6afdccc5a 100644 --- a/volatility/framework/plugins/windows/modules.py +++ b/volatility/framework/plugins/windows/modules.py @@ -19,6 +19,7 @@ vollog = logging.getLogger(__name__) class Modules(interfaces.plugins.PluginInterface): """Lists the loaded kernel modules.""" + _required_framework_version = (2, 0, 0) _version = (1, 1, 0) @classmethod diff --git a/volatility/framework/plugins/windows/mutantscan.py b/volatility/framework/plugins/windows/mutantscan.py index 24356d120..d9053c44a 100644 --- a/volatility/framework/plugins/windows/mutantscan.py +++ b/volatility/framework/plugins/windows/mutantscan.py @@ -13,6 +13,8 @@ from volatility.plugins.windows import poolscanner class MutantScan(interfaces.plugins.PluginInterface): """Scans for mutexes present in a particular windows memory image.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls): return [ diff --git a/volatility/framework/plugins/windows/netscan.py b/volatility/framework/plugins/windows/netscan.py index e7d28d229..4b3650bf0 100644 --- a/volatility/framework/plugins/windows/netscan.py +++ b/volatility/framework/plugins/windows/netscan.py @@ -20,6 +20,7 @@ vollog = logging.getLogger(__name__) class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for network objects present in a particular windows memory image.""" + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/poolscanner.py b/volatility/framework/plugins/windows/poolscanner.py index 555a22ab8..2c1df940d 100644 --- a/volatility/framework/plugins/windows/poolscanner.py +++ b/volatility/framework/plugins/windows/poolscanner.py @@ -115,7 +115,7 @@ class PoolScanner(plugins.PluginInterface): """A generic pool scanner plugin.""" _version = (1, 0, 0) - _required_framework_version = (1, 2, 0) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/windows/pslist.py b/volatility/framework/plugins/windows/pslist.py index 2b2929c0c..4a1cb494a 100644 --- a/volatility/framework/plugins/windows/pslist.py +++ b/volatility/framework/plugins/windows/pslist.py @@ -20,6 +20,7 @@ vollog = logging.getLogger(__name__) class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the processes present in a particular windows memory image.""" + _required_framework_version = (2, 0, 0) _version = (1, 1, 0) PHYSICAL_DEFAULT = False diff --git a/volatility/framework/plugins/windows/psscan.py b/volatility/framework/plugins/windows/psscan.py index 9a762127b..15da457fd 100644 --- a/volatility/framework/plugins/windows/psscan.py +++ b/volatility/framework/plugins/windows/psscan.py @@ -22,6 +22,7 @@ vollog = logging.getLogger(__name__) class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for processes present in a particular windows memory image.""" + _required_framework_version = (2, 0, 0) _version = (1, 1, 0) @classmethod @@ -31,7 +32,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), - requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), + requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.VersionRequirement(name = 'info', component = info.Info, version = (1, 0, 0)), requirements.ListRequirement(name = 'pid', element_type = int, diff --git a/volatility/framework/plugins/windows/pstree.py b/volatility/framework/plugins/windows/pstree.py index 2d915ccb9..f323c1b46 100644 --- a/volatility/framework/plugins/windows/pstree.py +++ b/volatility/framework/plugins/windows/pstree.py @@ -14,6 +14,8 @@ class PsTree(interfaces.plugins.PluginInterface): """Plugin for listing processes in a tree based on their parent process ID.""" + _required_framework_version = (2, 0, 0) + def __init__(self, *args, **kwargs) -> None: super().__init__(*args, **kwargs) self._processes = {} # type: Dict[int, interfaces.objects.ObjectInterface] diff --git a/volatility/framework/plugins/windows/registry/hivelist.py b/volatility/framework/plugins/windows/registry/hivelist.py index 42e87e6f7..d1bac638e 100644 --- a/volatility/framework/plugins/windows/registry/hivelist.py +++ b/volatility/framework/plugins/windows/registry/hivelist.py @@ -18,6 +18,8 @@ class HiveGenerator: """Walks the registry HiveList linked list in a given direction and stores an invalid offset if it's unable to fully walk the list""" + _required_framework_version = (2, 0, 0) + def __init__(self, cmhive, forward = True): self._cmhive = cmhive self._forward = forward diff --git a/volatility/framework/plugins/windows/registry/hivescan.py b/volatility/framework/plugins/windows/registry/hivescan.py index 16d555da6..466e27763 100644 --- a/volatility/framework/plugins/windows/registry/hivescan.py +++ b/volatility/framework/plugins/windows/registry/hivescan.py @@ -15,6 +15,7 @@ class HiveScan(interfaces.plugins.PluginInterface): """Scans for registry hives present in a particular windows memory image.""" + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/registry/printkey.py b/volatility/framework/plugins/windows/registry/printkey.py index 85f0a5956..547e65930 100644 --- a/volatility/framework/plugins/windows/registry/printkey.py +++ b/volatility/framework/plugins/windows/registry/printkey.py @@ -19,8 +19,8 @@ vollog = logging.getLogger(__name__) class PrintKey(interfaces.plugins.PluginInterface): """Lists the registry keys under a hive or specific key value.""" + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) - _required_framework_version = (1, 1, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/windows/registry/userassist.py b/volatility/framework/plugins/windows/registry/userassist.py index 0085e29e2..c18d92edf 100644 --- a/volatility/framework/plugins/windows/registry/userassist.py +++ b/volatility/framework/plugins/windows/registry/userassist.py @@ -23,6 +23,8 @@ vollog = logging.getLogger(__name__) class UserAssist(interfaces.plugins.PluginInterface): """Print userassist registry keys and information.""" + _required_framework_version = (2, 0, 0) + def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self._userassist_size = 0 diff --git a/volatility/framework/plugins/windows/ssdt.py b/volatility/framework/plugins/windows/ssdt.py index ceae3e195..539d2e0a4 100644 --- a/volatility/framework/plugins/windows/ssdt.py +++ b/volatility/framework/plugins/windows/ssdt.py @@ -18,6 +18,7 @@ from volatility.plugins.windows import modules class SSDT(plugins.PluginInterface): """Lists the system call table.""" + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/strings.py b/volatility/framework/plugins/windows/strings.py index d5ca58d05..9c958fb1c 100644 --- a/volatility/framework/plugins/windows/strings.py +++ b/volatility/framework/plugins/windows/strings.py @@ -19,6 +19,7 @@ vollog = logging.getLogger(__name__) class Strings(interfaces.plugins.PluginInterface): """Reads output from the strings command and indicates which process(es) each string belongs to.""" + _required_framework_version = (2, 0, 0) strings_pattern = re.compile(rb"(?:\W*)([0-9]+)(?:\W*)(\w[\w\W]+)\n?") @classmethod diff --git a/volatility/framework/plugins/windows/svcscan.py b/volatility/framework/plugins/windows/svcscan.py index e47c51ce9..c9a125a7d 100644 --- a/volatility/framework/plugins/windows/svcscan.py +++ b/volatility/framework/plugins/windows/svcscan.py @@ -20,6 +20,7 @@ vollog = logging.getLogger(__name__) class SvcScan(interfaces.plugins.PluginInterface): """Scans for windows services.""" + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/symlinkscan.py b/volatility/framework/plugins/windows/symlinkscan.py index 44b6efd95..74f5e116a 100644 --- a/volatility/framework/plugins/windows/symlinkscan.py +++ b/volatility/framework/plugins/windows/symlinkscan.py @@ -15,6 +15,8 @@ from volatility.plugins.windows import poolscanner class SymlinkScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for links present in a particular windows memory image.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls): return [ diff --git a/volatility/framework/plugins/windows/vadinfo.py b/volatility/framework/plugins/windows/vadinfo.py index 1a1a85c7b..63aab0560 100644 --- a/volatility/framework/plugins/windows/vadinfo.py +++ b/volatility/framework/plugins/windows/vadinfo.py @@ -33,6 +33,7 @@ winnt_protections = { class VadInfo(interfaces.plugins.PluginInterface): """Lists process memory ranges.""" + _required_framework_version = (2, 0, 0) _version = (1, 1, 0) MAXSIZE_DEFAULT = 0 diff --git a/volatility/framework/plugins/windows/vadyarascan.py b/volatility/framework/plugins/windows/vadyarascan.py index 2500a8d54..529d1b21d 100644 --- a/volatility/framework/plugins/windows/vadyarascan.py +++ b/volatility/framework/plugins/windows/vadyarascan.py @@ -21,6 +21,8 @@ except ImportError: class VadYaraScan(interfaces.plugins.PluginInterface): """Scans all the Virtual Address Descriptor memory maps using yara.""" + + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility/framework/plugins/windows/verinfo.py b/volatility/framework/plugins/windows/verinfo.py index 94485768e..98340f855 100644 --- a/volatility/framework/plugins/windows/verinfo.py +++ b/volatility/framework/plugins/windows/verinfo.py @@ -25,6 +25,8 @@ except ImportError: class VerInfo(interfaces.plugins.PluginInterface): """Lists version information from PE files.""" + _required_framework_version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: ## TODO: we might add a regex option on the name later, but otherwise we're good diff --git a/volatility/framework/plugins/windows/virtmap.py b/volatility/framework/plugins/windows/virtmap.py index 1c9515d07..5ce7d5d78 100644 --- a/volatility/framework/plugins/windows/virtmap.py +++ b/volatility/framework/plugins/windows/virtmap.py @@ -16,8 +16,7 @@ vollog = logging.getLogger(__name__) class VirtMap(interfaces.plugins.PluginInterface): """Lists virtual mapped sections.""" - def __init__(self, *args, **kwargs): - super().__init__(*args, **kwargs) + _required_framework_version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility/framework/plugins/yarascan.py b/volatility/framework/plugins/yarascan.py index c2265d550..4e3abee25 100644 --- a/volatility/framework/plugins/yarascan.py +++ b/volatility/framework/plugins/yarascan.py @@ -37,6 +37,7 @@ class YaraScanner(interfaces.layers.ScannerInterface): class YaraScan(plugins.PluginInterface): """Scans kernel memory using yara rules (string or file).""" + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod