From ddef7e76b352c4e1c650592fc8ddd1efa95fd162 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 13 Apr 2015 14:18:33 -0500 Subject: [PATCH] Add a todo to validate factory requirements as well as just plugin requirements. --- volatility/cli/__init__.py | 9 ++++++--- volatility/framework/interfaces/plugins.py | 6 ++++-- volatility/plugins/windows/pslist.py | 2 +- 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index 14c30360b..74a0eb53c 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -28,7 +28,10 @@ class CommandLine(object): plugin = volatility.plugins.windows.pslist.PsList context = self.handle_plugin_requirements(plugin) - plugin(context) + # Construct the plugin + runner = plugin(context) + # Run the plugin + runner() def construct_layer_factory(self, name): """Turns a configuration from a plugin into a """ @@ -51,9 +54,9 @@ class CommandLine(object): facreqs = factory.requirements() for facreq in facreqs: context.config.add_item(facreq, namespace = namespace) - #TODO: Do something clever with the facreqs + #TODO: Validate factory requirements context = factory(context) - context.config.get(config.namespace_join([plugin.__name__, req.name])).value = 'primary' + context.config.get(config.namespace_join([plugin.__name__, req.name])).value = 'intel' return context diff --git a/volatility/framework/interfaces/plugins.py b/volatility/framework/interfaces/plugins.py index 770ff5d0a..09446274b 100644 --- a/volatility/framework/interfaces/plugins.py +++ b/volatility/framework/interfaces/plugins.py @@ -37,7 +37,7 @@ class PluginInterface(validity.ValidityRoutines, metaclass = ABCMeta): @abstractmethod def requirements(cls): """Returns a list of requirements options""" - return + return [] @property def config(self, core = False): @@ -47,7 +47,9 @@ class PluginInterface(validity.ValidityRoutines, metaclass = ABCMeta): def validate_inputs(self): for option in self.requirements(): - option.validate_input(self.config.get_value(option.name), self.context) + if not option.optional: + print("Validate", option.name) + option.validate_input(self.config.get_value(option.name), self.context) @abstractmethod def __call__(self): diff --git a/volatility/plugins/windows/pslist.py b/volatility/plugins/windows/pslist.py index 7beb1b457..5cde1d85d 100644 --- a/volatility/plugins/windows/pslist.py +++ b/volatility/plugins/windows/pslist.py @@ -33,6 +33,6 @@ class PsList(plugins.PluginInterface): def __call__(self): self.validate_inputs() - eproc = self.kernel_process_from_physical_process(self.context, 'physical', 'primary', self.config.get_value('offset')) + eproc = self.kernel_process_from_physical_process(self.context, 'physical', 'intel', self.config.get_value('offset')) for proc in eproc.ActiveProcessLinks: print(proc.UniqueProcessId) \ No newline at end of file