From d258c5699185ca56184dc4e7c27690e691f0d68d Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 21 Nov 2015 13:12:00 +0000 Subject: [PATCH] Rerun pylint with pycharm-5 and fix pep8 issues as well. --- test_rig.py | 4 +-- vol.py | 2 +- volatility/cli/__init__.py | 5 ++- volatility/framework/__init__.py | 3 -- volatility/framework/contexts/__init__.py | 7 +---- volatility/framework/contexts/intel.py | 31 +++++++++---------- volatility/framework/contexts/physical.py | 9 +++--- volatility/framework/contexts/windows.py | 3 +- .../framework/interfaces/configuration.py | 2 +- volatility/framework/interfaces/layers.py | 2 -- volatility/framework/interfaces/objects.py | 1 + volatility/framework/interfaces/renderers.py | 5 +-- volatility/framework/interfaces/symbols.py | 2 +- volatility/framework/layers/__init__.py | 3 +- volatility/framework/objects/__init__.py | 3 +- volatility/framework/plugins/__init__.py | 5 ++- volatility/framework/renderers/__init__.py | 7 +++-- volatility/framework/symbols/__init__.py | 1 + .../framework/symbols/windows/__init__.py | 4 +-- volatility/framework/validity.py | 9 +++--- volatility/plugins/windows/pslist.py | 25 +++++++-------- 21 files changed, 61 insertions(+), 72 deletions(-) diff --git a/test_rig.py b/test_rig.py index 090d12875..c436886a9 100644 --- a/test_rig.py +++ b/test_rig.py @@ -4,13 +4,13 @@ Created on 10 Mar 2013 @author: mike """ -import pdb import logging +import pdb from volatility import framework from volatility.framework import contexts -from volatility.framework.interfaces import objects from volatility.framework import xp_sp2_x86_vtypes, layers, plugins +from volatility.framework.interfaces import objects from volatility.framework.symbols import vtypes, native diff --git a/vol.py b/vol.py index 9c537f763..5580f4836 100644 --- a/vol.py +++ b/vol.py @@ -3,4 +3,4 @@ __author__ = 'mike' import volatility.cli if __name__ == '__main__': - volatility.cli.main() \ No newline at end of file + volatility.cli.main() diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index 1e7cf208e..ce33d6c0a 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -1,10 +1,10 @@ import argparse -import sys import logging +import sys -from volatility.cli import argparse_adapter import volatility.framework import volatility.plugins +from volatility.cli import argparse_adapter from volatility.framework import interfaces, plugins, configuration, contexts __author__ = 'mike' @@ -75,6 +75,5 @@ class CommandLine(object): return context, req_mapping - def main(): CommandLine().run() diff --git a/volatility/framework/__init__.py b/volatility/framework/__init__.py index 76274eedb..5d1ccc23c 100644 --- a/volatility/framework/__init__.py +++ b/volatility/framework/__init__.py @@ -37,6 +37,3 @@ def require_version(*args): from volatility.framework import interfaces, symbols, layers, contexts, configuration - - - diff --git a/volatility/framework/contexts/__init__.py b/volatility/framework/contexts/__init__.py index 8e7c4bccc..709977385 100644 --- a/volatility/framework/contexts/__init__.py +++ b/volatility/framework/contexts/__init__.py @@ -1,14 +1,9 @@ from volatility.framework import validity, interfaces, symbols, layers +from volatility.framework.contexts import intel, physical, windows from volatility.framework.interfaces.context import ContextModifierInterface -from volatility.framework.symbols import native -import volatility - __author__ = 'mike' -from volatility.framework.contexts import intel, physical, windows -from volatility.framework import configuration - class LayerFactory(validity.ValidityRoutines, list): """Class to establish and load the appropriate components of the context for a given operating system""" diff --git a/volatility/framework/contexts/intel.py b/volatility/framework/contexts/intel.py index bb6e795d6..ea8efdb00 100644 --- a/volatility/framework/contexts/intel.py +++ b/volatility/framework/contexts/intel.py @@ -7,28 +7,27 @@ class IntelContextModifier(interfaces.context.ContextModifierInterface): @classmethod def requirements(cls): return [configuration.ChoiceRequirement(name = "architecture", - choices = ["auto", "pae", "32", "64"], - description = "Determines the memory image", - default = "auto"), + choices = ["auto", "pae", "32", "64"], + description = "Determines the memory image", + default = "auto"), configuration.IntRequirement(name = "page_map_offset", - description = "Offset to the directory table base"), + description = "Offset to the directory table base"), configuration.StringRequirement(name = 'layer_name', - description = 'Name of the layer to be added to the memory space', - default = 'intel'), + description = 'Name of the layer to be added to the memory space', + default = 'intel'), configuration.TranslationLayerRequirement(name = 'physical_layer', - description = 'Physical Address Space', - os_type = 'windows', - architectures = None, - layer_type = 'physical'), + description = 'Physical Address Space', + os_type = 'windows', + architectures = None, + layer_type = 'physical'), configuration.TranslationLayerRequirement(name = 'swap_layer', - description = "Layer name for the swap layer", - optional = True)] + description = "Layer name for the swap layer", + optional = True)] def modify_context(self, context): # TODO: Attempt to determine whether the image is 32, PAE or x64 (although the context must already know whether it is x64) config = self.config_get(context) - layer = None if config.get('architecture') == 'pae': layer = layers.intel.IntelPAE elif config.get('architecture') == '32': @@ -36,10 +35,10 @@ class IntelContextModifier(interfaces.context.ContextModifierInterface): elif config.get('architecture') == '64': layer = layers.intel.Intel32e else: - #TODO: Add automagic here + # TODO: Add automagic here layer = layers.intel.IntelPAE intel = layer(context, config.get_value('layer_name'), - config.get_value('physical_layer').name, - page_map_offset = config.get_value('page_map_offset')) + config.get_value('physical_layer').name, + page_map_offset = config.get_value('page_map_offset')) context.add_layer(intel) diff --git a/volatility/framework/contexts/physical.py b/volatility/framework/contexts/physical.py index 20b442815..da69ef8b3 100644 --- a/volatility/framework/contexts/physical.py +++ b/volatility/framework/contexts/physical.py @@ -7,11 +7,11 @@ class PhysicalContextModifier(interfaces.context.ContextModifierInterface): @classmethod def requirements(cls): return [configuration.StringRequirement(name = 'location', - description = 'URL to the physical address space', - default = '/home/mike/memory/jon-fres.dmp'), + description = 'URL to the physical address space', + default = '/home/mike/memory/jon-fres.dmp'), configuration.StringRequirement(name = 'layer_name', - description = 'Layer name for the physical space', - default = 'physical')] + description = 'Layer name for the physical space', + default = 'physical')] def modify_context(self, context): # Ideally allow for the plugin to specify the layering, but if not then guess at the best one @@ -20,4 +20,3 @@ class PhysicalContextModifier(interfaces.context.ContextModifierInterface): modconfig.get_value('layer_name'), filename = modconfig.get_value('location')) context.add_layer(base) - diff --git a/volatility/framework/contexts/windows.py b/volatility/framework/contexts/windows.py index 3a294dc6b..d509f8cbb 100644 --- a/volatility/framework/contexts/windows.py +++ b/volatility/framework/contexts/windows.py @@ -6,7 +6,8 @@ __author__ = 'mike' class WindowsContextModifier(interfaces.context.ContextModifierInterface): # TODO: Only import the vtypes only when necessary - def __init__(self, config): + def __init__(self, namespace): + interfaces.context.ContextModifierInterface.__init__(namespace) from volatility.framework import xp_sp2_x86_vtypes self._virtual_types = xp_sp2_x86_vtypes.ntkrnlmp_types diff --git a/volatility/framework/interfaces/configuration.py b/volatility/framework/interfaces/configuration.py index 13f60532d..77c9f208e 100644 --- a/volatility/framework/interfaces/configuration.py +++ b/volatility/framework/interfaces/configuration.py @@ -1,5 +1,5 @@ -from abc import ABCMeta, abstractmethod import collections.abc +from abc import ABCMeta, abstractmethod from volatility.framework import validity diff --git a/volatility/framework/interfaces/layers.py b/volatility/framework/interfaces/layers.py index 8e5b7b582..51dfe170f 100644 --- a/volatility/framework/interfaces/layers.py +++ b/volatility/framework/interfaces/layers.py @@ -110,5 +110,3 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): raise exceptions.LayerException("Mapping returned an overlapping element") self._context.memory.write(layer, mapped_offset, length) current_offset += length - - diff --git a/volatility/framework/interfaces/objects.py b/volatility/framework/interfaces/objects.py index 135586b82..b902fcd17 100644 --- a/volatility/framework/interfaces/objects.py +++ b/volatility/framework/interfaces/objects.py @@ -4,6 +4,7 @@ Created on 6 May 2013 @author: mike """ +import collections import collections.abc from abc import ABCMeta, abstractmethod diff --git a/volatility/framework/interfaces/renderers.py b/volatility/framework/interfaces/renderers.py index 2193d2731..2e6c8d593 100644 --- a/volatility/framework/interfaces/renderers.py +++ b/volatility/framework/interfaces/renderers.py @@ -1,9 +1,8 @@ -from abc import abstractmethod, ABCMeta import collections +from abc import abstractmethod, ABCMeta from volatility.framework import validity - __author__ = 'mike' Column = collections.namedtuple('Column', ['index', 'name', 'type']) @@ -91,7 +90,6 @@ class TreeGrid(object, metaclass = ABCMeta): :param generator: A generator that populates the tree/grid structure """ - @abstractmethod def populate(self, func = None, initial_accumulator = None): """Generator that returns the next available Node @@ -108,7 +106,6 @@ class TreeGrid(object, metaclass = ABCMeta): @abstractmethod def columns(self): """Returns the available columns and their ordering and types""" - return self._columns @abstractmethod def children(self, node): diff --git a/volatility/framework/interfaces/symbols.py b/volatility/framework/interfaces/symbols.py index 36a2d587b..1478c532c 100644 --- a/volatility/framework/interfaces/symbols.py +++ b/volatility/framework/interfaces/symbols.py @@ -26,7 +26,7 @@ class SymbolTableInterface(validity.ValidityRoutines): """ raise NotImplementedError("Abstract property get_constant not implemented by subclass.") - @ property + @property def constants(self): """Returns an iterator of the constant symbols""" raise NotImplementedError("Abstract property constants not implemented by subclass.") diff --git a/volatility/framework/layers/__init__.py b/volatility/framework/layers/__init__.py index 4dd0bfd29..7c57f5218 100644 --- a/volatility/framework/layers/__init__.py +++ b/volatility/framework/layers/__init__.py @@ -4,9 +4,10 @@ Created on 4 May 2013 @author: mike """ +import collections.abc + from volatility.framework import validity, interfaces, exceptions from volatility.framework.layers import physical, intel -import collections.abc class Memory(validity.ValidityRoutines, collections.abc.Mapping): diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index 4e975c1e0..1e6bc7eaf 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -4,8 +4,8 @@ Created on 17 Feb 2013 @author: mike """ -import struct import collections +import struct from volatility.framework import interfaces from volatility.framework.objects import templates @@ -191,6 +191,7 @@ class BitField(PrimitiveObject, int): class Enumeration(interfaces.objects.ObjectInterface): """Returns an object made up of choices""" + # FIXME: Add in body for the enumeration object def write(self, value): diff --git a/volatility/framework/plugins/__init__.py b/volatility/framework/plugins/__init__.py index 1b7542b64..3a79b78a6 100644 --- a/volatility/framework/plugins/__init__.py +++ b/volatility/framework/plugins/__init__.py @@ -1,14 +1,13 @@ # TODO: Code to import all the py/pyc files available (but not both). # TODO: Code to return a none-instantiated list of plugin classes. +import inspect +import logging import os import sys -import logging -import inspect import volatility.plugins as plugins - logger = logging.getLogger(__name__) diff --git a/volatility/framework/renderers/__init__.py b/volatility/framework/renderers/__init__.py index 5fdf7346d..fdf78cd2d 100644 --- a/volatility/framework/renderers/__init__.py +++ b/volatility/framework/renderers/__init__.py @@ -37,8 +37,8 @@ class TreeNode(interfaces.renderers.TreeNode): column = self._treegrid.columns[index] if not isinstance(values[index], column.type): raise TypeError( - "Values item with index " + repr(index) + " is the wrong type for column " + \ - repr(column.name) + " (got " + str(type(values[index])) + " but expected " + \ + "Values item with index " + repr(index) + " is the wrong type for column " + + repr(column.name) + " (got " + str(type(values[index])) + " but expected " + str(column.type) + ")") @property @@ -140,7 +140,8 @@ class TreeGrid(interfaces.renderers.TreeGrid): """ accumulator = initial_accumulator if func is None: - func = lambda _x, _y: None + def func(_x, _y): + return None if not self.populated: prev_nodes = [] diff --git a/volatility/framework/symbols/__init__.py b/volatility/framework/symbols/__init__.py index 89fbb2296..23fe5b7ce 100644 --- a/volatility/framework/symbols/__init__.py +++ b/volatility/framework/symbols/__init__.py @@ -4,6 +4,7 @@ Created on 7 Feb 2013 @author: mike """ +import collections import collections.abc import warnings diff --git a/volatility/framework/symbols/windows/__init__.py b/volatility/framework/symbols/windows/__init__.py index b18fef493..13c5ff269 100644 --- a/volatility/framework/symbols/windows/__init__.py +++ b/volatility/framework/symbols/windows/__init__.py @@ -1,9 +1,9 @@ -__author__ = 'mike' - import collections.abc from volatility.framework import objects +__author__ = 'mike' + class _ETHREAD(objects.Struct): def owning_process(self, kernel_layer = None): diff --git a/volatility/framework/validity.py b/volatility/framework/validity.py index d32747c0c..aa0b63cdf 100644 --- a/volatility/framework/validity.py +++ b/volatility/framework/validity.py @@ -16,8 +16,9 @@ class ValidityRoutines(object): :param valid_type: The type against which to validate :type valid_type: type """ - assert isinstance(value, valid_type), self.__class__.__name__ + " expected " + \ - valid_type.__name__ + ", not " + type(value).__name__ + assert isinstance(value, + valid_type), self.__class__.__name__ + " expected " + valid_type.__name__ + ", not " + type( + value).__name__ return value def _class_check(self, klass, valid_class): @@ -28,5 +29,5 @@ class ValidityRoutines(object): :param valid_class: Valid class against which to check class validity :type valid_class: class """ - assert issubclass(klass, valid_class), self.__class__.__name__ + " expected " + \ - valid_class.__name__ + ", not " + klass.__name__ + assert issubclass(klass, + valid_class), self.__class__.__name__ + " expected " + valid_class.__name__ + ", not " + klass.__name__ diff --git a/volatility/plugins/windows/pslist.py b/volatility/plugins/windows/pslist.py index d8a6206db..d17def75a 100644 --- a/volatility/plugins/windows/pslist.py +++ b/volatility/plugins/windows/pslist.py @@ -1,23 +1,21 @@ -import inspect -from volatility.framework import configuration - import volatility.framework.interfaces.plugins as plugins +from volatility.framework import configuration class PsList(plugins.PluginInterface): @classmethod def requirements(cls): return [configuration.TranslationLayerRequirement(name = 'primary', - description = 'Kernel Address Space', - os_type = 'windows', - architectures = None, - layer_type = 'kernel'), + description = 'Kernel Address Space', + os_type = 'windows', + architectures = None, + layer_type = 'kernel'), configuration.IntRequirement(name = 'pid', - description = "Process ID", - optional = True), + description = "Process ID", + optional = True), configuration.IntRequirement(name = 'offset', - description = 'Address of any process', - default = 0x192ad18)] + description = 'Address of any process', + default = 0x192ad18)] @staticmethod def kernel_process_from_physical_process(ctx, physical_layer, kernel_layer, offset): @@ -33,6 +31,7 @@ class PsList(plugins.PluginInterface): def run(self): self.validate_inputs() - eproc = self.kernel_process_from_physical_process(self.context, 'physical', 'intel', self.config.get_value('offset')) + eproc = self.kernel_process_from_physical_process(self.context, 'physical', 'intel', + self.config.get_value('offset')) for proc in eproc.ActiveProcessLinks: - print(proc.UniqueProcessId) \ No newline at end of file + print(proc.UniqueProcessId)