From c8791c241af545bca2396937f2775262354e8ee8 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 12 Mar 2025 12:22:04 -0500 Subject: [PATCH 01/10] #1471 - move registry plugins to registry directory --- volatility3/framework/plugins/windows/{ => registry}/amcache.py | 0 volatility3/framework/plugins/windows/{ => registry}/cachedump.py | 0 volatility3/framework/plugins/windows/{ => registry}/hashdump.py | 0 volatility3/framework/plugins/windows/{ => registry}/lsadump.py | 0 .../framework/plugins/windows/{ => registry}/scheduled_tasks.py | 0 5 files changed, 0 insertions(+), 0 deletions(-) rename volatility3/framework/plugins/windows/{ => registry}/amcache.py (100%) rename volatility3/framework/plugins/windows/{ => registry}/cachedump.py (100%) rename volatility3/framework/plugins/windows/{ => registry}/hashdump.py (100%) rename volatility3/framework/plugins/windows/{ => registry}/lsadump.py (100%) rename volatility3/framework/plugins/windows/{ => registry}/scheduled_tasks.py (100%) diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/registry/amcache.py similarity index 100% rename from volatility3/framework/plugins/windows/amcache.py rename to volatility3/framework/plugins/windows/registry/amcache.py diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/registry/cachedump.py similarity index 100% rename from volatility3/framework/plugins/windows/cachedump.py rename to volatility3/framework/plugins/windows/registry/cachedump.py diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/registry/hashdump.py similarity index 100% rename from volatility3/framework/plugins/windows/hashdump.py rename to volatility3/framework/plugins/windows/registry/hashdump.py diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/registry/lsadump.py similarity index 100% rename from volatility3/framework/plugins/windows/lsadump.py rename to volatility3/framework/plugins/windows/registry/lsadump.py diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/registry/scheduled_tasks.py similarity index 100% rename from volatility3/framework/plugins/windows/scheduled_tasks.py rename to volatility3/framework/plugins/windows/registry/scheduled_tasks.py From 54f1f746cd81f8222c58a42b1a6c931f87fe828b Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 12 Mar 2025 12:23:30 -0500 Subject: [PATCH 02/10] #1471 - import from correct location --- volatility3/framework/plugins/windows/registry/cachedump.py | 3 +-- volatility3/framework/plugins/windows/registry/lsadump.py | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/windows/registry/cachedump.py b/volatility3/framework/plugins/windows/registry/cachedump.py index 7bc35945a..c46ea237e 100644 --- a/volatility3/framework/plugins/windows/registry/cachedump.py +++ b/volatility3/framework/plugins/windows/registry/cachedump.py @@ -12,8 +12,7 @@ from volatility3.framework import interfaces, renderers, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.layers import registry from volatility3.framework.symbols.windows import versions -from volatility3.plugins.windows import hashdump, lsadump -from volatility3.plugins.windows.registry import hivelist +from volatility3.plugins.windows.registry import hashdump, hivelist, lsadump vollog = logging.getLogger(__name__) diff --git a/volatility3/framework/plugins/windows/registry/lsadump.py b/volatility3/framework/plugins/windows/registry/lsadump.py index 72f2fa146..2154923ec 100644 --- a/volatility3/framework/plugins/windows/registry/lsadump.py +++ b/volatility3/framework/plugins/windows/registry/lsadump.py @@ -14,8 +14,7 @@ from volatility3.framework.exceptions import InvalidAddressException from volatility3.framework.layers import registry from volatility3.framework.symbols.windows import versions -from volatility3.plugins.windows import hashdump -from volatility3.plugins.windows.registry import hivelist +from volatility3.plugins.windows.registry import hashdump, hivelist from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) From 474e8e69166b4edc1e230dd4f6504a541a52d546 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 12 Mar 2025 12:31:26 -0500 Subject: [PATCH 03/10] #1471 - add deprecated plugins in old location --- .../framework/plugins/windows/amcache.py | 23 ++++++++++++++++++ .../framework/plugins/windows/cachedump.py | 23 ++++++++++++++++++ .../framework/plugins/windows/hashdump.py | 23 ++++++++++++++++++ .../framework/plugins/windows/lsadump.py | 23 ++++++++++++++++++ .../plugins/windows/scheduled_tasks.py | 24 +++++++++++++++++++ 5 files changed, 116 insertions(+) create mode 100644 volatility3/framework/plugins/windows/amcache.py create mode 100644 volatility3/framework/plugins/windows/cachedump.py create mode 100644 volatility3/framework/plugins/windows/hashdump.py create mode 100644 volatility3/framework/plugins/windows/lsadump.py create mode 100644 volatility3/framework/plugins/windows/scheduled_tasks.py diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py new file mode 100644 index 000000000..65ef041db --- /dev/null +++ b/volatility3/framework/plugins/windows/amcache.py @@ -0,0 +1,23 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import amcache + +vollog = logging.getLogger(__name__) + + +class Amcache(amcache.Amcache): + """Extract information on executed applications from the AmCache (deprecated).""" + + _required_framework_version = (2, 0, 0) + _version = (2, 0, 0) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.amcache.Amcache" + ) + ) + return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py new file mode 100644 index 000000000..73ab7c87b --- /dev/null +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -0,0 +1,23 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import cachedump + +vollog = logging.getLogger(__name__) + + +class Cachedump(cachedump.Cachedump): + """Dumps lsa secrets from memory (deprecated)""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 2) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.cachedump.Cachedump" + ) + ) + return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py new file mode 100644 index 000000000..c875dda50 --- /dev/null +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -0,0 +1,23 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import hashdump + +vollog = logging.getLogger(__name__) + + +class Hashdump(hashdump.Hashdump): + """Dumps user hashes from memory (deprecated)""" + + _required_framework_version = (2, 0, 0) + _version = (1, 1, 1) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.hashdump.Hashdump" + ) + ) + return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py new file mode 100644 index 000000000..65e58cc25 --- /dev/null +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -0,0 +1,23 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import lsadump + +vollog = logging.getLogger(__name__) + + +class Lsadump(lsadump.Lsadump): + """Dumps lsa secrets from memory (deprecated)""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 1) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.lsadump.Lsadump" + ) + ) + return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py new file mode 100644 index 000000000..4b32f6be7 --- /dev/null +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -0,0 +1,24 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import scheduled_tasks + +vollog = logging.getLogger(__name__) + + +class ScheduledTasks(scheduled_tasks.ScheduledTasks): + """Decodes scheduled task information from the Windows registry, including \ +information about triggers, actions, run times, and creation times (deprecated).""" + + _required_framework_version = (2, 11, 0) + _version = (2, 0, 0) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.scheduled_tasks.ScheduledTasks" + ) + ) + return super().__getattr__(*args, **kwargs) From 3a6063f2709bccb95b633c20d6d68906cc6e19a1 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 12 Mar 2025 15:51:42 -0500 Subject: [PATCH 04/10] #1471 - change DeprecationWarning to FutureWarning --- volatility3/framework/plugins/windows/amcache.py | 4 +--- volatility3/framework/plugins/windows/cachedump.py | 2 +- volatility3/framework/plugins/windows/hashdump.py | 2 +- volatility3/framework/plugins/windows/lsadump.py | 4 +--- volatility3/framework/plugins/windows/scheduled_tasks.py | 2 +- 5 files changed, 5 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index 65ef041db..dade91a7d 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -16,8 +16,6 @@ class Amcache(amcache.Amcache): def __getattr__(self, *args, **kwargs): warnings.warn( - DeprecationWarning( - "This plugin is now called windows.registry.amcache.Amcache" - ) + FutureWarning("This plugin is now called windows.registry.amcache.Amcache") ) return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 73ab7c87b..7aa63e013 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -16,7 +16,7 @@ class Cachedump(cachedump.Cachedump): def __getattr__(self, *args, **kwargs): warnings.warn( - DeprecationWarning( + FutureWarning( "This plugin is now called windows.registry.cachedump.Cachedump" ) ) diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index c875dda50..fa23541bc 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -16,7 +16,7 @@ class Hashdump(hashdump.Hashdump): def __getattr__(self, *args, **kwargs): warnings.warn( - DeprecationWarning( + FutureWarning( "This plugin is now called windows.registry.hashdump.Hashdump" ) ) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 65e58cc25..a360d6ca8 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -16,8 +16,6 @@ class Lsadump(lsadump.Lsadump): def __getattr__(self, *args, **kwargs): warnings.warn( - DeprecationWarning( - "This plugin is now called windows.registry.lsadump.Lsadump" - ) + FutureWarning("This plugin is now called windows.registry.lsadump.Lsadump") ) return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index 4b32f6be7..4861092ba 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -17,7 +17,7 @@ information about triggers, actions, run times, and creation times (deprecated). def __getattr__(self, *args, **kwargs): warnings.warn( - DeprecationWarning( + FutureWarning( "This plugin is now called windows.registry.scheduled_tasks.ScheduledTasks" ) ) From f0991a9cf6cbdd91a474a7ac845eb0d31cf9beb0 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 12 Mar 2025 16:33:09 -0500 Subject: [PATCH 05/10] #1471 - getattribute instead of getattr, and removal date --- volatility3/framework/plugins/windows/amcache.py | 9 ++++++--- volatility3/framework/plugins/windows/cachedump.py | 7 ++++--- volatility3/framework/plugins/windows/hashdump.py | 7 ++++--- volatility3/framework/plugins/windows/lsadump.py | 9 ++++++--- .../plugins/windows/registry/scheduled_tasks.py | 4 ++-- .../framework/plugins/windows/scheduled_tasks.py | 11 ++++++----- 6 files changed, 28 insertions(+), 19 deletions(-) diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index dade91a7d..90e0949c8 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -14,8 +14,11 @@ class Amcache(amcache.Amcache): _required_framework_version = (2, 0, 0) _version = (2, 0, 0) - def __getattr__(self, *args, **kwargs): + def __getattribute__(self, *args, **kwargs): warnings.warn( - FutureWarning("This plugin is now called windows.registry.amcache.Amcache") + FutureWarning( + "The windows.amcache.Amcache plugin is deprecated and will be removed on " + "September 19, 2025. Use windows.registry.amcache.Amcache instead." + ) ) - return super().__getattr__(*args, **kwargs) + return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 7aa63e013..8640ae5cf 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -14,10 +14,11 @@ class Cachedump(cachedump.Cachedump): _required_framework_version = (2, 0, 0) _version = (1, 0, 2) - def __getattr__(self, *args, **kwargs): + def __getattribute__(self, *args, **kwargs): warnings.warn( FutureWarning( - "This plugin is now called windows.registry.cachedump.Cachedump" + "The windows.cachedump.Cachedump plugin is deprecated and will be removed on " + "September 19, 2025. Use windows.registry.cachedump.Cachedump instead." ) ) - return super().__getattr__(*args, **kwargs) + return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index fa23541bc..ee6bdb477 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -14,10 +14,11 @@ class Hashdump(hashdump.Hashdump): _required_framework_version = (2, 0, 0) _version = (1, 1, 1) - def __getattr__(self, *args, **kwargs): + def __getattribute__(self, *args, **kwargs): warnings.warn( FutureWarning( - "This plugin is now called windows.registry.hashdump.Hashdump" + "The windows.hashdump.Hashdump plugin is deprecated and will be removed on " + "September 19, 2025. Use windows.registry.hashdump.Hashdump instead." ) ) - return super().__getattr__(*args, **kwargs) + return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index a360d6ca8..8ee173e89 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -14,8 +14,11 @@ class Lsadump(lsadump.Lsadump): _required_framework_version = (2, 0, 0) _version = (1, 0, 1) - def __getattr__(self, *args, **kwargs): + def __getattribute__(self, *args, **kwargs): warnings.warn( - FutureWarning("This plugin is now called windows.registry.lsadump.Lsadump") + FutureWarning( + "The windows.lsadump.Lsadump plugin is deprecated and will be removed on " + "September 19, 2025. Use windows.registry.lsadump.Lsadump instead." + ) ) - return super().__getattr__(*args, **kwargs) + return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/registry/scheduled_tasks.py b/volatility3/framework/plugins/windows/registry/scheduled_tasks.py index ba54e19ec..3aa82a69e 100644 --- a/volatility3/framework/plugins/windows/registry/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/registry/scheduled_tasks.py @@ -1108,8 +1108,8 @@ class DynamicInfo: class ScheduledTasks(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): - """Decodes scheduled task information from the Windows registry, including \ -information about triggers, actions, run times, and creation times.""" + """Decodes scheduled task information from the Windows registry, including + information about triggers, actions, run times, and creation times.""" _required_framework_version = (2, 11, 0) _version = (2, 0, 0) diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index 4861092ba..15d8abb93 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -9,16 +9,17 @@ vollog = logging.getLogger(__name__) class ScheduledTasks(scheduled_tasks.ScheduledTasks): - """Decodes scheduled task information from the Windows registry, including \ -information about triggers, actions, run times, and creation times (deprecated).""" + """Decodes scheduled task information from the Windows registry, including + information about triggers, actions, run times, and creation times (deprecated).""" _required_framework_version = (2, 11, 0) _version = (2, 0, 0) - def __getattr__(self, *args, **kwargs): + def __getattribute__(self, *args, **kwargs): warnings.warn( FutureWarning( - "This plugin is now called windows.registry.scheduled_tasks.ScheduledTasks" + "The windows.registry.scheduled_tasks.ScheduledTasks plugin is deprecated and will be removed on " + "September 19, 2025. Use windows.registry.scheduled_tasks.ScheduledTasks instead." ) ) - return super().__getattr__(*args, **kwargs) + return super().__getattribute__(*args, **kwargs) From 154999461fbecf374661f14c0ae5d3ec067e855e Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 12 Mar 2025 19:02:59 -0500 Subject: [PATCH 06/10] #1471 - use standard date format --- volatility3/framework/plugins/windows/amcache.py | 2 +- volatility3/framework/plugins/windows/cachedump.py | 2 +- volatility3/framework/plugins/windows/hashdump.py | 2 +- volatility3/framework/plugins/windows/lsadump.py | 2 +- volatility3/framework/plugins/windows/scheduled_tasks.py | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index 90e0949c8..6e45d5b36 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -18,7 +18,7 @@ class Amcache(amcache.Amcache): warnings.warn( FutureWarning( "The windows.amcache.Amcache plugin is deprecated and will be removed on " - "September 19, 2025. Use windows.registry.amcache.Amcache instead." + "2025-09-25. Use windows.registry.amcache.Amcache instead." ) ) return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 8640ae5cf..14320312a 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -18,7 +18,7 @@ class Cachedump(cachedump.Cachedump): warnings.warn( FutureWarning( "The windows.cachedump.Cachedump plugin is deprecated and will be removed on " - "September 19, 2025. Use windows.registry.cachedump.Cachedump instead." + "2025-09-25. Use windows.registry.cachedump.Cachedump instead." ) ) return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index ee6bdb477..98baf7d53 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -18,7 +18,7 @@ class Hashdump(hashdump.Hashdump): warnings.warn( FutureWarning( "The windows.hashdump.Hashdump plugin is deprecated and will be removed on " - "September 19, 2025. Use windows.registry.hashdump.Hashdump instead." + "2025-09-25. Use windows.registry.hashdump.Hashdump instead." ) ) return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 8ee173e89..86cbe1949 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -18,7 +18,7 @@ class Lsadump(lsadump.Lsadump): warnings.warn( FutureWarning( "The windows.lsadump.Lsadump plugin is deprecated and will be removed on " - "September 19, 2025. Use windows.registry.lsadump.Lsadump instead." + "2025-09-25. Use windows.registry.lsadump.Lsadump instead." ) ) return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index 15d8abb93..7241f07d1 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -19,7 +19,7 @@ class ScheduledTasks(scheduled_tasks.ScheduledTasks): warnings.warn( FutureWarning( "The windows.registry.scheduled_tasks.ScheduledTasks plugin is deprecated and will be removed on " - "September 19, 2025. Use windows.registry.scheduled_tasks.ScheduledTasks instead." + "2025-09-25. Use windows.registry.scheduled_tasks.ScheduledTasks instead." ) ) return super().__getattribute__(*args, **kwargs) From 67533b034a6c31368c1bfc176497368255a6ccfb Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 26 Mar 2025 08:21:28 -0500 Subject: [PATCH 07/10] #1471 - deprecation class for moving --- volatility3/framework/deprecation.py | 47 +++++++++++++++++++ .../framework/plugins/windows/amcache.py | 16 +++---- 2 files changed, 53 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/deprecation.py b/volatility3/framework/deprecation.py index e2e91a0eb..5d8087503 100644 --- a/volatility3/framework/deprecation.py +++ b/volatility3/framework/deprecation.py @@ -88,3 +88,50 @@ def deprecated_method( return wrapper return decorator + +def renamed_class(deprecated_class_name: str, message: str, removal_date: str): + """A decorator for marking classes as being renamed and removed in the future. + Callers to this function should explicitly update to use the other plugins instead. + + Args: + deprecated_class_name: The name of the class being deprecated + message: A message added to the standard deprecation warning. Should include the replacement API paths + removal_date: A YYYY-MM-DD formatted date of when the function will be removed from the framework + """ + + def decorator(replacement_func): + @functools.wraps(replacement_func) + def wrapper(*args, **kwargs): + warnings.warn( + f"This plugin ({deprecated_class_name}) has been renamed and will be removed in the first release after {removal_date}. {message}", + FutureWarning, + ) + return replacement_func(*args, **kwargs) + + return wrapper + + return decorator + + +class PluginRenameClass: + """Class to move all classmethod invocations (for when a plugin has been moved)""" + + def __init_subclass__(cls, replacement_class, removal_date, **kwargs): + deprecated_class_name = f"{cls.__module__}.{cls.__qualname__}" + super().__init_subclass__(**kwargs) + for attr, value in replacement_class.__dict__.items(): + if isinstance(value, classmethod): + setattr( + cls, + attr, + classmethod( + renamed_class( + deprecated_class_name=deprecated_class_name, + removal_date=removal_date, + message=f"Please ensure all method calls to this plugin are replaced with calls to {replacement_class.__module__}.{replacement_class.__qualname__}", + )(value.__func__) + ), + ) + else: + setattr(cls, attr, value) + return super(replacement_class).__init_subclass__(**kwargs) \ No newline at end of file diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index 6e45d5b36..bf0f8f8ad 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -3,22 +3,18 @@ # import logging import warnings +from volatility3.framework import interfaces, deprecation from volatility3.plugins.windows.registry import amcache vollog = logging.getLogger(__name__) -class Amcache(amcache.Amcache): +class Amcache( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=amcache.Amcache, + removal_date="2025-09-25"): """Extract information on executed applications from the AmCache (deprecated).""" _required_framework_version = (2, 0, 0) _version = (2, 0, 0) - - def __getattribute__(self, *args, **kwargs): - warnings.warn( - FutureWarning( - "The windows.amcache.Amcache plugin is deprecated and will be removed on " - "2025-09-25. Use windows.registry.amcache.Amcache instead." - ) - ) - return super().__getattribute__(*args, **kwargs) From f431f519b682d886edcda9b0371f483ee9735c97 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 26 Mar 2025 08:22:37 -0500 Subject: [PATCH 08/10] #1471 - black and ruff fixes --- volatility3/framework/deprecation.py | 3 ++- volatility3/framework/plugins/windows/amcache.py | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/deprecation.py b/volatility3/framework/deprecation.py index 5d8087503..ba07743a3 100644 --- a/volatility3/framework/deprecation.py +++ b/volatility3/framework/deprecation.py @@ -89,6 +89,7 @@ def deprecated_method( return decorator + def renamed_class(deprecated_class_name: str, message: str, removal_date: str): """A decorator for marking classes as being renamed and removed in the future. Callers to this function should explicitly update to use the other plugins instead. @@ -134,4 +135,4 @@ class PluginRenameClass: ) else: setattr(cls, attr, value) - return super(replacement_class).__init_subclass__(**kwargs) \ No newline at end of file + return super(replacement_class).__init_subclass__(**kwargs) diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index bf0f8f8ad..be144be91 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -2,7 +2,6 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -import warnings from volatility3.framework import interfaces, deprecation from volatility3.plugins.windows.registry import amcache @@ -13,7 +12,8 @@ class Amcache( interfaces.plugins.PluginInterface, deprecation.PluginRenameClass, replacement_class=amcache.Amcache, - removal_date="2025-09-25"): + removal_date="2025-09-25", +): """Extract information on executed applications from the AmCache (deprecated).""" _required_framework_version = (2, 0, 0) From ef29008cc8773ea2d02e63b89a856055cd53ad6e Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 26 Mar 2025 17:53:19 -0500 Subject: [PATCH 09/10] #1471 - fix class deprecation and update other plugins --- volatility3/framework/deprecation.py | 5 +++-- .../framework/plugins/windows/cachedump.py | 18 +++++++----------- .../framework/plugins/windows/hashdump.py | 18 +++++++----------- .../framework/plugins/windows/lsadump.py | 18 +++++++----------- .../plugins/windows/scheduled_tasks.py | 18 +++++++----------- 5 files changed, 31 insertions(+), 46 deletions(-) diff --git a/volatility3/framework/deprecation.py b/volatility3/framework/deprecation.py index ba07743a3..b9b84f001 100644 --- a/volatility3/framework/deprecation.py +++ b/volatility3/framework/deprecation.py @@ -121,7 +121,7 @@ class PluginRenameClass: deprecated_class_name = f"{cls.__module__}.{cls.__qualname__}" super().__init_subclass__(**kwargs) for attr, value in replacement_class.__dict__.items(): - if isinstance(value, classmethod): + if isinstance(value, classmethod) and attr != "get_requirements": setattr( cls, attr, @@ -134,5 +134,6 @@ class PluginRenameClass: ), ) else: - setattr(cls, attr, value) + if not attr.startswith("__"): + setattr(cls, attr, value) return super(replacement_class).__init_subclass__(**kwargs) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 14320312a..35127c6f3 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -2,23 +2,19 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -import warnings +from volatility3.framework import interfaces, deprecation from volatility3.plugins.windows.registry import cachedump vollog = logging.getLogger(__name__) -class Cachedump(cachedump.Cachedump): +class Cachedump( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=cachedump.Cachedump, + removal_date="2025-09-25", +): """Dumps lsa secrets from memory (deprecated)""" _required_framework_version = (2, 0, 0) _version = (1, 0, 2) - - def __getattribute__(self, *args, **kwargs): - warnings.warn( - FutureWarning( - "The windows.cachedump.Cachedump plugin is deprecated and will be removed on " - "2025-09-25. Use windows.registry.cachedump.Cachedump instead." - ) - ) - return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index 98baf7d53..e496e77a9 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -2,23 +2,19 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -import warnings +from volatility3.framework import interfaces, deprecation from volatility3.plugins.windows.registry import hashdump vollog = logging.getLogger(__name__) -class Hashdump(hashdump.Hashdump): +class Hashdump( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=hashdump.Hashdump, + removal_date="2025-09-25", +): """Dumps user hashes from memory (deprecated)""" _required_framework_version = (2, 0, 0) _version = (1, 1, 1) - - def __getattribute__(self, *args, **kwargs): - warnings.warn( - FutureWarning( - "The windows.hashdump.Hashdump plugin is deprecated and will be removed on " - "2025-09-25. Use windows.registry.hashdump.Hashdump instead." - ) - ) - return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 86cbe1949..0b36ddef0 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -2,23 +2,19 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -import warnings +from volatility3.framework import interfaces, deprecation from volatility3.plugins.windows.registry import lsadump vollog = logging.getLogger(__name__) -class Lsadump(lsadump.Lsadump): +class Lsadump( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=lsadump.Lsadump, + removal_date="2025-09-25", +): """Dumps lsa secrets from memory (deprecated)""" _required_framework_version = (2, 0, 0) _version = (1, 0, 1) - - def __getattribute__(self, *args, **kwargs): - warnings.warn( - FutureWarning( - "The windows.lsadump.Lsadump plugin is deprecated and will be removed on " - "2025-09-25. Use windows.registry.lsadump.Lsadump instead." - ) - ) - return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index 7241f07d1..62d8e3b88 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -2,24 +2,20 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -import warnings +from volatility3.framework import interfaces, deprecation from volatility3.plugins.windows.registry import scheduled_tasks vollog = logging.getLogger(__name__) -class ScheduledTasks(scheduled_tasks.ScheduledTasks): +class ScheduledTasks( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=scheduled_tasks.ScheduledTasks, + removal_date="2025-09-25", +): """Decodes scheduled task information from the Windows registry, including information about triggers, actions, run times, and creation times (deprecated).""" _required_framework_version = (2, 11, 0) _version = (2, 0, 0) - - def __getattribute__(self, *args, **kwargs): - warnings.warn( - FutureWarning( - "The windows.registry.scheduled_tasks.ScheduledTasks plugin is deprecated and will be removed on " - "2025-09-25. Use windows.registry.scheduled_tasks.ScheduledTasks instead." - ) - ) - return super().__getattribute__(*args, **kwargs) From 70e101ff90f4537260a35e389f3424cf0c69c5cf Mon Sep 17 00:00:00 2001 From: ikelos Date: Thu, 27 Mar 2025 14:13:25 +0000 Subject: [PATCH 10/10] Potential fix for code scanning alert no. 407: First argument to super() is not enclosing class Think this is more correct Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- volatility3/framework/deprecation.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/deprecation.py b/volatility3/framework/deprecation.py index b9b84f001..859a32bad 100644 --- a/volatility3/framework/deprecation.py +++ b/volatility3/framework/deprecation.py @@ -136,4 +136,4 @@ class PluginRenameClass: else: if not attr.startswith("__"): setattr(cls, attr, value) - return super(replacement_class).__init_subclass__(**kwargs) + return super(PluginRenameClass).__init_subclass__(**kwargs)