diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index 51adb8ef5..8ed8836a5 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -12,6 +12,7 @@ User interfaces make use of the framework to: """ import argparse +import glob import inspect import json import logging @@ -138,6 +139,10 @@ class CommandLine(interfaces.plugins.FileConsumerInterface): help = "Write configuration JSON file out to config.json", default = False, action = 'store_true') + parser.add_argument("--clear-cache", + help = "Clears out all short-term cached items", + default = False, + action = 'store_true') # We have to filter out help, otherwise parse_known_args will trigger the help message before having # processed the plugin choice or had the plugin subparser added. @@ -181,6 +186,10 @@ class CommandLine(interfaces.plugins.FileConsumerInterface): else: constants.PARALLELISM = constants.Parallelism.Off + if partial_args.clear_cache: + for cache_filename in glob.glob(os.path.join(constants.CACHE_PATH, '*.cache')): + os.unlink(cache_filename) + # Do the initialization ctx = contexts.Context() # Construct a blank context failures = framework.import_files(volatility.plugins, diff --git a/volatility/cli/volshell/__init__.py b/volatility/cli/volshell/__init__.py index 8fdcae1e1..07e0ac030 100644 --- a/volatility/cli/volshell/__init__.py +++ b/volatility/cli/volshell/__init__.py @@ -84,6 +84,10 @@ class VolShell(cli.CommandLine): help = "Write configuration JSON file out to config.json", default = False, action = 'store_true') + parser.add_argument("--clear-cache", + help = "Clears out all short-term cached items", + default = False, + action = 'store_true') # Volshell specific flags os_specific = parser.add_mutually_exclusive_group(required = False) @@ -118,11 +122,16 @@ class VolShell(cli.CommandLine): file_logger.setFormatter(file_formatter) vollog.addHandler(file_logger) vollog.info("Logging started") + if partial_args.verbosity < 3: console.setLevel(30 - (partial_args.verbosity * 10)) else: console.setLevel(10 - (partial_args.verbosity - 2)) + if partial_args.clear_cache: + for cache_filename in glob.glob(os.path.join(constants.CACHE_PATH, '*.cache')): + os.unlink(cache_filename) + # Do the initialization ctx = contexts.Context() # Construct a blank context failures = framework.import_files(volatility.plugins, diff --git a/volatility/framework/layers/resources.py b/volatility/framework/layers/resources.py index 9b79a2d95..5d01bc3dd 100644 --- a/volatility/framework/layers/resources.py +++ b/volatility/framework/layers/resources.py @@ -71,10 +71,9 @@ class ResourceAccessor(object): except error.URLError as excp: if excp.args: # TODO: As of python3.7 this can be removed - unverified_retrieval = (hasattr(ssl, "SSLCertVerificationError") and isinstance(excp.args[0], - ssl.SSLCertVerificationError)) or ( - isinstance(excp.args[0], ssl.SSLError) and excp.args[ - 0].reason == "CERTIFICATE_VERIFY_FAILED") + unverified_retrieval = (hasattr(ssl, "SSLCertVerificationError") and isinstance( + excp.args[0], ssl.SSLCertVerificationError)) or (isinstance(excp.args[0], ssl.SSLError) and + excp.args[0].reason == "CERTIFICATE_VERIFY_FAILED") if unverified_retrieval: vollog.warning("SSL certificate verification failed: attempting UNVERIFIED retrieval") non_verifying_ctx = ssl.SSLContext() @@ -97,7 +96,7 @@ class ResourceAccessor(object): # TODO: find a way to check if we already have this file (look at http headers?) block_size = 1028 * 8 temp_filename = os.path.join(constants.CACHE_PATH, - "data_" + hashlib.sha512(bytes(url, 'latin-1')).hexdigest()) + "data_" + hashlib.sha512(bytes(url, 'latin-1')).hexdigest() + ".cache") if not os.path.exists(temp_filename): vollog.debug("Caching file at: {}".format(temp_filename)) diff --git a/volatility/schemas/__init__.py b/volatility/schemas/__init__.py index 1c66cdf42..3fe70ae5c 100644 --- a/volatility/schemas/__init__.py +++ b/volatility/schemas/__init__.py @@ -12,7 +12,7 @@ from volatility.framework import constants vollog = logging.getLogger(__name__) -cached_validation_filepath = os.path.join(constants.CACHE_PATH, "valid_isf.cache") +cached_validation_filepath = os.path.join(constants.CACHE_PATH, "valid_isf.hashcache") def load_cached_validations() -> Set[str]: