From ef5d21ea7c294e63ceae68e9550c0f653a83c335 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 9 Oct 2017 00:05:50 +0100 Subject: [PATCH] Refactor the names given the new deprecation. The concept is to have a helper_ namespace, to ensure that members cannot accidentally be overriden by properties in extended classes. This demonstrates that by renaming all extension properties to helper_. --- volatility/framework/symbols/windows/extensions/__init__.py | 6 +++--- volatility/plugins/windows/dlllist.py | 6 +++--- volatility/plugins/windows/hivelist.py | 2 +- volatility/plugins/windows/modules.py | 4 ++-- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 032500ceb..2f2249934 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -15,14 +15,14 @@ class _ETHREAD(objects.Struct): class _CMHIVE(objects.Struct): @property - def name(self): + def helper_name(self): """Determine a name for the hive. Note that some attributes are unpredictably blank across different OS versions while others are populated, so we check all possibilities and take the first one that's not empty""" for attr in ["FileFullPath", "FileUserName", "HiveRootPath"]: try: - return getattr(self, attr).String + return getattr(self, attr).helper_string except (AttributeError, exceptions.InvalidAddressException): pass @@ -31,7 +31,7 @@ class _CMHIVE(objects.Struct): class _UNICODE_STRING(objects.Struct): @property - def String(self): + def helper_string(self): # We explicitly do *not* catch errors here, we allow an exception to be thrown # (otherwise there's no way to determine anything went wrong) # It's up to the user of this method to catch exceptions diff --git a/volatility/plugins/windows/dlllist.py b/volatility/plugins/windows/dlllist.py index 4de6278c6..c06135e56 100644 --- a/volatility/plugins/windows/dlllist.py +++ b/volatility/plugins/windows/dlllist.py @@ -1,7 +1,7 @@ import volatility.framework.interfaces.plugins as interfaces_plugins -from volatility.plugins.windows import pslist from volatility.framework import exceptions, renderers from volatility.framework.renderers import format_hints +from volatility.plugins.windows import pslist class DllList(interfaces_plugins.PluginInterface): @@ -20,9 +20,9 @@ class DllList(interfaces_plugins.PluginInterface): BaseDllName = FullDllName = "" try: - BaseDllName = entry.BaseDllName.String + BaseDllName = entry.BaseDllName.helper_string # We assume that if the BaseDllName points to an invalid buffer, so will FullDllName - FullDllName = entry.FullDllName.String + FullDllName = entry.FullDllName.helper_string except exceptions.InvalidAddressException: pass diff --git a/volatility/plugins/windows/hivelist.py b/volatility/plugins/windows/hivelist.py index 60df17651..f2845cef3 100644 --- a/volatility/plugins/windows/hivelist.py +++ b/volatility/plugins/windows/hivelist.py @@ -21,7 +21,7 @@ class HiveList(plugins.PluginInterface): for hive in self.list_hives(): yield (0, (format_hints.Hex(hive.vol.offset), - hive.name or "")) + hive.helper_name or "")) def list_hives(self): """Lists all the hives in the primary layer""" diff --git a/volatility/plugins/windows/modules.py b/volatility/plugins/windows/modules.py index 0114839a1..83223691d 100644 --- a/volatility/plugins/windows/modules.py +++ b/volatility/plugins/windows/modules.py @@ -22,12 +22,12 @@ class Modules(plugins.PluginInterface): for mod in self.list_modules(): try: - BaseDllName = mod.BaseDllName.String + BaseDllName = mod.BaseDllName.helper_string except exceptions.InvalidAddressException: BaseDllName = "" try: - FullDllName = mod.FullDllName.String + FullDllName = mod.FullDllName.helper_string except exceptions.InvalidAddressException: FullDllName = ""