Rerun pylint with pycharm-5 and fix pep8 issues as well.

test_rig.py

@@ -4,13 +4,13 @@ Created on 10 Mar 2013
 @author: mike
 """
 
-import pdb
 import logging
+import pdb
 
 from volatility import framework
 from volatility.framework import contexts
-from volatility.framework.interfaces import objects
 from volatility.framework import xp_sp2_x86_vtypes, layers, plugins
+from volatility.framework.interfaces import objects
 from volatility.framework.symbols import vtypes, native
 
 

vol.py

@@ -3,4 +3,4 @@ __author__ = 'mike'
 import volatility.cli
 
 if __name__ == '__main__':
-    volatility.cli.main()
+    volatility.cli.main()

volatility/cli/__init__.py

@@ -1,10 +1,10 @@
 import argparse
-import sys
 import logging
+import sys
 
-from volatility.cli import argparse_adapter
 import volatility.framework
 import volatility.plugins
+from volatility.cli import argparse_adapter
 from volatility.framework import interfaces, plugins, configuration, contexts
 
 __author__ = 'mike'
@@ -75,6 +75,5 @@ class CommandLine(object):
         return context, req_mapping
 
 
-
 def main():
     CommandLine().run()

volatility/framework/__init__.py

@@ -37,6 +37,3 @@ def require_version(*args):
 
 
 from volatility.framework import interfaces, symbols, layers, contexts, configuration
-
-
-

volatility/framework/contexts/__init__.py

@@ -1,14 +1,9 @@
 from volatility.framework import validity, interfaces, symbols, layers
+from volatility.framework.contexts import intel, physical, windows
 from volatility.framework.interfaces.context import ContextModifierInterface
-from volatility.framework.symbols import native
-import volatility
-
 
 __author__ = 'mike'
 
-from volatility.framework.contexts import intel, physical, windows
-from volatility.framework import configuration
-
 
 class LayerFactory(validity.ValidityRoutines, list):
     """Class to establish and load the appropriate components of the context for a given operating system"""

volatility/framework/contexts/intel.py

@@ -7,28 +7,27 @@ class IntelContextModifier(interfaces.context.ContextModifierInterface):
     @classmethod
     def requirements(cls):
         return [configuration.ChoiceRequirement(name = "architecture",
-                                         choices = ["auto", "pae", "32", "64"],
-                                         description = "Determines the memory image",
-                                         default = "auto"),
+                                                choices = ["auto", "pae", "32", "64"],
+                                                description = "Determines the memory image",
+                                                default = "auto"),
                 configuration.IntRequirement(name = "page_map_offset",
-                                         description = "Offset to the directory table base"),
+                                             description = "Offset to the directory table base"),
                 configuration.StringRequirement(name = 'layer_name',
-                                         description = 'Name of the layer to be added to the memory space',
-                                         default = 'intel'),
+                                                description = 'Name of the layer to be added to the memory space',
+                                                default = 'intel'),
                 configuration.TranslationLayerRequirement(name = 'physical_layer',
-                                         description = 'Physical Address Space',
-                                         os_type = 'windows',
-                                         architectures = None,
-                                         layer_type = 'physical'),
+                                                          description = 'Physical Address Space',
+                                                          os_type = 'windows',
+                                                          architectures = None,
+                                                          layer_type = 'physical'),
                 configuration.TranslationLayerRequirement(name = 'swap_layer',
-                                         description = "Layer name for the swap layer",
-                                         optional = True)]
+                                                          description = "Layer name for the swap layer",
+                                                          optional = True)]
 
     def modify_context(self, context):
         # TODO: Attempt to determine whether the image is 32, PAE or x64 (although the context must already know whether it is x64)
         config = self.config_get(context)
 
-        layer = None
         if config.get('architecture') == 'pae':
             layer = layers.intel.IntelPAE
         elif config.get('architecture') == '32':
@@ -36,10 +35,10 @@ class IntelContextModifier(interfaces.context.ContextModifierInterface):
         elif config.get('architecture') == '64':
             layer = layers.intel.Intel32e
         else:
-            #TODO: Add automagic here
+            # TODO: Add automagic here
             layer = layers.intel.IntelPAE
 
         intel = layer(context, config.get_value('layer_name'),
-                               config.get_value('physical_layer').name,
-                               page_map_offset = config.get_value('page_map_offset'))
+                      config.get_value('physical_layer').name,
+                      page_map_offset = config.get_value('page_map_offset'))
         context.add_layer(intel)

volatility/framework/contexts/physical.py

@@ -7,11 +7,11 @@ class PhysicalContextModifier(interfaces.context.ContextModifierInterface):
     @classmethod
     def requirements(cls):
         return [configuration.StringRequirement(name = 'location',
-                                         description = 'URL to the physical address space',
-                                         default = '/home/mike/memory/jon-fres.dmp'),
+                                                description = 'URL to the physical address space',
+                                                default = '/home/mike/memory/jon-fres.dmp'),
                 configuration.StringRequirement(name = 'layer_name',
-                                         description = 'Layer name for the physical space',
-                                         default = 'physical')]
+                                                description = 'Layer name for the physical space',
+                                                default = 'physical')]
 
     def modify_context(self, context):
         # Ideally allow for the plugin to specify the layering, but if not then guess at the best one
@@ -20,4 +20,3 @@ class PhysicalContextModifier(interfaces.context.ContextModifierInterface):
                                          modconfig.get_value('layer_name'),
                                          filename = modconfig.get_value('location'))
         context.add_layer(base)
-

volatility/framework/contexts/windows.py

@@ -6,7 +6,8 @@ __author__ = 'mike'
 
 class WindowsContextModifier(interfaces.context.ContextModifierInterface):
     # TODO: Only import the vtypes only when necessary
-    def __init__(self, config):
+    def __init__(self, namespace):
+        interfaces.context.ContextModifierInterface.__init__(namespace)
         from volatility.framework import xp_sp2_x86_vtypes
 
         self._virtual_types = xp_sp2_x86_vtypes.ntkrnlmp_types

volatility/framework/interfaces/configuration.py

@@ -1,5 +1,5 @@
-from abc import ABCMeta, abstractmethod
 import collections.abc
+from abc import ABCMeta, abstractmethod
 
 from volatility.framework import validity
 

volatility/framework/interfaces/layers.py

@@ -110,5 +110,3 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta):
                 raise exceptions.LayerException("Mapping returned an overlapping element")
             self._context.memory.write(layer, mapped_offset, length)
             current_offset += length
-
-

volatility/framework/interfaces/objects.py

@@ -4,6 +4,7 @@ Created on 6 May 2013
 @author: mike
 """
 
+import collections
 import collections.abc
 from abc import ABCMeta, abstractmethod
 

volatility/framework/interfaces/renderers.py

@@ -1,9 +1,8 @@
-from abc import abstractmethod, ABCMeta
 import collections
+from abc import abstractmethod, ABCMeta
 
 from volatility.framework import validity
 
-
 __author__ = 'mike'
 
 Column = collections.namedtuple('Column', ['index', 'name', 'type'])
@@ -91,7 +90,6 @@ class TreeGrid(object, metaclass = ABCMeta):
         :param generator: A generator that populates the tree/grid structure
         """
 
-
     @abstractmethod
     def populate(self, func = None, initial_accumulator = None):
         """Generator that returns the next available Node
@@ -108,7 +106,6 @@ class TreeGrid(object, metaclass = ABCMeta):
     @abstractmethod
     def columns(self):
         """Returns the available columns and their ordering and types"""
-        return self._columns
 
     @abstractmethod
     def children(self, node):

volatility/framework/interfaces/symbols.py

@@ -26,7 +26,7 @@ class SymbolTableInterface(validity.ValidityRoutines):
         """
         raise NotImplementedError("Abstract property get_constant not implemented by subclass.")
 
-    @ property
+    @property
     def constants(self):
         """Returns an iterator of the constant symbols"""
         raise NotImplementedError("Abstract property constants not implemented by subclass.")

volatility/framework/layers/__init__.py

@@ -4,9 +4,10 @@ Created on 4 May 2013
 @author: mike
 """
 
+import collections.abc
+
 from volatility.framework import validity, interfaces, exceptions
 from volatility.framework.layers import physical, intel
-import collections.abc
 
 
 class Memory(validity.ValidityRoutines, collections.abc.Mapping):

volatility/framework/objects/__init__.py

@@ -4,8 +4,8 @@ Created on 17 Feb 2013
 @author: mike
 """
 
-import struct
 import collections
+import struct
 
 from volatility.framework import interfaces
 from volatility.framework.objects import templates
@@ -191,6 +191,7 @@ class BitField(PrimitiveObject, int):
 
 class Enumeration(interfaces.objects.ObjectInterface):
     """Returns an object made up of choices"""
+
     # FIXME: Add in body for the enumeration object
 
     def write(self, value):

volatility/framework/plugins/__init__.py

@@ -1,14 +1,13 @@
 # TODO: Code to import all the py/pyc files available (but not both).
 # TODO: Code to return a none-instantiated list of plugin classes.
 
+import inspect
+import logging
 import os
 import sys
-import logging
-import inspect
 
 import volatility.plugins as plugins
 
-
 logger = logging.getLogger(__name__)
 
 

volatility/framework/renderers/__init__.py

@@ -37,8 +37,8 @@ class TreeNode(interfaces.renderers.TreeNode):
             column = self._treegrid.columns[index]
             if not isinstance(values[index], column.type):
                 raise TypeError(
-                    "Values item with index " + repr(index) + " is the wrong type for column " + \
-                    repr(column.name) + " (got " + str(type(values[index])) + " but expected " + \
+                    "Values item with index " + repr(index) + " is the wrong type for column " +
+                    repr(column.name) + " (got " + str(type(values[index])) + " but expected " +
                     str(column.type) + ")")
 
     @property
@@ -140,7 +140,8 @@ class TreeGrid(interfaces.renderers.TreeGrid):
         """
         accumulator = initial_accumulator
         if func is None:
-            func = lambda _x, _y: None
+            def func(_x, _y):
+                return None
 
         if not self.populated:
             prev_nodes = []

volatility/framework/symbols/__init__.py

@@ -4,6 +4,7 @@ Created on 7 Feb 2013
 @author: mike
 """
 
+import collections
 import collections.abc
 import warnings
 

volatility/framework/symbols/windows/__init__.py

@@ -1,9 +1,9 @@
-__author__ = 'mike'
-
 import collections.abc
 
 from volatility.framework import objects
 
+__author__ = 'mike'
+
 
 class _ETHREAD(objects.Struct):
     def owning_process(self, kernel_layer = None):

volatility/framework/validity.py

@@ -16,8 +16,9 @@ class ValidityRoutines(object):
         :param valid_type: The type against which to validate
         :type valid_type: type
         """
-        assert isinstance(value, valid_type), self.__class__.__name__ + " expected " + \
-                                              valid_type.__name__ + ", not " + type(value).__name__
+        assert isinstance(value,
+                          valid_type), self.__class__.__name__ + " expected " + valid_type.__name__ + ", not " + type(
+            value).__name__
         return value
 
     def _class_check(self, klass, valid_class):
@@ -28,5 +29,5 @@ class ValidityRoutines(object):
         :param valid_class: Valid class against which to check class validity
         :type valid_class: class
         """
-        assert issubclass(klass, valid_class), self.__class__.__name__ + " expected " + \
-                                               valid_class.__name__ + ", not " + klass.__name__
+        assert issubclass(klass,
+                          valid_class), self.__class__.__name__ + " expected " + valid_class.__name__ + ", not " + klass.__name__

volatility/plugins/windows/pslist.py

@@ -1,23 +1,21 @@
-import inspect
-from volatility.framework import configuration
-
 import volatility.framework.interfaces.plugins as plugins
+from volatility.framework import configuration
 
 
 class PsList(plugins.PluginInterface):
     @classmethod
     def requirements(cls):
         return [configuration.TranslationLayerRequirement(name = 'primary',
-                                                   description = 'Kernel Address Space',
-                                                   os_type = 'windows',
-                                                   architectures = None,
-                                                   layer_type = 'kernel'),
+                                                          description = 'Kernel Address Space',
+                                                          os_type = 'windows',
+                                                          architectures = None,
+                                                          layer_type = 'kernel'),
                 configuration.IntRequirement(name = 'pid',
-                                      description = "Process ID",
-                                      optional = True),
+                                             description = "Process ID",
+                                             optional = True),
                 configuration.IntRequirement(name = 'offset',
-                                      description = 'Address of any process',
-                                      default = 0x192ad18)]
+                                             description = 'Address of any process',
+                                             default = 0x192ad18)]
 
     @staticmethod
     def kernel_process_from_physical_process(ctx, physical_layer, kernel_layer, offset):
@@ -33,6 +31,7 @@ class PsList(plugins.PluginInterface):
 
     def run(self):
         self.validate_inputs()
-        eproc = self.kernel_process_from_physical_process(self.context, 'physical', 'intel', self.config.get_value('offset'))
+        eproc = self.kernel_process_from_physical_process(self.context, 'physical', 'intel',
+                                                          self.config.get_value('offset'))
         for proc in eproc.ActiveProcessLinks:
-            print(proc.UniqueProcessId)
+            print(proc.UniqueProcessId)