From e65a00894aa343737bd5b95711055a14aef5b5f2 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 17 Dec 2018 12:46:14 +0000 Subject: [PATCH] Minor style tweaks and mass changes across the codebase because of it. --- .style.yapf | 4 ++-- development/dtbfinder.py | 8 +++----- development/nlpdtbfinder.py | 10 ++++------ development/pdbscanner.py | 3 +-- volatility/cli/__init__.py | 6 ++---- volatility/cli/volshell/__init__.py | 3 +-- volatility/framework/automagic/mac.py | 3 +-- volatility/framework/automagic/pdbscan.py | 3 +-- volatility/framework/automagic/windows.py | 10 ++-------- volatility/framework/configuration/requirements.py | 14 ++++---------- volatility/framework/interfaces/automagic.py | 4 ++-- volatility/framework/interfaces/objects.py | 12 ++++-------- volatility/framework/layers/crash.py | 7 ++----- volatility/framework/layers/intel.py | 12 ++++++------ volatility/framework/layers/registry.py | 11 ++++------- volatility/framework/objects/__init__.py | 13 +++++-------- volatility/framework/objects/templates.py | 3 +-- volatility/framework/plugins/linux/bash.py | 3 +-- .../framework/plugins/linux/check_syscall.py | 3 +-- volatility/framework/plugins/timeliner.py | 3 +-- volatility/framework/plugins/windows/dlldump.py | 4 ++-- volatility/framework/plugins/windows/handles.py | 3 +-- volatility/framework/plugins/windows/moddump.py | 4 +--- volatility/framework/plugins/windows/modules.py | 4 ++-- volatility/framework/plugins/windows/pslist.py | 12 +++++------- .../framework/plugins/windows/registry/printkey.py | 4 ++-- .../plugins/windows/registry/userassist.py | 6 +++--- .../framework/plugins/windows/vadyarascan.py | 3 +-- volatility/framework/plugins/yarascan.py | 3 +-- volatility/framework/symbols/linux/__init__.py | 3 +-- volatility/framework/symbols/mac/__init__.py | 3 +-- volatility/framework/symbols/windows/__init__.py | 3 +-- .../framework/symbols/windows/extensions/kdbg.py | 4 +--- .../framework/symbols/windows/extensions/pe.py | 3 +-- volatility/plugins/windows/statistics.py | 3 +-- 35 files changed, 72 insertions(+), 125 deletions(-) diff --git a/.style.yapf b/.style.yapf index 8f96a3874..8159be910 100644 --- a/.style.yapf +++ b/.style.yapf @@ -55,7 +55,7 @@ blank_line_before_nested_class_or_def=True coalesce_brackets=False # The column limit. -column_limit=119 +column_limit=120 # The style for continuation alignment. Possible values are: # @@ -142,7 +142,7 @@ no_spaces_around_selected_binary_operators= spaces_around_default_or_named_assign=True # Use spaces around the power operator. -spaces_around_power_operator=False +spaces_around_power_operator=True # The number of spaces required before a trailing comment. spaces_before_comment=2 diff --git a/development/dtbfinder.py b/development/dtbfinder.py index 00f96dc0c..31c807a2f 100644 --- a/development/dtbfinder.py +++ b/development/dtbfinder.py @@ -13,8 +13,7 @@ if __name__ == '__main__': import argparse parser = argparse.ArgumentParser() - parser.add_argument( - "filenames", metavar = "FILE", nargs = "+", action = "store", help = "FILE to read for testing") + parser.add_argument("filenames", metavar = "FILE", nargs = "+", action = "store", help = "FILE to read for testing") parser.add_argument("--32bit", action = "store_false", dest = "bit32", help = "Disable 32-bit scanning") parser.add_argument("--64bit", action = "store_false", dest = "bit64", help = "Disable 64-bit scanning") parser.add_argument("--pae", action = "store_false", dest = "pae", help = "Disable pae scanning") @@ -38,9 +37,8 @@ if __name__ == '__main__': 'data' + str(args.filenames.index(filename))) ctx.memory.add_layer(data) if args.lime: - ctx.config[interfaces.configuration.path_join( - 'lime-config' + str(args.filenames.index(filename)), - "base_layer")] = 'data' + str(args.filenames.index(filename)) + ctx.config[interfaces.configuration.path_join('lime-config' + str(args.filenames.index(filename)), + "base_layer")] = 'data' + str(args.filenames.index(filename)) data = layers.lime.LimeLayer(ctx, 'lime-config' + str(args.filenames.index(filename)), 'lime-data' + str(args.filenames.index(filename))) ctx.memory.add_layer(data) diff --git a/development/nlpdtbfinder.py b/development/nlpdtbfinder.py index ade1de2de..f4e15185e 100644 --- a/development/nlpdtbfinder.py +++ b/development/nlpdtbfinder.py @@ -22,7 +22,7 @@ import struct PAGE_SIZE = 0x1000 PHYS_MASK = 0xfffffffffff -PML4_ENTRY_SIZE = int((2**64) / 512) +PML4_ENTRY_SIZE = int((2 ** 64) / 512) class PML4EScanner(interfaces.layers.ScannerInterface): @@ -145,8 +145,7 @@ if __name__ == '__main__': import argparse parser = argparse.ArgumentParser() - parser.add_argument( - "filenames", metavar = "FILE", nargs = "+", action = "store", help = "FILE to read for testing") + parser.add_argument("filenames", metavar = "FILE", nargs = "+", action = "store", help = "FILE to read for testing") parser.add_argument("-l", "--lime", action = "store_true", dest = "lime", help = "All files are LIME format") parser.add_argument( "-v", "--verbose", action = "count", default = 0, help = "Increase the verbosity of the information returned") @@ -161,9 +160,8 @@ if __name__ == '__main__': 'data' + str(args.filenames.index(filename))) ctx.memory.add_layer(data) if args.lime: - ctx.config[interfaces.configuration.path_join( - 'lime-config' + str(args.filenames.index(filename)), - "base_layer")] = 'data' + str(args.filenames.index(filename)) + ctx.config[interfaces.configuration.path_join('lime-config' + str(args.filenames.index(filename)), + "base_layer")] = 'data' + str(args.filenames.index(filename)) data = layers.lime.LimeLayer(ctx, 'lime-config' + str(args.filenames.index(filename)), 'lime-data' + str(args.filenames.index(filename))) ctx.memory.add_layer(data) diff --git a/development/pdbscanner.py b/development/pdbscanner.py index 939b4e249..7024fd7fb 100644 --- a/development/pdbscanner.py +++ b/development/pdbscanner.py @@ -13,8 +13,7 @@ if __name__ == '__main__': from volatility.framework import contexts parser = argparse.ArgumentParser() - parser.add_argument( - "filenames", metavar = "FILE", nargs = "+", action = "store", help = "FILE to read for testing") + parser.add_argument("filenames", metavar = "FILE", nargs = "+", action = "store", help = "FILE to read for testing") args = parser.parse_args() diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index 7b78813e6..f47b291a7 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -74,8 +74,7 @@ class CommandLine(interfaces.plugins.FileConsumerInterface): volatility.framework.require_interface_version(0, 0, 0) - parser = argparse.ArgumentParser( - prog = 'volatility', description = "An open-source memory forensics framework") + parser = argparse.ArgumentParser(prog = 'volatility', description = "An open-source memory forensics framework") parser.add_argument( "-c", "--config", help = "Load the configuration from a json file", default = None, type = str) parser.add_argument( @@ -211,8 +210,7 @@ class CommandLine(interfaces.plugins.FileConsumerInterface): if args.extend: for extension in args.extend: if '=' not in extension: - raise ValueError( - "Invalid extension (extensions must be of the format \"conf.path.value='value'\")") + raise ValueError("Invalid extension (extensions must be of the format \"conf.path.value='value'\")") address, value = extension[:extension.find('=')], json.loads(extension[extension.find('=') + 1:]) ctx.config[address] = value diff --git a/volatility/cli/volshell/__init__.py b/volatility/cli/volshell/__init__.py index 801a0692a..27276a1d8 100644 --- a/volatility/cli/volshell/__init__.py +++ b/volatility/cli/volshell/__init__.py @@ -183,8 +183,7 @@ class VolShell(cli.CommandLine): if args.extend: for extension in args.extend: if '=' not in extension: - raise ValueError( - "Invalid extension (extensions must be of the format \"conf.path.value='value'\")") + raise ValueError("Invalid extension (extensions must be of the format \"conf.path.value='value'\")") address, value = extension[:extension.find('=')], json.loads(extension[extension.find('=') + 1:]) ctx.config[address] = value diff --git a/volatility/framework/automagic/mac.py b/volatility/framework/automagic/mac.py index 3d1a9f942..a5979051b 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility/framework/automagic/mac.py @@ -130,8 +130,7 @@ class MacUtilities(object): darwin_signature = rb"Darwin Kernel Version \d{1,3}\.\d{1,3}\.\d{1,3}: [^\x00]+\x00" for offset in context.memory[layer_name].scan( - scanner = scanners.RegExScanner(darwin_signature), - context = context, + scanner = scanners.RegExScanner(darwin_signature), context = context, progress_callback = progress_callback): banner = context.memory[layer_name].read(offset, 128) diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index fd77032af..89b55e169 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -164,8 +164,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): if isinstance(memlayer, intel.Intel): page_size = memlayer.page_size # type: int results = { - virtual_layer_name: - scan(context, layer_name, page_size, progress_callback = progress_callback) + virtual_layer_name: scan(context, layer_name, page_size, progress_callback = progress_callback) } else: for subreq in requirement.requirements.values(): diff --git a/volatility/framework/automagic/windows.py b/volatility/framework/automagic/windows.py index d9cf97d1f..a241a64c3 100644 --- a/volatility/framework/automagic/windows.py +++ b/volatility/framework/automagic/windows.py @@ -115,10 +115,7 @@ class DtbTest64bit(DtbTest): def __init__(self): super().__init__( - layer_type = layers.intel.WindowsIntel32e, - ptr_struct = "Q", - ptr_reference = 0x1ED, - mask = 0x3FFFFFFFFFF000) + layer_type = layers.intel.WindowsIntel32e, ptr_struct = "Q", ptr_reference = 0x1ED, mask = 0x3FFFFFFFFFF000) class DtbTestPae(DtbTest): @@ -186,10 +183,7 @@ class DtbSelfRef64bit(DtbSelfReferential): def __init__(self): super().__init__( - layer_type = layers.intel.WindowsIntel32e, - ptr_struct = "Q", - ptr_reference = 0x1ED, - mask = 0x3FFFFFFFFFF000) + layer_type = layers.intel.WindowsIntel32e, ptr_struct = "Q", ptr_reference = 0x1ED, mask = 0x3FFFFFFFFFF000) class PageMapScanner(interfaces.layers.ScannerInterface): diff --git a/volatility/framework/configuration/requirements.py b/volatility/framework/configuration/requirements.py index 995fdf22a..a84b48469 100644 --- a/volatility/framework/configuration/requirements.py +++ b/volatility/framework/configuration/requirements.py @@ -102,8 +102,7 @@ class ListRequirement(configuration.RequirementInterface): vollog.log(constants.LOGLEVEL_V, "TypeError - Too many values provided to list option.") return [config_path] if not all([self._check_type(element, self.element_type) for element in value]): - vollog.log(constants.LOGLEVEL_V, - "TypeError - At least one element in the list is not of the correct type.") + vollog.log(constants.LOGLEVEL_V, "TypeError - At least one element in the list is not of the correct type.") return [config_path] return [] @@ -132,8 +131,7 @@ class ChoiceRequirement(configuration.RequirementInterface): return [] -class ComplexListRequirement( - MultiRequirement, configuration.ConfigurableRequirementInterface, metaclass = abc.ABCMeta): +class ComplexListRequirement(MultiRequirement, configuration.ConfigurableRequirementInterface, metaclass = abc.ABCMeta): """Allows a variable length list of requirements""" def unsatisfied(self, context: interfaces.context.ContextInterface, config_path: str) -> List[str]: @@ -276,9 +274,7 @@ class TranslationLayerRequirement(configuration.ConstructableRequirementInterfac args = {"context": context, "config_path": config_path, "name": name} if any( - [subreq.unsatisfied(context, config_path) - for subreq in self.requirements.values() - if not subreq.optional]): + [subreq.unsatisfied(context, config_path) for subreq in self.requirements.values() if not subreq.optional]): return None obj = self._construct_class(context, config_path, args) @@ -322,9 +318,7 @@ class SymbolRequirement(configuration.ConstructableRequirementInterface, args = {"context": context, "config_path": config_path, "name": name} if any( - [subreq.unsatisfied(context, config_path) - for subreq in self.requirements.values() - if not subreq.optional]): + [subreq.unsatisfied(context, config_path) for subreq in self.requirements.values() if not subreq.optional]): return None # Fill out the parameter for class creation diff --git a/volatility/framework/interfaces/automagic.py b/volatility/framework/interfaces/automagic.py index 6eb3707b1..4760b6ee0 100644 --- a/volatility/framework/interfaces/automagic.py +++ b/volatility/framework/interfaces/automagic.py @@ -54,8 +54,8 @@ class AutomagicInterface(interfaces.configuration.ConfigurableInterface, metacla context: interfaces.context.ContextInterface, config_path: str, requirement_root: interfaces.configuration.RequirementInterface, - requirement_type: Union[Tuple[Type[interfaces.configuration.RequirementInterface], ...], - Type[interfaces.configuration.RequirementInterface]], + requirement_type: Union[Tuple[Type[interfaces.configuration.RequirementInterface], ...], Type[ + interfaces.configuration.RequirementInterface]], shortcut: bool = True) -> List[Tuple[str, interfaces.configuration.RequirementInterface]]: """Determines if there is actually an unfulfilled requirement waiting diff --git a/volatility/framework/interfaces/objects.py b/volatility/framework/interfaces/objects.py index 1deb09372..006dc3282 100644 --- a/volatility/framework/interfaces/objects.py +++ b/volatility/framework/interfaces/objects.py @@ -74,8 +74,8 @@ class ObjectInformation(ReadOnlyMapping): class ObjectInterface(validity.ValidityRoutines, metaclass = ABCMeta): """A base object required to be the ancestor of every object used in volatility""" - def __init__(self, context: 'interfaces_context.ContextInterface', type_name: str, - object_info: 'ObjectInformation', **kwargs) -> None: + def __init__(self, context: 'interfaces_context.ContextInterface', type_name: str, object_info: 'ObjectInformation', + **kwargs) -> None: # Since objects are likely to be instantiated often, # we're only checking that context, offset and parent # Everything else may be wrong, but that will get caught later on @@ -93,10 +93,7 @@ class ObjectInterface(validity.ValidityRoutines, metaclass = ABCMeta): mask = context.memory[object_info.layer_name].address_mask normalized_offset = object_info.offset & mask - self._vol = collections.ChainMap({}, object_info, { - 'type_name': type_name, - 'offset': normalized_offset - }, kwargs) + self._vol = collections.ChainMap({}, object_info, {'type_name': type_name, 'offset': normalized_offset}, kwargs) self._context = context @property @@ -124,8 +121,7 @@ class ObjectInterface(validity.ValidityRoutines, metaclass = ABCMeta): raise ValueError("Unable to determine table for symbol: {}".format(self.vol.type_name)) table_name = self.vol.type_name[:self.vol.type_name.index(constants.BANG)] if table_name not in self._context.symbol_space: - raise KeyError("Symbol table not found in context's symbol_space for symbol: {}".format( - self.vol.type_name)) + raise KeyError("Symbol table not found in context's symbol_space for symbol: {}".format(self.vol.type_name)) return self._context.symbol_space[table_name] def cast(self, new_type_name: str, **additional) -> 'ObjectInterface': diff --git a/volatility/framework/layers/crash.py b/volatility/framework/layers/crash.py index 5addde2ba..9e8eedc41 100644 --- a/volatility/framework/layers/crash.py +++ b/volatility/framework/layers/crash.py @@ -40,8 +40,7 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer): self._base_layer = self.config["base_layer"] # Create a custom SymbolSpace - self._crash_table_name = intermed.IntermediateSymbolTable.create(context, self._config_path, 'windows', - 'crash') + self._crash_table_name = intermed.IntermediateSymbolTable.create(context, self._config_path, 'windows', 'crash') # Check Header hdr_layer = self._context.memory[self._base_layer] hdr_offset = 0 @@ -49,9 +48,7 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer): # Need to create a header object self.header = self.context.object( - self._crash_table_name + constants.BANG + "_DMP_HEADER", - offset = hdr_offset, - layer_name = self._base_layer) + self._crash_table_name + constants.BANG + "_DMP_HEADER", offset = hdr_offset, layer_name = self._base_layer) # Extract the DTB self.dtb = self.header.DirectoryTableBase diff --git a/volatility/framework/layers/intel.py b/volatility/framework/layers/intel.py index ec3efcf37..7766c2f45 100644 --- a/volatility/framework/layers/intel.py +++ b/volatility/framework/layers/intel.py @@ -81,8 +81,8 @@ class Intel(interfaces.layers.TranslationLayerInterface): @staticmethod def _mask(value: int, high_bit: int, low_bit: int) -> int: """Returns the bits of a value between highbit and lowbit inclusive""" - high_mask = (2**(high_bit + 1)) - 1 - low_mask = (2**low_bit) - 1 + high_mask = (2 ** (high_bit + 1)) - 1 + low_mask = (2 ** low_bit) - 1 mask = (high_mask ^ low_mask) # print(high_bit, low_bit, bin(mask), bin(value)) return value & mask @@ -122,8 +122,8 @@ class Intel(interfaces.layers.TranslationLayerInterface): for (name, size, large_page) in self._structure: # Check we're valid if not self._page_is_valid(entry): - raise exceptions.PagedInvalidAddressException( - self.name, offset, position + 1, entry, "Page Fault at entry " + hex(entry) + " in table " + name) + raise exceptions.PagedInvalidAddressException(self.name, offset, position + 1, entry, + "Page Fault at entry " + hex(entry) + " in table " + name) # Check if we're a large page if large_page and (entry & (1 << 7)): # We're a large page, the rest is finished below @@ -142,8 +142,8 @@ class Intel(interfaces.layers.TranslationLayerInterface): # If the table is entirely duplicates, then mark the whole table as bad if (table == table[:struct.calcsize(self._entry_format)] * (self.page_size // struct.calcsize(self._entry_format))): - raise exceptions.PagedInvalidAddressException( - self.name, offset, position + 1, entry, "Page Fault at entry " + hex(entry) + " in table " + name) + raise exceptions.PagedInvalidAddressException(self.name, offset, position + 1, entry, + "Page Fault at entry " + hex(entry) + " in table " + name) # Read the data for the next entry entry_data = table[( index << self._index_shift):(index << self._index_shift) + struct.calcsize(self._entry_format)] diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index d064ec82c..f0480158d 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -46,8 +46,7 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): # Win10 17063 introduced the Registry process to map most hives. Check # if it exists and update RegistryHive._base_layer for proc in pslist.PsList.list_processes(self.context, self.config['base_layer'], self.config['nt_symbols']): - proc_name = proc.ImageFileName.cast( - "string", max_length = proc.ImageFileName.vol.count, errors = 'replace') + proc_name = proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = 'replace') if proc_name == "Registry" and proc.InheritedFromUniqueProcessId == 4: proc_layer_name = proc.add_process_layer() self._base_layer = proc_layer_name @@ -83,9 +82,7 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): """Returns the appropriate Cell value for a cell offset""" # This would be an _HCELL containing CELL_DATA, but to save time we skip the size of the HCELL cell = self._context.object( - symbol = self._table_name + constants.BANG + "_CELL_DATA", - offset = cell_offset + 4, - layer_name = self.name) + symbol = self._table_name + constants.BANG + "_CELL_DATA", offset = cell_offset + 4, layer_name = self.name) return cell def get_node(self, cell_offset: int) -> 'objects.Struct': @@ -149,8 +146,8 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): @staticmethod def _mask(value: int, high_bit: int, low_bit: int) -> int: """Returns the bits of a value between highbit and lowbit inclusive""" - high_mask = (2**(high_bit + 1)) - 1 - low_mask = (2**low_bit) - 1 + high_mask = (2 ** (high_bit + 1)) - 1 + low_mask = (2 ** low_bit) - 1 mask = (high_mask ^ low_mask) # print(high_bit, low_bit, bin(mask), bin(value)) return value & mask diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index 3077b642f..a8cf29bdf 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -83,8 +83,7 @@ class PrimitiveObject(interfaces.objects.ObjectInterface): def __init__(self, context: interfaces.context.ContextInterface, type_name: str, object_info: interfaces.objects.ObjectInformation, data_format: DataFormatInfo) -> None: - super().__init__( - context = context, type_name = type_name, object_info = object_info, data_format = data_format) + super().__init__(context = context, type_name = type_name, object_info = object_info, data_format = data_format) self._data_format = data_format def __new__(cls: Type, @@ -235,8 +234,8 @@ class String(PrimitiveObject, str): # Pass the encoding and error parameters to the string constructor to appropriately encode the string value = cls._struct_type.__new__( cls, - cls._unmarshall( - context, data_format = DataFormatInfo(max_length, "big", False), object_info = object_info), **params) + cls._unmarshall(context, data_format = DataFormatInfo(max_length, "big", False), object_info = object_info), + **params) if value.find('\x00') >= 0: value = value[:value.find('\x00')] return value @@ -252,8 +251,7 @@ class Pointer(Integer): data_format: DataFormatInfo, subtype: Optional[templates.ObjectTemplate] = None) -> None: self._check_type(subtype, templates.ObjectTemplate) - super().__init__( - context = context, object_info = object_info, type_name = type_name, data_format = data_format) + super().__init__(context = context, object_info = object_info, type_name = type_name, data_format = data_format) self._vol['subtype'] = subtype @classmethod @@ -283,8 +281,7 @@ class Pointer(Integer): offset = self & mask return self.vol.subtype( context = self._context, - object_info = interfaces.objects.ObjectInformation( - layer_name = layer_name, offset = offset, parent = self)) + object_info = interfaces.objects.ObjectInformation(layer_name = layer_name, offset = offset, parent = self)) def is_readable(self, layer_name: Optional[str] = None) -> bool: """Determines whether the address of this pointer can be read from memory""" diff --git a/volatility/framework/objects/templates.py b/volatility/framework/objects/templates.py index d017c1dcf..5cdaf2dc2 100644 --- a/volatility/framework/objects/templates.py +++ b/volatility/framework/objects/templates.py @@ -84,7 +84,6 @@ class ReferenceTemplate(interfaces.objects.Template): relative_child_offset = _unresolved # type: ClassVar[Any] has_member = _unresolved # type: ClassVar[Any] - def __call__(self, context: interfaces.context.ContextInterface, - object_info: interfaces.objects.ObjectInformation): + def __call__(self, context: interfaces.context.ContextInterface, object_info: interfaces.objects.ObjectInformation): template = context.symbol_space.get_type(self.vol.type_name) return template(context = context, object_info = object_info) diff --git a/volatility/framework/plugins/linux/bash.py b/volatility/framework/plugins/linux/bash.py index 421d8da5e..f837e6404 100644 --- a/volatility/framework/plugins/linux/bash.py +++ b/volatility/framework/plugins/linux/bash.py @@ -92,8 +92,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): plugin = pslist.PsList.list_tasks - for row in self._generator( - plugin(self.context, self.config['primary'], self.config['vmlinux'], filter = filt)): + for row in self._generator(plugin(self.context, self.config['primary'], self.config['vmlinux'], filter = filt)): _depth, row_data = row description = "{} ({}): \"{}\"".format(row_data[0], row_data[1], row_data[3]) yield (description, timeliner.TimeLinerType.CREATED, row_data[2]) diff --git a/volatility/framework/plugins/linux/check_syscall.py b/volatility/framework/plugins/linux/check_syscall.py index 91cb30423..821cb51c7 100644 --- a/volatility/framework/plugins/linux/check_syscall.py +++ b/volatility/framework/plugins/linux/check_syscall.py @@ -94,8 +94,7 @@ class Check_syscall(plugins.PluginInterface): md = capstone.Cs(capstone.CS_ARCH_X86, mode) try: - func_addr = self.context.symbol_space.get_symbol(vmlinux.name + constants.BANG + - syscall_entry_func).address + func_addr = self.context.symbol_space.get_symbol(vmlinux.name + constants.BANG + syscall_entry_func).address except exceptions.SymbolError as e: # if we can't find the disassemble function then bail and rely on a different method return 0 diff --git a/volatility/framework/plugins/timeliner.py b/volatility/framework/plugins/timeliner.py index eff420d3d..4e78934ce 100644 --- a/volatility/framework/plugins/timeliner.py +++ b/volatility/framework/plugins/timeliner.py @@ -135,8 +135,7 @@ class Timeliner(interfaces.plugins.PluginInterface): for plugin in runable_plugins: old_dict = dict(plugin.build_configuration()) for entry in old_dict: - total_config[interfaces.configuration.path_join(plugin.__class__.__name__, - entry)] = old_dict[entry] + total_config[interfaces.configuration.path_join(plugin.__class__.__name__, entry)] = old_dict[entry] filedata = interfaces.plugins.FileInterface("config.json") with io.TextIOWrapper(filedata.data, write_through = True) as fp: diff --git a/volatility/framework/plugins/windows/dlldump.py b/volatility/framework/plugins/windows/dlldump.py index 20d5e9165..928e4271d 100644 --- a/volatility/framework/plugins/windows/dlldump.py +++ b/volatility/framework/plugins/windows/dlldump.py @@ -54,8 +54,8 @@ class DllDump(interfaces_plugins.PluginInterface): # it requires special handling on wow64 processes, and its # unreliable from an integrity standpoint, let's use the VADs instead protection_string = vad.get_protection( - vadinfo.VadInfo.protect_values(self.context, self.config['primary'], - self.config['nt_symbols']), vadinfo.winnt_protections) + vadinfo.VadInfo.protect_values(self.context, self.config['primary'], self.config['nt_symbols']), + vadinfo.winnt_protections) # DLLs are write copy... if protection_string != "PAGE_EXECUTE_WRITECOPY": diff --git a/volatility/framework/plugins/windows/handles.py b/volatility/framework/plugins/windows/handles.py index cb90b1ffe..c3a16663c 100644 --- a/volatility/framework/plugins/windows/handles.py +++ b/volatility/framework/plugins/windows/handles.py @@ -268,8 +268,7 @@ class Handles(interfaces_plugins.PluginInterface): obj_name = item.file_name_with_device() elif obj_type == "Process": item = entry.Body.cast(self.config["nt_symbols"] + constants.BANG + "_EPROCESS") - obj_name = "{} Pid {}".format( - utility.array_to_string(proc.ImageFileName), item.UniqueProcessId) + obj_name = "{} Pid {}".format(utility.array_to_string(proc.ImageFileName), item.UniqueProcessId) elif obj_type == "Thread": item = entry.Body.cast(self.config["nt_symbols"] + constants.BANG + "_ETHREAD") obj_name = "Tid {} Pid {}".format(item.Cid.UniqueThread, item.Cid.UniqueProcess) diff --git a/volatility/framework/plugins/windows/moddump.py b/volatility/framework/plugins/windows/moddump.py index c878b49de..4eb15e0d4 100644 --- a/volatility/framework/plugins/windows/moddump.py +++ b/volatility/framework/plugins/windows/moddump.py @@ -51,9 +51,7 @@ class ModDump(interfaces_plugins.PluginInterface): # create the session space object in the process' own layer. # not all processes have a valid session pointer. session_space = context.object( - symbol_table + constants.BANG + "_MM_SESSION_SPACE", - layer_name = layer_name, - offset = proc.Session) + symbol_table + constants.BANG + "_MM_SESSION_SPACE", layer_name = layer_name, offset = proc.Session) if session_space.SessionId in seen_ids: continue diff --git a/volatility/framework/plugins/windows/modules.py b/volatility/framework/plugins/windows/modules.py index 8dd91b41d..d416c2407 100644 --- a/volatility/framework/plugins/windows/modules.py +++ b/volatility/framework/plugins/windows/modules.py @@ -63,5 +63,5 @@ class Modules(interfaces.plugins.PluginInterface): yield mod def run(self): - return renderers.TreeGrid([("Offset", format_hints.Hex), ("Base", format_hints.Hex), - ("Size", format_hints.Hex), ("Name", str), ("Path", str)], self._generator()) + return renderers.TreeGrid([("Offset", format_hints.Hex), ("Base", format_hints.Hex), ("Size", format_hints.Hex), + ("Name", str), ("Path", str)], self._generator()) diff --git a/volatility/framework/plugins/windows/pslist.py b/volatility/framework/plugins/windows/pslist.py index a2e3ec89e..282f51940 100644 --- a/volatility/framework/plugins/windows/pslist.py +++ b/volatility/framework/plugins/windows/pslist.py @@ -21,8 +21,7 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), # TODO: Convert this to a ListRequirement so that people can filter on sets of pids requirements.IntRequirement( - name = 'pid', - description = "Process ID to include (all other processes are excluded)", + name = 'pid', description = "Process ID to include (all other processes are excluded)", optional = True), requirements.BooleanRequirement( name = 'physical', @@ -92,11 +91,10 @@ class PsList(plugins.PluginInterface, timeliner.TimeLinerInterface): raise TypeError("Primary layer is not an intel layer") (_, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0] - yield (0, - (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId, - proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = 'replace'), - format_hints.Hex(offset), proc.ActiveThreads, proc.get_handle_count(), proc.get_session_id(), - proc.get_is_wow64(), proc.get_create_time(), proc.get_exit_time())) + yield (0, (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId, + proc.ImageFileName.cast("string", max_length = proc.ImageFileName.vol.count, errors = 'replace'), + format_hints.Hex(offset), proc.ActiveThreads, proc.get_handle_count(), proc.get_session_id(), + proc.get_is_wow64(), proc.get_create_time(), proc.get_exit_time())) def generate_timeline(self): for row in self._generator(): diff --git a/volatility/framework/plugins/windows/registry/printkey.py b/volatility/framework/plugins/windows/registry/printkey.py index 6211c49e7..304dd269d 100644 --- a/volatility/framework/plugins/windows/registry/printkey.py +++ b/volatility/framework/plugins/windows/registry/printkey.py @@ -63,8 +63,8 @@ class PrintKey(interfaces.plugins.PluginInterface): try: import volatility.plugins.windows.registry.hivelist as hivelist hive_offsets = [ - hive.vol.offset for hive in hivelist.HiveList.list_hives(self.context, self.config['primary'], - self.config['nt_symbols']) + hive.vol.offset for hive in hivelist.HiveList.list_hives(self.context, self.config['primary'], self. + config['nt_symbols']) ] except ImportError: vollog.warning("Unable to import windows.hivelist plugin, please provide a hive offset") diff --git a/volatility/framework/plugins/windows/registry/userassist.py b/volatility/framework/plugins/windows/registry/userassist.py index d83cc1c70..3fb2661b4 100644 --- a/volatility/framework/plugins/windows/registry/userassist.py +++ b/volatility/framework/plugins/windows/registry/userassist.py @@ -138,10 +138,10 @@ class UserAssist(interfaces.plugins.PluginInterface): # output the parent Count key result = ( - 0, (renderers.format_hints.Hex(hive.hive_offset), hive_name, - countkey_path, countkey_last_write_time, "Key", renderers.NotApplicableValue(), + 0, (renderers.format_hints.Hex(hive.hive_offset), hive_name, countkey_path, + countkey_last_write_time, "Key", renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(), - renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue()) + renderers.NotApplicableValue(), renderers.NotApplicableValue()) ) # type: Tuple[int, Tuple[format_hints.Hex, Any, Any, Any, Any, Any, Any, Any, Any, Any, Any, Any]] yield result diff --git a/volatility/framework/plugins/windows/vadyarascan.py b/volatility/framework/plugins/windows/vadyarascan.py index 5d3180983..d3b80a271 100644 --- a/volatility/framework/plugins/windows/vadyarascan.py +++ b/volatility/framework/plugins/windows/vadyarascan.py @@ -22,8 +22,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = "Primary kernel address space", architectures = ["Intel32", - "Intel64"]), + name = 'primary', description = "Primary kernel address space", architectures = ["Intel32", "Intel64"]), requirements.SymbolRequirement(name = "nt_symbols", description = "Windows OS"), requirements.BooleanRequirement( name = "wide", description = "Match wide (unicode) strings", default = False, optional = True), diff --git a/volatility/framework/plugins/yarascan.py b/volatility/framework/plugins/yarascan.py index d6db39c20..ea392ec1e 100644 --- a/volatility/framework/plugins/yarascan.py +++ b/volatility/framework/plugins/yarascan.py @@ -35,8 +35,7 @@ class YaraScan(plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( - name = 'primary', description = "Primary kernel address space", architectures = ["Intel32", - "Intel64"]), + name = 'primary', description = "Primary kernel address space", architectures = ["Intel32", "Intel64"]), requirements.BooleanRequirement( name = "all", description = "Scan both process and kernel memory", default = False, optional = True), requirements.BooleanRequirement( diff --git a/volatility/framework/symbols/linux/__init__.py b/volatility/framework/symbols/linux/__init__.py index 9842a1fc7..826f8f5fc 100644 --- a/volatility/framework/symbols/linux/__init__.py +++ b/volatility/framework/symbols/linux/__init__.py @@ -6,8 +6,7 @@ from volatility.framework.symbols.linux import extensions class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): provides = {"type": "interface"} - def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, - isf_url: str) -> None: + def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, isf_url: str) -> None: super().__init__(context = context, config_path = config_path, name = name, isf_url = isf_url) # Set-up Linux specific types diff --git a/volatility/framework/symbols/mac/__init__.py b/volatility/framework/symbols/mac/__init__.py index 1f000cb67..e57a22125 100644 --- a/volatility/framework/symbols/mac/__init__.py +++ b/volatility/framework/symbols/mac/__init__.py @@ -6,8 +6,7 @@ from volatility.framework.symbols.mac import extensions class MacKernelIntermedSymbols(intermed.IntermediateSymbolTable): provides = {"type": "interface"} - def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, - isf_url: str) -> None: + def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, isf_url: str) -> None: super().__init__(context = context, config_path = config_path, name = name, isf_url = isf_url) self.set_type_class('proc', extensions.proc) diff --git a/volatility/framework/symbols/windows/__init__.py b/volatility/framework/symbols/windows/__init__.py index 8b774a290..cd3287403 100644 --- a/volatility/framework/symbols/windows/__init__.py +++ b/volatility/framework/symbols/windows/__init__.py @@ -6,8 +6,7 @@ from volatility.framework.symbols.windows.extensions import registry class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): - def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, - isf_url: str) -> None: + def __init__(self, context: interfaces.context.ContextInterface, config_path: str, name: str, isf_url: str) -> None: super().__init__(context = context, config_path = config_path, name = name, isf_url = isf_url) # Set-up windows specific types diff --git a/volatility/framework/symbols/windows/extensions/kdbg.py b/volatility/framework/symbols/windows/extensions/kdbg.py index 9333fc641..8c1a9ae01 100644 --- a/volatility/framework/symbols/windows/extensions/kdbg.py +++ b/volatility/framework/symbols/windows/extensions/kdbg.py @@ -24,8 +24,6 @@ class _KDDEBUGGER_DATA64(objects.Struct): symbol_table_name = self.get_symbol_table().name csdresult = self._context.object( - symbol_table_name + constants.BANG + "unsigned long", - layer_name = layer_name, - offset = self.CmNtCSDVersion) + symbol_table_name + constants.BANG + "unsigned long", layer_name = layer_name, offset = self.CmNtCSDVersion) return (csdresult >> 8) & 0xffffffff diff --git a/volatility/framework/symbols/windows/extensions/pe.py b/volatility/framework/symbols/windows/extensions/pe.py index 65aa661d2..56ef12d0e 100644 --- a/volatility/framework/symbols/windows/extensions/pe.py +++ b/volatility/framework/symbols/windows/extensions/pe.py @@ -71,8 +71,7 @@ class _IMAGE_DOS_HEADER(objects.Struct): image_base_offset = nt_header.OptionalHeader.ImageBase.vol.offset - self.vol.offset image_base_type = nt_header.OptionalHeader.ImageBase.vol.type_name member_size = self._context.symbol_space.get_type(image_base_type).size - newval = objects.convert_value_to_data(self.vol.offset, int, - nt_header.OptionalHeader.ImageBase.vol.data_format) + newval = objects.convert_value_to_data(self.vol.offset, int, nt_header.OptionalHeader.ImageBase.vol.data_format) return raw_data[:image_base_offset] + newval + raw_data[image_base_offset + member_size:] def reconstruct(self) -> Generator[Tuple[int, bytes], None, None]: diff --git a/volatility/plugins/windows/statistics.py b/volatility/plugins/windows/statistics.py index 716f00ba2..0ebc8d6d2 100644 --- a/volatility/plugins/windows/statistics.py +++ b/volatility/plugins/windows/statistics.py @@ -45,8 +45,7 @@ class Statistics(plugins.PluginInterface): page_addr += page_size self._progress_callback((page_addr * 100) / layer.maximum_address, "Reading memory") - yield (0, (page_count, large_page_count, swap_count, large_swap_count, invalid_page_count, - large_invalid_count)) + yield (0, (page_count, large_page_count, swap_count, large_swap_count, invalid_page_count, large_invalid_count)) def run(self): return renderers.TreeGrid([("Valid pages (all)", int), ("Valid pages (large)", int),