Plugins: Bump required_framework_version and yapf

volatility/framework/plugins/windows/bigpools.py

@@ -19,6 +19,7 @@ vollog = logging.getLogger(__name__)
 class BigPools(interfaces.plugins.PluginInterface):
     """List big page pools."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/cachedump.py

@@ -17,6 +17,7 @@ from volatility.plugins.windows.registry import hivelist
 class Cachedump(interfaces.plugins.PluginInterface):
     """Dumps lsa secrets from memory"""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/callbacks.py

@@ -19,6 +19,7 @@ vollog = logging.getLogger(__name__)
 class Callbacks(interfaces.plugins.PluginInterface):
     """Lists kernel callbacks and notification routines."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/cmdline.py

@@ -15,6 +15,7 @@ vollog = logging.getLogger(__name__)
 class CmdLine(interfaces.plugins.PluginInterface):
     """Lists process command line arguments."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/dlllist.py

@@ -20,6 +20,7 @@ vollog = logging.getLogger(__name__)
 class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
     """Lists the loaded modules in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/driverirp.py

@@ -22,6 +22,8 @@ MAJOR_FUNCTIONS = [
 class DriverIrp(interfaces.plugins.PluginInterface):
     """List IRPs for drivers in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/windows/driverscan.py

@@ -13,6 +13,7 @@ from volatility.plugins.windows import poolscanner
 class DriverScan(interfaces.plugins.PluginInterface):
     """Scans for drivers present in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/filescan.py

@@ -13,6 +13,8 @@ from volatility.plugins.windows import poolscanner
 class FileScan(interfaces.plugins.PluginInterface):
     """Scans for file objects present in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/windows/handles.py

@@ -24,6 +24,7 @@ except ImportError:
 class Handles(interfaces.plugins.PluginInterface):
     """Lists process open handles."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     def __init__(self, *args, **kwargs):

volatility/framework/plugins/windows/hashdump.py

@@ -21,6 +21,8 @@ vollog = logging.getLogger(__name__)
 class Hashdump(interfaces.plugins.PluginInterface):
     """Dumps user hashes from memory"""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/windows/info.py

@@ -17,6 +17,7 @@ from volatility.framework.symbols.windows.extensions import kdbg
 class Info(plugins.PluginInterface):
     """Show OS & kernel details of the memory sample being analyzed."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/lsadump.py

@@ -19,6 +19,7 @@ vollog = logging.getLogger(__name__)
 class Lsadump(interfaces.plugins.PluginInterface):
     """Dumps lsa secrets from memory"""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/malfind.py

@@ -17,6 +17,8 @@ vollog = logging.getLogger(__name__)
 class Malfind(interfaces.plugins.PluginInterface):
     """Lists process memory ranges that potentially contain injected code."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         # Since we're calling the plugin, make sure we have the plugin's requirements
@@ -103,8 +105,8 @@ class Malfind(interfaces.plugins.PluginInterface):
                 continue
 
             if (vad.get_private_memory() == 1
-                    and vad.get_tag() == "VadS") or (vad.get_private_memory() == 0
-                                                     and protection_string != "PAGE_EXECUTE_WRITECOPY"):
+                and vad.get_tag() == "VadS") or (vad.get_private_memory() == 0
+                                                 and protection_string != "PAGE_EXECUTE_WRITECOPY"):
                 if cls.is_vad_empty(proc_layer, vad):
                     continue
 

volatility/framework/plugins/windows/memmap.py

@@ -15,6 +15,8 @@ vollog = logging.getLogger(__name__)
 class Memmap(interfaces.plugins.PluginInterface):
     """Prints the memory map"""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         # Since we're calling the plugin, make sure we have the plugin's requirements

volatility/framework/plugins/windows/modscan.py

@@ -15,6 +15,8 @@ from volatility.plugins.windows import poolscanner, dlllist
 class ModScan(interfaces.plugins.PluginInterface):
     """Scans for modules present in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/windows/modules.py

@@ -19,6 +19,7 @@ vollog = logging.getLogger(__name__)
 class Modules(interfaces.plugins.PluginInterface):
     """Lists the loaded kernel modules."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 1, 0)
 
     @classmethod

volatility/framework/plugins/windows/mutantscan.py

@@ -13,6 +13,8 @@ from volatility.plugins.windows import poolscanner
 class MutantScan(interfaces.plugins.PluginInterface):
     """Scans for mutexes present in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/windows/netscan.py

@@ -20,6 +20,7 @@ vollog = logging.getLogger(__name__)
 class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
     """Scans for network objects present in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/poolscanner.py

@@ -115,7 +115,7 @@ class PoolScanner(plugins.PluginInterface):
     """A generic pool scanner plugin."""
 
     _version = (1, 0, 0)
-    _required_framework_version = (1, 2, 0)
+    _required_framework_version = (2, 0, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:

volatility/framework/plugins/windows/pslist.py

@@ -20,6 +20,7 @@ vollog = logging.getLogger(__name__)
 class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
     """Lists the processes present in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 1, 0)
     PHYSICAL_DEFAULT = False
 

volatility/framework/plugins/windows/psscan.py

@@ -22,6 +22,7 @@ vollog = logging.getLogger(__name__)
 class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
     """Scans for processes present in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 1, 0)
 
     @classmethod
@@ -31,7 +32,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
                                                      description = 'Memory layer for the kernel',
                                                      architectures = ["Intel32", "Intel64"]),
             requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
-            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)),
+            requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
             requirements.VersionRequirement(name = 'info', component = info.Info, version = (1, 0, 0)),
             requirements.ListRequirement(name = 'pid',
                                          element_type = int,

volatility/framework/plugins/windows/pstree.py

@@ -14,6 +14,8 @@ class PsTree(interfaces.plugins.PluginInterface):
     """Plugin for listing processes in a tree based on their parent process
     ID."""
 
+    _required_framework_version = (2, 0, 0)
+
     def __init__(self, *args, **kwargs) -> None:
         super().__init__(*args, **kwargs)
         self._processes = {}  # type: Dict[int, interfaces.objects.ObjectInterface]

volatility/framework/plugins/windows/registry/hivelist.py

@@ -18,6 +18,8 @@ class HiveGenerator:
     """Walks the registry HiveList linked list in a given direction and stores an invalid offset
     if it's unable to fully walk the list"""
 
+    _required_framework_version = (2, 0, 0)
+
     def __init__(self, cmhive, forward = True):
         self._cmhive = cmhive
         self._forward = forward

volatility/framework/plugins/windows/registry/hivescan.py

@@ -15,6 +15,7 @@ class HiveScan(interfaces.plugins.PluginInterface):
     """Scans for registry hives present in a particular windows memory
     image."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/registry/printkey.py

@@ -19,8 +19,8 @@ vollog = logging.getLogger(__name__)
 class PrintKey(interfaces.plugins.PluginInterface):
     """Lists the registry keys under a hive or specific key value."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
-    _required_framework_version = (1, 1, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:

volatility/framework/plugins/windows/registry/userassist.py

@@ -23,6 +23,8 @@ vollog = logging.getLogger(__name__)
 class UserAssist(interfaces.plugins.PluginInterface):
     """Print userassist registry keys and information."""
 
+    _required_framework_version = (2, 0, 0)
+
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self._userassist_size = 0

volatility/framework/plugins/windows/ssdt.py

@@ -18,6 +18,7 @@ from volatility.plugins.windows import modules
 class SSDT(plugins.PluginInterface):
     """Lists the system call table."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/strings.py

@@ -19,6 +19,7 @@ vollog = logging.getLogger(__name__)
 class Strings(interfaces.plugins.PluginInterface):
     """Reads output from the strings command and indicates which process(es) each string belongs to."""
 
+    _required_framework_version = (2, 0, 0)
     strings_pattern = re.compile(rb"(?:\W*)([0-9]+)(?:\W*)(\w[\w\W]+)\n?")
 
     @classmethod

volatility/framework/plugins/windows/svcscan.py

@@ -20,6 +20,7 @@ vollog = logging.getLogger(__name__)
 class SvcScan(interfaces.plugins.PluginInterface):
     """Scans for windows services."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/symlinkscan.py

@@ -15,6 +15,8 @@ from volatility.plugins.windows import poolscanner
 class SymlinkScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
     """Scans for links present in a particular windows memory image."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [

volatility/framework/plugins/windows/vadinfo.py

@@ -33,6 +33,7 @@ winnt_protections = {
 class VadInfo(interfaces.plugins.PluginInterface):
     """Lists process memory ranges."""
 
+    _required_framework_version = (2, 0, 0)
     _version = (1, 1, 0)
     MAXSIZE_DEFAULT = 0
 

volatility/framework/plugins/windows/vadyarascan.py

@@ -21,6 +21,8 @@ except ImportError:
 
 class VadYaraScan(interfaces.plugins.PluginInterface):
     """Scans all the Virtual Address Descriptor memory maps using yara."""
+
+    _required_framework_version = (2, 0, 0)
     _version = (1, 0, 0)
 
     @classmethod

volatility/framework/plugins/windows/verinfo.py

@@ -25,6 +25,8 @@ except ImportError:
 class VerInfo(interfaces.plugins.PluginInterface):
     """Lists version information from PE files."""
 
+    _required_framework_version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
         ## TODO: we might add a regex option on the name later, but otherwise we're good

volatility/framework/plugins/windows/virtmap.py

@@ -16,8 +16,7 @@ vollog = logging.getLogger(__name__)
 class VirtMap(interfaces.plugins.PluginInterface):
     """Lists virtual mapped sections."""
 
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
+    _required_framework_version = (2, 0, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: