From d14ba9e96e8a34d1cf3ac81e7bfa7d3a79dd990e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 20 Jan 2021 21:29:30 +0000 Subject: [PATCH] Core: Roll the version number back to 1.0.0 --- volatility3/cli/__init__.py | 2 +- volatility3/cli/volshell/__init__.py | 2 +- volatility3/cli/volshell/generic.py | 2 +- volatility3/framework/constants/__init__.py | 2 +- volatility3/framework/interfaces/plugins.py | 4 ++-- volatility3/framework/plugins/banners.py | 2 +- volatility3/framework/plugins/configwriter.py | 2 +- volatility3/framework/plugins/frameworkinfo.py | 2 +- volatility3/framework/plugins/isfinfo.py | 2 +- volatility3/framework/plugins/layerwriter.py | 2 +- volatility3/framework/plugins/linux/bash.py | 2 +- volatility3/framework/plugins/linux/check_afinfo.py | 2 +- volatility3/framework/plugins/linux/check_creds.py | 2 +- volatility3/framework/plugins/linux/check_idt.py | 2 +- volatility3/framework/plugins/linux/check_modules.py | 2 +- volatility3/framework/plugins/linux/check_syscall.py | 2 +- volatility3/framework/plugins/linux/elfs.py | 2 +- volatility3/framework/plugins/linux/keyboard_notifiers.py | 2 +- volatility3/framework/plugins/linux/lsmod.py | 2 +- volatility3/framework/plugins/linux/lsof.py | 2 +- volatility3/framework/plugins/linux/malfind.py | 2 +- volatility3/framework/plugins/linux/proc.py | 2 +- volatility3/framework/plugins/linux/pslist.py | 2 +- volatility3/framework/plugins/linux/pstree.py | 2 +- volatility3/framework/plugins/linux/tty_check.py | 2 +- volatility3/framework/plugins/mac/bash.py | 2 +- volatility3/framework/plugins/mac/check_syscall.py | 2 +- volatility3/framework/plugins/mac/check_sysctl.py | 2 +- volatility3/framework/plugins/mac/check_trap_table.py | 2 +- volatility3/framework/plugins/mac/ifconfig.py | 2 +- volatility3/framework/plugins/mac/kauth_listeners.py | 2 +- volatility3/framework/plugins/mac/kauth_scopes.py | 2 +- volatility3/framework/plugins/mac/kevents.py | 2 +- volatility3/framework/plugins/mac/lsmod.py | 2 +- volatility3/framework/plugins/mac/lsof.py | 2 +- volatility3/framework/plugins/mac/malfind.py | 2 +- volatility3/framework/plugins/mac/mount.py | 2 +- volatility3/framework/plugins/mac/netstat.py | 2 +- volatility3/framework/plugins/mac/proc_maps.py | 2 +- volatility3/framework/plugins/mac/psaux.py | 2 +- volatility3/framework/plugins/mac/pslist.py | 2 +- volatility3/framework/plugins/mac/pstree.py | 2 +- volatility3/framework/plugins/mac/socket_filters.py | 2 +- volatility3/framework/plugins/mac/timers.py | 2 +- volatility3/framework/plugins/mac/trustedbsd.py | 2 +- volatility3/framework/plugins/mac/vfsevents.py | 2 +- volatility3/framework/plugins/timeliner.py | 2 +- volatility3/framework/plugins/windows/bigpools.py | 2 +- volatility3/framework/plugins/windows/cachedump.py | 2 +- volatility3/framework/plugins/windows/callbacks.py | 2 +- volatility3/framework/plugins/windows/cmdline.py | 2 +- volatility3/framework/plugins/windows/dlllist.py | 2 +- volatility3/framework/plugins/windows/driverirp.py | 2 +- volatility3/framework/plugins/windows/driverscan.py | 2 +- volatility3/framework/plugins/windows/dumpfiles.py | 2 +- volatility3/framework/plugins/windows/envars.py | 2 +- volatility3/framework/plugins/windows/filescan.py | 2 +- volatility3/framework/plugins/windows/getservicesids.py | 2 +- volatility3/framework/plugins/windows/getsids.py | 2 +- volatility3/framework/plugins/windows/handles.py | 2 +- volatility3/framework/plugins/windows/hashdump.py | 2 +- volatility3/framework/plugins/windows/info.py | 2 +- volatility3/framework/plugins/windows/lsadump.py | 2 +- volatility3/framework/plugins/windows/malfind.py | 2 +- volatility3/framework/plugins/windows/memmap.py | 2 +- volatility3/framework/plugins/windows/modscan.py | 2 +- volatility3/framework/plugins/windows/modules.py | 2 +- volatility3/framework/plugins/windows/mutantscan.py | 2 +- volatility3/framework/plugins/windows/netscan.py | 2 +- volatility3/framework/plugins/windows/poolscanner.py | 2 +- volatility3/framework/plugins/windows/privileges.py | 2 +- volatility3/framework/plugins/windows/pslist.py | 2 +- volatility3/framework/plugins/windows/psscan.py | 2 +- volatility3/framework/plugins/windows/pstree.py | 2 +- volatility3/framework/plugins/windows/registry/hivelist.py | 4 ++-- volatility3/framework/plugins/windows/registry/hivescan.py | 2 +- volatility3/framework/plugins/windows/registry/printkey.py | 2 +- volatility3/framework/plugins/windows/registry/userassist.py | 2 +- volatility3/framework/plugins/windows/ssdt.py | 2 +- volatility3/framework/plugins/windows/strings.py | 2 +- volatility3/framework/plugins/windows/svcscan.py | 2 +- volatility3/framework/plugins/windows/symlinkscan.py | 2 +- volatility3/framework/plugins/windows/vadinfo.py | 2 +- volatility3/framework/plugins/windows/vadyarascan.py | 2 +- volatility3/framework/plugins/windows/verinfo.py | 2 +- volatility3/framework/plugins/windows/virtmap.py | 2 +- volatility3/framework/plugins/yarascan.py | 2 +- volatility3/plugins/windows/registry/certificates.py | 2 +- volatility3/plugins/windows/statistics.py | 2 +- 89 files changed, 91 insertions(+), 91 deletions(-) diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index a90404d0a..02b8d1cb0 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -87,7 +87,7 @@ class CommandLine: """Executes the command line module, taking the system arguments, determining the plugin to run and then running it.""" - volatility3.framework.require_interface_version(2, 0, 0) + volatility3.framework.require_interface_version(1, 0, 0) renderers = dict([(x.name.lower(), x) for x in framework.class_subclasses(text_renderer.CLIRenderer)]) diff --git a/volatility3/cli/volshell/__init__.py b/volatility3/cli/volshell/__init__.py index 122107d0f..4a7cb5380 100644 --- a/volatility3/cli/volshell/__init__.py +++ b/volatility3/cli/volshell/__init__.py @@ -42,7 +42,7 @@ class VolShell(cli.CommandLine): determining the plugin to run and then running it.""" sys.stdout.write("Volshell (Volatility 3 Framework) {}\n".format(constants.PACKAGE_VERSION)) - framework.require_interface_version(2, 0, 0) + framework.require_interface_version(1, 0, 0) parser = argparse.ArgumentParser(prog = 'volshell', description = "A tool for interactivate forensic analysis of memory images") diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index a2a156ac4..19d398ba9 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -26,7 +26,7 @@ except ImportError: class Volshell(interfaces.plugins.PluginInterface): """Shell environment to directly interact with a memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/constants/__init__.py b/volatility3/framework/constants/__init__.py index 9e014122b..5a5e5f1c5 100644 --- a/volatility3/framework/constants/__init__.py +++ b/volatility3/framework/constants/__init__.py @@ -38,7 +38,7 @@ BANG = "!" """Constant used to delimit table names from type names when referring to a symbol""" # We use the SemVer 2.0.0 versioning scheme -VERSION_MAJOR = 2 # Number of releases of the library with a breaking change +VERSION_MAJOR = 1 # Number of releases of the library with a breaking change VERSION_MINOR = 0 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" diff --git a/volatility3/framework/interfaces/plugins.py b/volatility3/framework/interfaces/plugins.py index 3ab602903..5649629ca 100644 --- a/volatility3/framework/interfaces/plugins.py +++ b/volatility3/framework/interfaces/plugins.py @@ -94,8 +94,8 @@ class PluginInterface(interfaces.configuration.ConfigurableInterface, and configuration information in the context it is passed. """ - # Be careful with inheritance around this - _required_framework_version = (1, 0, 0) # type: Tuple[int, int, int] + # Be careful with inheritance around this (We default to requiring a version which doesn't exist, so it must be set) + _required_framework_version = (0, 0, 0) # type: Tuple[int, int, int] """The _version variable is a quick way for plugins to define their current interface, it should follow SemVer rules""" def __init__(self, diff --git a/volatility3/framework/plugins/banners.py b/volatility3/framework/plugins/banners.py index ac2006207..c907497ed 100644 --- a/volatility3/framework/plugins/banners.py +++ b/volatility3/framework/plugins/banners.py @@ -15,7 +15,7 @@ vollog = logging.getLogger(__name__) class Banners(interfaces.plugins.PluginInterface): """Attempts to identify potential linux banners in an image""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/configwriter.py b/volatility3/framework/plugins/configwriter.py index 3c2da6ce3..6dc504fb5 100644 --- a/volatility3/framework/plugins/configwriter.py +++ b/volatility3/framework/plugins/configwriter.py @@ -17,7 +17,7 @@ class ConfigWriter(plugins.PluginInterface): """Runs the automagics and both prints and outputs configuration in the output directory.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/frameworkinfo.py b/volatility3/framework/plugins/frameworkinfo.py index b7c887d5c..8d9f3b013 100644 --- a/volatility3/framework/plugins/frameworkinfo.py +++ b/volatility3/framework/plugins/frameworkinfo.py @@ -8,7 +8,7 @@ from volatility3.framework.interfaces import plugins class FrameworkInfo(plugins.PluginInterface): """Plugin to list the various modular components of Volatility""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/isfinfo.py b/volatility3/framework/plugins/isfinfo.py index 929c95cdf..c1f5daef1 100644 --- a/volatility3/framework/plugins/isfinfo.py +++ b/volatility3/framework/plugins/isfinfo.py @@ -22,7 +22,7 @@ vollog = logging.getLogger(__name__) class IsfInfo(plugins.PluginInterface): """Determines information about the currently available ISF files, or a specific one""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/layerwriter.py b/volatility3/framework/plugins/layerwriter.py index 53f07701f..721845fd3 100644 --- a/volatility3/framework/plugins/layerwriter.py +++ b/volatility3/framework/plugins/layerwriter.py @@ -17,7 +17,7 @@ class LayerWriter(plugins.PluginInterface): default_block_size = 0x500000 - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (2, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/linux/bash.py b/volatility3/framework/plugins/linux/bash.py index 9d43a59d3..8e6de7241 100644 --- a/volatility3/framework/plugins/linux/bash.py +++ b/volatility3/framework/plugins/linux/bash.py @@ -21,7 +21,7 @@ from volatility3.plugins.linux import pslist class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): """Recovers bash command history from memory.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/check_afinfo.py b/volatility3/framework/plugins/linux/check_afinfo.py index 1b38fe9be..29e697540 100644 --- a/volatility3/framework/plugins/linux/check_afinfo.py +++ b/volatility3/framework/plugins/linux/check_afinfo.py @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class Check_afinfo(plugins.PluginInterface): """Verifies the operation function pointers of network protocols.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/check_creds.py b/volatility3/framework/plugins/linux/check_creds.py index 0d87bce2a..2333eb123 100644 --- a/volatility3/framework/plugins/linux/check_creds.py +++ b/volatility3/framework/plugins/linux/check_creds.py @@ -14,7 +14,7 @@ vollog = logging.getLogger(__name__) class Check_creds(interfaces.plugins.PluginInterface): """Checks if any processes are sharing credential structures""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/linux/check_idt.py b/volatility3/framework/plugins/linux/check_idt.py index 0e021bb5c..f171ab846 100644 --- a/volatility3/framework/plugins/linux/check_idt.py +++ b/volatility3/framework/plugins/linux/check_idt.py @@ -17,7 +17,7 @@ vollog = logging.getLogger(__name__) class Check_idt(interfaces.plugins.PluginInterface): """ Checks if the IDT has been altered """ - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index bdd8d921d..449046e86 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class Check_modules(plugins.PluginInterface): """Compares module list to sysfs info, if available""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/check_syscall.py b/volatility3/framework/plugins/linux/check_syscall.py index 4a4381b8b..b845ad4aa 100644 --- a/volatility3/framework/plugins/linux/check_syscall.py +++ b/volatility3/framework/plugins/linux/check_syscall.py @@ -25,7 +25,7 @@ except ImportError: class Check_syscall(plugins.PluginInterface): """Check system call table for hooks.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/elfs.py b/volatility3/framework/plugins/linux/elfs.py index ac8b9fbfb..89909f4ff 100644 --- a/volatility3/framework/plugins/linux/elfs.py +++ b/volatility3/framework/plugins/linux/elfs.py @@ -17,7 +17,7 @@ from volatility3.plugins.linux import pslist class Elfs(plugins.PluginInterface): """Lists all memory mapped ELF files for all processes.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/keyboard_notifiers.py b/volatility3/framework/plugins/linux/keyboard_notifiers.py index cd7a70b34..290c0a180 100644 --- a/volatility3/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility3/framework/plugins/linux/keyboard_notifiers.py @@ -16,7 +16,7 @@ vollog = logging.getLogger(__name__) class Keyboard_notifiers(interfaces.plugins.PluginInterface): """Parses the keyboard notifier call chain""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index d75a9dff4..2d390cc82 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/linux/lsof.py b/volatility3/framework/plugins/linux/lsof.py index b9a686a44..153d28f6a 100644 --- a/volatility3/framework/plugins/linux/lsof.py +++ b/volatility3/framework/plugins/linux/lsof.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Lsof(plugins.PluginInterface): """Lists all memory maps for all processes.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py index 41339cca2..149222f37 100644 --- a/volatility3/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -15,7 +15,7 @@ from volatility3.plugins.linux import pslist class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/proc.py b/volatility3/framework/plugins/linux/proc.py index 53e9297de..8bd0db538 100644 --- a/volatility3/framework/plugins/linux/proc.py +++ b/volatility3/framework/plugins/linux/proc.py @@ -15,7 +15,7 @@ from volatility3.plugins.linux import pslist class Maps(plugins.PluginInterface): """Lists all memory maps for all processes.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index 4c6d294e1..78fce978b 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -12,7 +12,7 @@ from volatility3.framework.objects import utility class PsList(interfaces.plugins.PluginInterface): """Lists the processes present in a particular linux memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) diff --git a/volatility3/framework/plugins/linux/pstree.py b/volatility3/framework/plugins/linux/pstree.py index ff47be760..a187ea907 100644 --- a/volatility3/framework/plugins/linux/pstree.py +++ b/volatility3/framework/plugins/linux/pstree.py @@ -10,7 +10,7 @@ class PsTree(pslist.PsList): """Plugin for listing processes in a tree based on their parent process ID.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/linux/tty_check.py b/volatility3/framework/plugins/linux/tty_check.py index 3693b6150..fe35d8fa3 100644 --- a/volatility3/framework/plugins/linux/tty_check.py +++ b/volatility3/framework/plugins/linux/tty_check.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class tty_check(plugins.PluginInterface): """Checks tty devices for hooks""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/bash.py b/volatility3/framework/plugins/mac/bash.py index 3540db6fb..6b453759e 100644 --- a/volatility3/framework/plugins/mac/bash.py +++ b/volatility3/framework/plugins/mac/bash.py @@ -20,7 +20,7 @@ from volatility3.plugins.mac import pslist class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): """Recovers bash command history from memory.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/check_syscall.py b/volatility3/framework/plugins/mac/check_syscall.py index 530e2f031..4f367001e 100644 --- a/volatility3/framework/plugins/mac/check_syscall.py +++ b/volatility3/framework/plugins/mac/check_syscall.py @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class Check_syscall(plugins.PluginInterface): """Check system call table for hooks.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/check_sysctl.py b/volatility3/framework/plugins/mac/check_sysctl.py index 2096b291a..4ea1d8af0 100644 --- a/volatility3/framework/plugins/mac/check_sysctl.py +++ b/volatility3/framework/plugins/mac/check_sysctl.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class Check_sysctl(plugins.PluginInterface): """Check sysctl handlers for hooks.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/check_trap_table.py b/volatility3/framework/plugins/mac/check_trap_table.py index b2861d5d5..0584d9ff7 100644 --- a/volatility3/framework/plugins/mac/check_trap_table.py +++ b/volatility3/framework/plugins/mac/check_trap_table.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Check_trap_table(plugins.PluginInterface): """Check mach trap table for hooks.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/ifconfig.py b/volatility3/framework/plugins/mac/ifconfig.py index 501ba8a56..5c4e5728e 100644 --- a/volatility3/framework/plugins/mac/ifconfig.py +++ b/volatility3/framework/plugins/mac/ifconfig.py @@ -11,7 +11,7 @@ from volatility3.framework.symbols import mac class Ifconfig(plugins.PluginInterface): """Lists loaded kernel modules""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/kauth_listeners.py b/volatility3/framework/plugins/mac/kauth_listeners.py index f4bbeaa4c..930239db9 100644 --- a/volatility3/framework/plugins/mac/kauth_listeners.py +++ b/volatility3/framework/plugins/mac/kauth_listeners.py @@ -13,7 +13,7 @@ from volatility3.plugins.mac import lsmod, kauth_scopes class Kauth_listeners(interfaces.plugins.PluginInterface): """ Lists kauth listeners and their status """ - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/kauth_scopes.py b/volatility3/framework/plugins/mac/kauth_scopes.py index d63c72322..a5f57d9a1 100644 --- a/volatility3/framework/plugins/mac/kauth_scopes.py +++ b/volatility3/framework/plugins/mac/kauth_scopes.py @@ -16,7 +16,7 @@ class Kauth_scopes(interfaces.plugins.PluginInterface): """ Lists kauth scopes and their status """ _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/kevents.py b/volatility3/framework/plugins/mac/kevents.py index 45bb29305..a6d905102 100644 --- a/volatility3/framework/plugins/mac/kevents.py +++ b/volatility3/framework/plugins/mac/kevents.py @@ -14,7 +14,7 @@ from volatility3.plugins.mac import pslist class Kevents(interfaces.plugins.PluginInterface): """ Lists event handlers registered by processes """ - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) event_types = { 1: "EVFILT_READ", diff --git a/volatility3/framework/plugins/mac/lsmod.py b/volatility3/framework/plugins/mac/lsmod.py index 81639115d..b536a112b 100644 --- a/volatility3/framework/plugins/mac/lsmod.py +++ b/volatility3/framework/plugins/mac/lsmod.py @@ -13,7 +13,7 @@ from volatility3.framework.renderers import format_hints class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) diff --git a/volatility3/framework/plugins/mac/lsof.py b/volatility3/framework/plugins/mac/lsof.py index 38351009a..f4fb725a0 100644 --- a/volatility3/framework/plugins/mac/lsof.py +++ b/volatility3/framework/plugins/mac/lsof.py @@ -16,7 +16,7 @@ vollog = logging.getLogger(__name__) class Lsof(plugins.PluginInterface): """Lists all open file descriptors for all processes.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/malfind.py b/volatility3/framework/plugins/mac/malfind.py index 64d7b5010..20b46528b 100644 --- a/volatility3/framework/plugins/mac/malfind.py +++ b/volatility3/framework/plugins/mac/malfind.py @@ -14,7 +14,7 @@ from volatility3.plugins.mac import pslist class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/mount.py b/volatility3/framework/plugins/mac/mount.py index 57ea9e5b6..3500e5ff1 100644 --- a/volatility3/framework/plugins/mac/mount.py +++ b/volatility3/framework/plugins/mac/mount.py @@ -14,7 +14,7 @@ class Mount(plugins.PluginInterface): """A module containing a collection of plugins that produce data typically foundin Mac's mount command""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) diff --git a/volatility3/framework/plugins/mac/netstat.py b/volatility3/framework/plugins/mac/netstat.py index 3e04d5899..4b9f539fd 100644 --- a/volatility3/framework/plugins/mac/netstat.py +++ b/volatility3/framework/plugins/mac/netstat.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Netstat(plugins.PluginInterface): """Lists all network connections for all processes.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/proc_maps.py b/volatility3/framework/plugins/mac/proc_maps.py index 3a0bef5ba..2ff80c47e 100644 --- a/volatility3/framework/plugins/mac/proc_maps.py +++ b/volatility3/framework/plugins/mac/proc_maps.py @@ -12,7 +12,7 @@ from volatility3.plugins.mac import pslist class Maps(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/mac/psaux.py b/volatility3/framework/plugins/mac/psaux.py index 1bb720575..97f61c02e 100644 --- a/volatility3/framework/plugins/mac/psaux.py +++ b/volatility3/framework/plugins/mac/psaux.py @@ -14,7 +14,7 @@ from volatility3.plugins.mac import pslist class Psaux(plugins.PluginInterface): """Recovers program command line arguments.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/pslist.py b/volatility3/framework/plugins/mac/pslist.py index c9253e093..8ef7876f1 100644 --- a/volatility3/framework/plugins/mac/pslist.py +++ b/volatility3/framework/plugins/mac/pslist.py @@ -16,7 +16,7 @@ vollog = logging.getLogger(__name__) class PsList(interfaces.plugins.PluginInterface): """Lists the processes present in a particular mac memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (2, 0, 0) pslist_methods = ['tasks', 'allproc', 'process_group', 'sessions', 'pid_hash_table'] diff --git a/volatility3/framework/plugins/mac/pstree.py b/volatility3/framework/plugins/mac/pstree.py index e499aa300..ea70a5d4c 100644 --- a/volatility3/framework/plugins/mac/pstree.py +++ b/volatility3/framework/plugins/mac/pstree.py @@ -13,7 +13,7 @@ class PsTree(plugins.PluginInterface): """Plugin for listing processes in a tree based on their parent process ID.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/mac/socket_filters.py b/volatility3/framework/plugins/mac/socket_filters.py index b2bcba759..40fc6ffe0 100644 --- a/volatility3/framework/plugins/mac/socket_filters.py +++ b/volatility3/framework/plugins/mac/socket_filters.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Socket_filters(plugins.PluginInterface): """Enumerates kernel socket filters.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/timers.py b/volatility3/framework/plugins/mac/timers.py index 3169b2aeb..912388ffb 100644 --- a/volatility3/framework/plugins/mac/timers.py +++ b/volatility3/framework/plugins/mac/timers.py @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class Timers(plugins.PluginInterface): """Check for malicious kernel timers.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/trustedbsd.py b/volatility3/framework/plugins/mac/trustedbsd.py index d515959fb..b03663625 100644 --- a/volatility3/framework/plugins/mac/trustedbsd.py +++ b/volatility3/framework/plugins/mac/trustedbsd.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class Trustedbsd(plugins.PluginInterface): """Checks for malicious trustedbsd modules""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/mac/vfsevents.py b/volatility3/framework/plugins/mac/vfsevents.py index 9d4db7b97..97b23168c 100644 --- a/volatility3/framework/plugins/mac/vfsevents.py +++ b/volatility3/framework/plugins/mac/vfsevents.py @@ -10,7 +10,7 @@ from volatility3.framework.objects import utility class VFSevents(interfaces.plugins.PluginInterface): """ Lists processes that are filtering file system events """ - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) event_types = [ "CREATE_FILE", "DELETE", "STAT_CHANGED", "RENAME", "CONTENT_MODIFIED", "EXCHANGE", "FINDER_INFO_CHANGED", diff --git a/volatility3/framework/plugins/timeliner.py b/volatility3/framework/plugins/timeliner.py index 2ec4d6961..bd6377ca1 100644 --- a/volatility3/framework/plugins/timeliner.py +++ b/volatility3/framework/plugins/timeliner.py @@ -42,7 +42,7 @@ class Timeliner(interfaces.plugins.PluginInterface): """Runs all relevant plugins that provide time related information and orders the results by time.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/bigpools.py b/volatility3/framework/plugins/windows/bigpools.py index 12d4d1f28..a2c23a31c 100644 --- a/volatility3/framework/plugins/windows/bigpools.py +++ b/volatility3/framework/plugins/windows/bigpools.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class BigPools(interfaces.plugins.PluginInterface): """List big page pools.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 02e3a540c..42bb93a73 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -17,7 +17,7 @@ from volatility3.plugins.windows.registry import hivelist class Cachedump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py index 7702d67a7..545ff9811 100644 --- a/volatility3/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Callbacks(interfaces.plugins.PluginInterface): """Lists kernel callbacks and notification routines.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/cmdline.py b/volatility3/framework/plugins/windows/cmdline.py index dfcf07f38..bf5cc4bfe 100644 --- a/volatility3/framework/plugins/windows/cmdline.py +++ b/volatility3/framework/plugins/windows/cmdline.py @@ -15,7 +15,7 @@ vollog = logging.getLogger(__name__) class CmdLine(interfaces.plugins.PluginInterface): """Lists process command line arguments.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index c5912afa9..4740e5751 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the loaded modules in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (2, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/driverirp.py b/volatility3/framework/plugins/windows/driverirp.py index 27f86f3b0..64231b9db 100644 --- a/volatility3/framework/plugins/windows/driverirp.py +++ b/volatility3/framework/plugins/windows/driverirp.py @@ -22,7 +22,7 @@ MAJOR_FUNCTIONS = [ class DriverIrp(interfaces.plugins.PluginInterface): """List IRPs for drivers in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/windows/driverscan.py b/volatility3/framework/plugins/windows/driverscan.py index be941836f..7b44d4ebc 100644 --- a/volatility3/framework/plugins/windows/driverscan.py +++ b/volatility3/framework/plugins/windows/driverscan.py @@ -13,7 +13,7 @@ from volatility3.plugins.windows import poolscanner class DriverScan(interfaces.plugins.PluginInterface): """Scans for drivers present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py index e73de42fa..757dbd3c3 100755 --- a/volatility3/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -25,7 +25,7 @@ EXTENSION_CACHE_MAP = { class DumpFiles(interfaces.plugins.PluginInterface): """Dumps cached file contents from Windows memory samples.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py index 7abcfa159..8d3ee8506 100644 --- a/volatility3/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -16,7 +16,7 @@ class Envars(interfaces.plugins.PluginInterface): "Display process environment variables" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/windows/filescan.py b/volatility3/framework/plugins/windows/filescan.py index b53352b6e..e1756630d 100644 --- a/volatility3/framework/plugins/windows/filescan.py +++ b/volatility3/framework/plugins/windows/filescan.py @@ -13,7 +13,7 @@ from volatility3.plugins.windows import poolscanner class FileScan(interfaces.plugins.PluginInterface): """Scans for file objects present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py index c2029b937..2b5ab11f4 100644 --- a/volatility3/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -31,7 +31,7 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): """Lists process token sids.""" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index c9aa9cc5c..30503b2bf 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -29,7 +29,7 @@ class GetSIDs(interfaces.plugins.PluginInterface): """Print the SIDs owning each process""" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 2951a5bdc..d08f888e3 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -24,7 +24,7 @@ except ImportError: class Handles(interfaces.plugins.PluginInterface): """Lists process open handles.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) def __init__(self, *args, **kwargs): diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index d78684beb..ed2f1988a 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -21,7 +21,7 @@ vollog = logging.getLogger(__name__) class Hashdump(interfaces.plugins.PluginInterface): """Dumps user hashes from memory""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/windows/info.py b/volatility3/framework/plugins/windows/info.py index 3cb4f1bb7..76b81eb00 100644 --- a/volatility3/framework/plugins/windows/info.py +++ b/volatility3/framework/plugins/windows/info.py @@ -16,7 +16,7 @@ from volatility3.framework.symbols.windows import extensions class Info(plugins.PluginInterface): """Show OS & kernel details of the memory sample being analyzed.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 538933f7b..b9f8df9fe 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Lsadump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py index ed35ef649..eedd3b715 100644 --- a/volatility3/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -17,7 +17,7 @@ vollog = logging.getLogger(__name__) class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/windows/memmap.py b/volatility3/framework/plugins/windows/memmap.py index 42cf3b9b0..86d453115 100644 --- a/volatility3/framework/plugins/windows/memmap.py +++ b/volatility3/framework/plugins/windows/memmap.py @@ -15,7 +15,7 @@ vollog = logging.getLogger(__name__) class Memmap(interfaces.plugins.PluginInterface): """Prints the memory map""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/windows/modscan.py b/volatility3/framework/plugins/windows/modscan.py index 0a5cb7c9a..13b23577f 100644 --- a/volatility3/framework/plugins/windows/modscan.py +++ b/volatility3/framework/plugins/windows/modscan.py @@ -17,7 +17,7 @@ vollog = logging.getLogger(__name__) class ModScan(interfaces.plugins.PluginInterface): """Scans for modules present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index e1384a015..b030066db 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Modules(interfaces.plugins.PluginInterface): """Lists the loaded kernel modules.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 1, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/mutantscan.py b/volatility3/framework/plugins/windows/mutantscan.py index c886960c6..c0a47d38e 100644 --- a/volatility3/framework/plugins/windows/mutantscan.py +++ b/volatility3/framework/plugins/windows/mutantscan.py @@ -13,7 +13,7 @@ from volatility3.plugins.windows import poolscanner class MutantScan(interfaces.plugins.PluginInterface): """Scans for mutexes present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py index cb455aa03..0f58c97f5 100644 --- a/volatility3/framework/plugins/windows/netscan.py +++ b/volatility3/framework/plugins/windows/netscan.py @@ -21,7 +21,7 @@ vollog = logging.getLogger(__name__) class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for network objects present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index f61c8566b..b2ea449ea 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -115,7 +115,7 @@ class PoolScanner(plugins.PluginInterface): """A generic pool scanner plugin.""" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/windows/privileges.py b/volatility3/framework/plugins/windows/privileges.py index cfd2d70e0..8c652daa6 100644 --- a/volatility3/framework/plugins/windows/privileges.py +++ b/volatility3/framework/plugins/windows/privileges.py @@ -17,7 +17,7 @@ class Privs(interfaces.plugins.PluginInterface): """Lists process token privileges""" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index 1428936f0..f9fb20aaf 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the processes present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (2, 0, 0) PHYSICAL_DEFAULT = False diff --git a/volatility3/framework/plugins/windows/psscan.py b/volatility3/framework/plugins/windows/psscan.py index 2458ee42e..a5e20ef62 100644 --- a/volatility3/framework/plugins/windows/psscan.py +++ b/volatility3/framework/plugins/windows/psscan.py @@ -22,7 +22,7 @@ vollog = logging.getLogger(__name__) class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for processes present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 1, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/pstree.py b/volatility3/framework/plugins/windows/pstree.py index 0d79d3d5b..3b695ea70 100644 --- a/volatility3/framework/plugins/windows/pstree.py +++ b/volatility3/framework/plugins/windows/pstree.py @@ -14,7 +14,7 @@ class PsTree(interfaces.plugins.PluginInterface): """Plugin for listing processes in a tree based on their parent process ID.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs) -> None: super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/registry/hivelist.py b/volatility3/framework/plugins/windows/registry/hivelist.py index d5ac804a5..249118c8e 100644 --- a/volatility3/framework/plugins/windows/registry/hivelist.py +++ b/volatility3/framework/plugins/windows/registry/hivelist.py @@ -17,7 +17,7 @@ class HiveGenerator: """Walks the registry HiveList linked list in a given direction and stores an invalid offset if it's unable to fully walk the list""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, cmhive, forward = True): self._cmhive = cmhive @@ -40,7 +40,7 @@ class HiveList(interfaces.plugins.PluginInterface): """Lists the registry hives present in a particular memory image.""" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/windows/registry/hivescan.py b/volatility3/framework/plugins/windows/registry/hivescan.py index 558638cfd..ac04fcc02 100644 --- a/volatility3/framework/plugins/windows/registry/hivescan.py +++ b/volatility3/framework/plugins/windows/registry/hivescan.py @@ -15,7 +15,7 @@ class HiveScan(interfaces.plugins.PluginInterface): """Scans for registry hives present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index 5709b246d..5b0a909fc 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class PrintKey(interfaces.plugins.PluginInterface): """Lists the registry keys under a hive or specific key value.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index 16e997d0f..b2ce971bf 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -23,7 +23,7 @@ vollog = logging.getLogger(__name__) class UserAssist(interfaces.plugins.PluginInterface): """Print userassist registry keys and information.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/ssdt.py b/volatility3/framework/plugins/windows/ssdt.py index c510dec92..8092beb2f 100644 --- a/volatility3/framework/plugins/windows/ssdt.py +++ b/volatility3/framework/plugins/windows/ssdt.py @@ -18,7 +18,7 @@ from volatility3.plugins.windows import modules class SSDT(plugins.PluginInterface): """Lists the system call table.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/strings.py b/volatility3/framework/plugins/windows/strings.py index 8b18ef812..3e9fdfb85 100644 --- a/volatility3/framework/plugins/windows/strings.py +++ b/volatility3/framework/plugins/windows/strings.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class Strings(interfaces.plugins.PluginInterface): """Reads output from the strings command and indicates which process(es) each string belongs to.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) strings_pattern = re.compile(rb"(?:\W*)([0-9]+)(?:\W*)(\w[\w\W]+)\n?") @classmethod diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py index 23648ada2..4820e5735 100644 --- a/volatility3/framework/plugins/windows/svcscan.py +++ b/volatility3/framework/plugins/windows/svcscan.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class SvcScan(interfaces.plugins.PluginInterface): """Scans for windows services.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/symlinkscan.py b/volatility3/framework/plugins/windows/symlinkscan.py index 7d8a54869..abfbd1d6d 100644 --- a/volatility3/framework/plugins/windows/symlinkscan.py +++ b/volatility3/framework/plugins/windows/symlinkscan.py @@ -15,7 +15,7 @@ from volatility3.plugins.windows import poolscanner class SymlinkScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for links present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py index 8d4ca027a..d50f596aa 100644 --- a/volatility3/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -33,7 +33,7 @@ winnt_protections = { class VadInfo(interfaces.plugins.PluginInterface): """Lists process memory ranges.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (2, 0, 0) MAXSIZE_DEFAULT = 0 diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index bf597140f..cdb349cf8 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -17,7 +17,7 @@ vollog = logging.getLogger(__name__) class VadYaraScan(interfaces.plugins.PluginInterface): """Scans all the Virtual Address Descriptor memory maps using yara.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/verinfo.py b/volatility3/framework/plugins/windows/verinfo.py index 52c8e462a..d65402a6a 100644 --- a/volatility3/framework/plugins/windows/verinfo.py +++ b/volatility3/framework/plugins/windows/verinfo.py @@ -25,7 +25,7 @@ except ImportError: class VerInfo(interfaces.plugins.PluginInterface): """Lists version information from PE files.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/windows/virtmap.py b/volatility3/framework/plugins/windows/virtmap.py index 93ec763cc..552564cad 100644 --- a/volatility3/framework/plugins/windows/virtmap.py +++ b/volatility3/framework/plugins/windows/virtmap.py @@ -16,7 +16,7 @@ vollog = logging.getLogger(__name__) class VirtMap(interfaces.plugins.PluginInterface): """Lists virtual mapped sections.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py index 8c49c0824..1c04e2311 100644 --- a/volatility3/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -37,7 +37,7 @@ class YaraScanner(interfaces.layers.ScannerInterface): class YaraScan(plugins.PluginInterface): """Scans kernel memory using yara rules (string or file).""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index fac98423a..909e852fb 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -10,7 +10,7 @@ from volatility3.plugins.windows.registry import hivelist, printkey class Certificates(interfaces.plugins.PluginInterface): """Lists the certificates in the registry's Certificate Store.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/plugins/windows/statistics.py b/volatility3/plugins/windows/statistics.py index e6f2016ed..b3bc8044f 100644 --- a/volatility3/plugins/windows/statistics.py +++ b/volatility3/plugins/windows/statistics.py @@ -13,7 +13,7 @@ vollog = logging.getLogger(__name__) class Statistics(plugins.PluginInterface): - _required_framework_version = (2, 0, 0) + _required_framework_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: