From 2d3b3158dc953a89898cd3e403415e1725f4cbc2 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 21 Oct 2023 23:34:17 +0200 Subject: [PATCH 1/2] correct sql query and strip identifier --- volatility3/framework/automagic/symbol_cache.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py index 29f2cfd08..2c605f915 100644 --- a/volatility3/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -429,8 +429,7 @@ class SqliteCache(CacheManagerInterface): progress_callback(0, "Reading remote ISF list") cursor = self._database.cursor() cursor.execute( - f"SELECT cached FROM cache WHERE local = 0 and cached < datetime('now', {self.cache_period})" - ) + f"SELECT cached FROM cache WHERE local = 0 and cached < datetime('now', '{self.cache_period}')" ) remote_identifiers = RemoteIdentifierFormat(constants.REMOTE_ISF_URL) progress_callback(50, "Reading remote ISF list") for operating_system in constants.OS_CATEGORIES: @@ -438,9 +437,11 @@ class SqliteCache(CacheManagerInterface): {}, operating_system=operating_system ) for identifier, location in identifiers: + identifier = identifier.rstrip() + identifier = identifier[:-1] if identifier.endswith(b"\x00") else identifier # Linux banners dumped by dwarf2json end with "\x00\n". If not stripped, the banner cannot match. cursor.execute( - "INSERT OR REPLACE INTO cache(identifier, location, operating_system, local, cached) VALUES (?, ?, ?, ?, datetime('now'))", - (location, identifier, operating_system, False), + "INSERT OR REPLACE INTO cache(identifier, location, operating_system, local, cached) VALUES (?, ?, ?, ?, datetime('now'))", + (identifier, location, operating_system, False), ) progress_callback(100, "Reading remote ISF list") self._database.commit() From c20baf9d1fd346fe9f809227d063d4cf56717879 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 23 Oct 2023 17:49:03 +0200 Subject: [PATCH 2/2] black formatting --- volatility3/framework/automagic/symbol_cache.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py index 2c605f915..22f1c94f3 100644 --- a/volatility3/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -429,7 +429,8 @@ class SqliteCache(CacheManagerInterface): progress_callback(0, "Reading remote ISF list") cursor = self._database.cursor() cursor.execute( - f"SELECT cached FROM cache WHERE local = 0 and cached < datetime('now', '{self.cache_period}')" ) + f"SELECT cached FROM cache WHERE local = 0 and cached < datetime('now', '{self.cache_period}')" + ) remote_identifiers = RemoteIdentifierFormat(constants.REMOTE_ISF_URL) progress_callback(50, "Reading remote ISF list") for operating_system in constants.OS_CATEGORIES: @@ -438,9 +439,11 @@ class SqliteCache(CacheManagerInterface): ) for identifier, location in identifiers: identifier = identifier.rstrip() - identifier = identifier[:-1] if identifier.endswith(b"\x00") else identifier # Linux banners dumped by dwarf2json end with "\x00\n". If not stripped, the banner cannot match. + identifier = ( + identifier[:-1] if identifier.endswith(b"\x00") else identifier + ) # Linux banners dumped by dwarf2json end with "\x00\n". If not stripped, the banner cannot match. cursor.execute( - "INSERT OR REPLACE INTO cache(identifier, location, operating_system, local, cached) VALUES (?, ?, ?, ?, datetime('now'))", + "INSERT OR REPLACE INTO cache(identifier, location, operating_system, local, cached) VALUES (?, ?, ?, ?, datetime('now'))", (identifier, location, operating_system, False), ) progress_callback(100, "Reading remote ISF list")