WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-26 19:44:50 +02:00
Code Issues Packages Projects Releases Wiki Activity

Improve docstrings for all plugins, and reformat all docstrings.

Browse Source
This commit is contained in:
Mike Auty
2019-09-07 22:59:54 +01:00
parent dc0a809729
commit e922cef316
134 changed files with 1933 additions and 1250 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/moddump.py
+16 -7
View File
@@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__)
class ModDump(interfaces.plugins.PluginInterface):
"""Dumps kernel modules"""
"""Dumps kernel modules."""
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -41,8 +41,14 @@ class ModDump(interfaces.plugins.PluginInterface):
the primary/kernel layer. Then keep one layer per session by cycling
through the process list.
Args:
context: The context to retrieve required elements (layers, symbol tables) from
layer_name: The name of the layer on which to operate
symbol_table: The name of the table containing the kernel symbols
pids: A list of process identifiers to include exclusively or None for no filter
Returns:
<list> of layer names
A list of session layer names
"""
seen_ids = [] # type: List[interfaces.objects.ObjectInterface]
filter_func = pslist.PsList.create_pid_filter(pids or [])
@@ -72,15 +78,18 @@ class ModDump(interfaces.plugins.PluginInterface):
@classmethod
def find_session_layer(cls, context: interfaces.context.ContextInterface, session_layers: Iterable[str],
base_address: int):
"""Given a base address and a list of layer names, find a
layer that can access the specified address.
"""Given a base address and a list of layer names, find a layer that
can access the specified address.
Args:
session_layers: <list> of layer names
base_address: <int> the base address
context: The context to retrieve required elements (layers, symbol tables) from
layer_name: The name of the layer on which to operate
symbol_table: The name of the table containing the kernel symbols
session_layers: A list of session layer names
base_address: The base address to identify the layers that can access it
Returns:
layer name (or None)
Layer name or None if no layers that contain the base address can be found
"""
for layer_name in session_layers: