From ef29008cc8773ea2d02e63b89a856055cd53ad6e Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 26 Mar 2025 17:53:19 -0500 Subject: [PATCH] #1471 - fix class deprecation and update other plugins --- volatility3/framework/deprecation.py | 5 +++-- .../framework/plugins/windows/cachedump.py | 18 +++++++----------- .../framework/plugins/windows/hashdump.py | 18 +++++++----------- .../framework/plugins/windows/lsadump.py | 18 +++++++----------- .../plugins/windows/scheduled_tasks.py | 18 +++++++----------- 5 files changed, 31 insertions(+), 46 deletions(-) diff --git a/volatility3/framework/deprecation.py b/volatility3/framework/deprecation.py index ba07743a3..b9b84f001 100644 --- a/volatility3/framework/deprecation.py +++ b/volatility3/framework/deprecation.py @@ -121,7 +121,7 @@ class PluginRenameClass: deprecated_class_name = f"{cls.__module__}.{cls.__qualname__}" super().__init_subclass__(**kwargs) for attr, value in replacement_class.__dict__.items(): - if isinstance(value, classmethod): + if isinstance(value, classmethod) and attr != "get_requirements": setattr( cls, attr, @@ -134,5 +134,6 @@ class PluginRenameClass: ), ) else: - setattr(cls, attr, value) + if not attr.startswith("__"): + setattr(cls, attr, value) return super(replacement_class).__init_subclass__(**kwargs) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 14320312a..35127c6f3 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -2,23 +2,19 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -import warnings +from volatility3.framework import interfaces, deprecation from volatility3.plugins.windows.registry import cachedump vollog = logging.getLogger(__name__) -class Cachedump(cachedump.Cachedump): +class Cachedump( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=cachedump.Cachedump, + removal_date="2025-09-25", +): """Dumps lsa secrets from memory (deprecated)""" _required_framework_version = (2, 0, 0) _version = (1, 0, 2) - - def __getattribute__(self, *args, **kwargs): - warnings.warn( - FutureWarning( - "The windows.cachedump.Cachedump plugin is deprecated and will be removed on " - "2025-09-25. Use windows.registry.cachedump.Cachedump instead." - ) - ) - return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index 98baf7d53..e496e77a9 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -2,23 +2,19 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -import warnings +from volatility3.framework import interfaces, deprecation from volatility3.plugins.windows.registry import hashdump vollog = logging.getLogger(__name__) -class Hashdump(hashdump.Hashdump): +class Hashdump( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=hashdump.Hashdump, + removal_date="2025-09-25", +): """Dumps user hashes from memory (deprecated)""" _required_framework_version = (2, 0, 0) _version = (1, 1, 1) - - def __getattribute__(self, *args, **kwargs): - warnings.warn( - FutureWarning( - "The windows.hashdump.Hashdump plugin is deprecated and will be removed on " - "2025-09-25. Use windows.registry.hashdump.Hashdump instead." - ) - ) - return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 86cbe1949..0b36ddef0 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -2,23 +2,19 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -import warnings +from volatility3.framework import interfaces, deprecation from volatility3.plugins.windows.registry import lsadump vollog = logging.getLogger(__name__) -class Lsadump(lsadump.Lsadump): +class Lsadump( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=lsadump.Lsadump, + removal_date="2025-09-25", +): """Dumps lsa secrets from memory (deprecated)""" _required_framework_version = (2, 0, 0) _version = (1, 0, 1) - - def __getattribute__(self, *args, **kwargs): - warnings.warn( - FutureWarning( - "The windows.lsadump.Lsadump plugin is deprecated and will be removed on " - "2025-09-25. Use windows.registry.lsadump.Lsadump instead." - ) - ) - return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index 7241f07d1..62d8e3b88 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -2,24 +2,20 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -import warnings +from volatility3.framework import interfaces, deprecation from volatility3.plugins.windows.registry import scheduled_tasks vollog = logging.getLogger(__name__) -class ScheduledTasks(scheduled_tasks.ScheduledTasks): +class ScheduledTasks( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=scheduled_tasks.ScheduledTasks, + removal_date="2025-09-25", +): """Decodes scheduled task information from the Windows registry, including information about triggers, actions, run times, and creation times (deprecated).""" _required_framework_version = (2, 11, 0) _version = (2, 0, 0) - - def __getattribute__(self, *args, **kwargs): - warnings.warn( - FutureWarning( - "The windows.registry.scheduled_tasks.ScheduledTasks plugin is deprecated and will be removed on " - "2025-09-25. Use windows.registry.scheduled_tasks.ScheduledTasks instead." - ) - ) - return super().__getattribute__(*args, **kwargs)