diff --git a/vol.py b/vol.py index 1be3c5a19..dc27f6371 100755 --- a/vol.py +++ b/vol.py @@ -1,4 +1,4 @@ -#!/usr/bin/env python3.6 +#!/usr/bin/env python3.5 import volatility.cli diff --git a/volatility/framework/__init__.py b/volatility/framework/__init__.py index eefb0d2d2..1c6bacf94 100644 --- a/volatility/framework/__init__.py +++ b/volatility/framework/__init__.py @@ -102,6 +102,6 @@ def import_files(base_module): # Check the python version to ensure it's suitable -required_python_version = (3, 6) +required_python_version = (3, 5) if sys.version_info.major != required_python_version[0] or sys.version_info.minor < required_python_version[1]: raise RuntimeError("Volatility framework requires python version {}.{} or greater".format(*required_python_version)) diff --git a/volatility/framework/automagic/__init__.py b/volatility/framework/automagic/__init__.py index 005298297..19657022a 100644 --- a/volatility/framework/automagic/__init__.py +++ b/volatility/framework/automagic/__init__.py @@ -78,7 +78,7 @@ def run(automagics: typing.List[interfaces.automagic.AutomagicInterface], # TODO: Fix need for top level config element just because we're using a MultiRequirement to group the # configurable's config requirements - configurable_class: typing.Type[interfaces.configuration.ConfigurableInterface] + # configurable_class: typing.Type[interfaces.configuration.ConfigurableInterface] if isinstance(configurable, interfaces.configuration.ConfigurableInterface): configurable_class = configurable.__class__ else: diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py index f4c042591..92189173b 100644 --- a/volatility/framework/automagic/linux.py +++ b/volatility/framework/automagic/linux.py @@ -17,9 +17,8 @@ class LinuxSymbolFinder(interfaces.automagic.AutomagicInterface): context: interfaces.context.ContextInterface, config_path: str) -> None: super().__init__(context, config_path) - self._requirements: typing.List[ - typing.Tuple[str, str, interfaces.configuration.ConstructableRequirementInterface]] = [] - self._linux_banners_: linux_symbol_cache.LinuxBanners = {} + self._requirements = [] # type: typing.List[typing.Tuple[str, str, interfaces.configuration.ConstructableRequirementInterface]] + self._linux_banners_ = {} # type: linux_symbol_cache.LinuxBanners @property def _linux_banners(self) -> linux_symbol_cache.LinuxBanners: @@ -133,7 +132,7 @@ class LintelStacker(interfaces.automagic.StackerLayerInterface): kaslr_shift, _ = LinuxUtilities.find_aslr(context, table_name, layer_name, progress_callback = progress_callback) - layer_class: typing.Type = intel.Intel + layer_class = intel.Intel # type: typing.Type if ('init_level4_pgt' in table.symbols): layer_class = intel.Intel32e dtb_symbol_name = 'init_level4_pgt' diff --git a/volatility/framework/automagic/linux_symbol_cache.py b/volatility/framework/automagic/linux_symbol_cache.py index ab7dfc32d..29596cc4f 100644 --- a/volatility/framework/automagic/linux_symbol_cache.py +++ b/volatility/framework/automagic/linux_symbol_cache.py @@ -21,7 +21,7 @@ class LinuxSymbolCache(interfaces.automagic.AutomagicInterface): @classmethod def load_linux_banners(cls) -> LinuxBanners: - linuxbanners: LinuxBanners = {} + linuxbanners = {} # type: LinuxBanners if os.path.exists(constants.LINUX_BANNERS_PATH): with open(constants.LINUX_BANNERS_PATH, "rb") as f: # We use pickle over JSON because we're dealing with bytes objects diff --git a/volatility/framework/automagic/nlpdtbfinder.py b/volatility/framework/automagic/nlpdtbfinder.py index abec2b38a..0bee5931b 100644 --- a/volatility/framework/automagic/nlpdtbfinder.py +++ b/volatility/framework/automagic/nlpdtbfinder.py @@ -9,14 +9,14 @@ from volatility.framework.layers import intel vollog = logging.getLogger(__name__) -validity_tests: typing.Dict[typing.Type[intel.Intel], - typing.List[typing.Tuple[int, int]]] = {intel.Intel: [], - intel.IntelPAE: [], - intel.Intel32e: [ - (0b10111011, 0b00100011), - (0b1, 0b1), - (0b1111011, 0b1100011), - (0b1111011, 0b1100011)]} +validity_tests = {} # type: typing.Dict[typing.Type[intel.Intel], typing.List[typing.Tuple[int, int]]] +validity_tests.update({intel.Intel: [], + intel.IntelPAE: [], + intel.Intel32e: [ + (0b10111011, 0b00100011), + (0b1, 0b1), + (0b1111011, 0b1100011), + (0b1111011, 0b1100011)]}) class NlpDtbScanner(interfaces.layers.ScannerInterface): @@ -111,7 +111,7 @@ class NlpDtbScanner(interfaces.layers.ScannerInterface): if len(data[page_offset:page_offset + calcsize]) < calcsize: continue entries = struct.unpack('<' + str(2 ** size) + format_str, data[page_offset:page_offset + calcsize]) - valid_entries: typing.List[typing.Tuple[int, int]] = [] + valid_entries = [] # type: typing.List[typing.Tuple[int, int]] invalid_count = 0 user_count = 0 supervisor_count = 0 diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index 4a99f1b59..e6b9cd752 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -136,7 +136,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): context: interfaces.context.ContextInterface, config_path: str) -> None: super().__init__(context, config_path) - self.valid_kernels: typing.Dict[str, typing.Tuple[int, typing.Dict]] = {} + self.valid_kernels = {} # type: typing.Dict[str, typing.Tuple[int, typing.Dict]] def recurse_pdb_finder(self, context: interfaces.context.ContextInterface, @@ -157,7 +157,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): :return: A list of (layer_name, scan_results) """ sub_config_path = interfaces.configuration.path_join(config_path, requirement.name) - results: typing.Dict[str, typing.Iterable] = {} + results = {} # type: typing.Dict[str, typing.Iterable] if isinstance(requirement, interfaces.configuration.TranslationLayerRequirement): # Check for symbols in this layer # FIXME: optionally allow a full (slow) scan @@ -289,7 +289,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): # TODO: On older windows, this might be \WINDOWS\system32\nt rather than \SystemRoot\system32\nt results = physical_layer.scan(context, scanners.BytesScanner(b"\\SystemRoot\\system32\\nt"), progress_callback = progress_callback) - seen: typing.Set[int] = set() + seen = set() # type: typing.Set[int] # Because this will launch a scan of the virtual layer, we want to be careful for result in results: # TODO: Identify the specific structure we're finding and document this a bit better diff --git a/volatility/framework/automagic/windows.py b/volatility/framework/automagic/windows.py index 54dda84fa..9bb5f4e3e 100644 --- a/volatility/framework/automagic/windows.py +++ b/volatility/framework/automagic/windows.py @@ -218,7 +218,7 @@ class PageMapScanner(interfaces.layers.ScannerInterface): def __call__(self, data: bytes, data_offset: int) \ -> typing.Generator[typing.Tuple[DtbTest, typing.Set[int]], None, None]: - results: typing.Dict[DtbTest, typing.Set[int]] = {} + results = {} # type: typing.Dict[DtbTest, typing.Set[int]] for test in self.tests: results[test] = set() diff --git a/volatility/framework/configuration/requirements.py b/volatility/framework/configuration/requirements.py index d4f950316..eff817a69 100644 --- a/volatility/framework/configuration/requirements.py +++ b/volatility/framework/configuration/requirements.py @@ -37,15 +37,15 @@ class BooleanRequirement(interfaces_configuration.InstanceRequirement): class IntRequirement(interfaces_configuration.InstanceRequirement): """A requirement type that contains a single integer""" - instance_type: typing.ClassVar[typing.Type] = int + instance_type = int # type: typing.ClassVar[typing.Type] class StringRequirement(interfaces_configuration.InstanceRequirement): """A requirement type that contains a single unicode string""" # TODO: Maybe add string length limits? - instance_type: typing.ClassVar[typing.Type] = str + instance_type = str # type: typing.ClassVar[typing.Type] class BytesRequirement(interfaces_configuration.InstanceRequirement): """A requirement type that contains a byte string""" - instance_type: typing.ClassVar[typing.Type] = bytes + instance_type = bytes # type: typing.ClassVar[typing.Type] diff --git a/volatility/framework/contexts/__init__.py b/volatility/framework/contexts/__init__.py index dc1390c21..09a1acf51 100644 --- a/volatility/framework/contexts/__init__.py +++ b/volatility/framework/contexts/__init__.py @@ -73,7 +73,7 @@ class Context(interfaces.context.ContextInterface): # ## Object Factory Functions def object(self, - symbol: interfaces.objects.Template, + symbol: str, layer_name: str, offset: int, **arguments) -> interfaces.objects.ObjectInterface: @@ -91,7 +91,7 @@ class Context(interfaces.context.ContextInterface): :return: A fully constructed object :rtype: :py:class:`volatility.framework.interfaces.objects.ObjectInterface` """ - object_template = symbol + object_template = self.symbol_space.get_type(symbol) if not isinstance(symbol, interfaces.objects.Template): object_template = self._symbol_space.get_type(symbol) object_template = object_template.clone() diff --git a/volatility/framework/interfaces/configuration.py b/volatility/framework/interfaces/configuration.py index 093190e65..34a1a47b9 100644 --- a/volatility/framework/interfaces/configuration.py +++ b/volatility/framework/interfaces/configuration.py @@ -57,8 +57,8 @@ class HierarchicalDict(collections.abc.Mapping): if not (isinstance(separator, str) and len(separator) == 1): raise TypeError("Separator must be a one character string: {}".format(separator)) self._separator = separator - self._data: typing.Dict[str, ConfigSimpleType] = {} - self._subdict: typing.Dict[str, 'HierarchicalDict'] = {} + self._data = {} # type: typing.Dict[str, ConfigSimpleType] + self._subdict = {} # type: typing.Dict[str, 'HierarchicalDict'] if isinstance(initial_dict, str): initial_dict = json.loads(initial_dict) if isinstance(initial_dict, dict): @@ -247,7 +247,7 @@ class RequirementInterface(validity.ValidityRoutines, metaclass = ABCMeta): self._description = description or "" self._default = default self._optional = optional - self._requirements: typing.Dict[str, RequirementInterface] = {} + self._requirements = {} # type: typing.Dict[str, RequirementInterface] def __repr__(self) -> str: return "<" + self.__class__.__name__ + ": " + self.name + ">" @@ -320,7 +320,7 @@ class RequirementInterface(validity.ValidityRoutines, metaclass = ABCMeta): class InstanceRequirement(RequirementInterface): """Class to represent a single simple type (such as a boolean, a string, an integer or a series of bytes)""" - instance_type: typing.ClassVar[typing.Type] = bool + instance_type = bool # type: typing.ClassVar[typing.Type] def add_requirement(self, requirement: RequirementInterface): """Always raises a TypeError as instance requirements cannot have children""" @@ -716,8 +716,8 @@ class ListRequirement(RequirementInterface): if not isinstance(element_type, InstanceRequirement): raise TypeError("ListRequirements can only contain simple InstanceRequirements") self.element_type = element_type - self.min_elements: int = min_elements - self.max_elements: int = max_elements + self.min_elements = min_elements # type: int + self.max_elements = max_elements # type: int def unsatisfied(self, context: interfaces.context.ContextInterface, config_path: str) -> typing.List[str]: """Check the types on each of the returned values and their number and then call the element type's check for each one""" diff --git a/volatility/framework/interfaces/context.py b/volatility/framework/interfaces/context.py index ad0bea816..b6420eb8a 100644 --- a/volatility/framework/interfaces/context.py +++ b/volatility/framework/interfaces/context.py @@ -54,7 +54,7 @@ class ContextInterface(object, metaclass = ABCMeta): @abstractmethod def object(self, - symbol: 'interfaces.objects.Template', + symbol: str, layer_name: str, offset: int, **arguments): diff --git a/volatility/framework/interfaces/layers.py b/volatility/framework/interfaces/layers.py index 7fac38123..714a39e9e 100644 --- a/volatility/framework/interfaces/layers.py +++ b/volatility/framework/interfaces/layers.py @@ -53,7 +53,7 @@ class ScannerInterface(validity.ValidityRoutines, metaclass = ABCMeta): self.chunk_size = 0x1000000 # Default to 16Mb chunks self.overlap = 0x1000 # A page of overlap by default self._context = None - self._layer_name: typing.Optional[str] = None + self._layer_name = None # type: typing.Optional[str] @property def context(self) -> 'interfaces.context.ContextInterface': @@ -210,7 +210,7 @@ class DataLayerInterface(configuration.ConfigurableInterface, validity.ValidityR max_address = min(self.maximum_address, max_address) try: - progress: ProgressValue + progress = DummyProgress() # type: ProgressValue scan_iterator = functools.partial(self._scan_iterator, scanner, min_address, max_address) scan_metric = functools.partial(self._scan_metric, scanner, min_address, max_address) if scanner.thread_safe and not constants.DISABLE_MULTITHREADED_SCANNING: @@ -319,7 +319,7 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): def read(self, offset: int, length: int, pad: bool = False) -> bytes: """Reads an offset for length bytes and returns 'bytes' (not 'str') of length size""" current_offset = offset - output: typing.List[bytes] = [] + output = [] # type: typing.List[bytes] for (offset, mapped_offset, length, layer) in self.mapping(offset, length, ignore_errors = pad): if not pad and offset > current_offset: raise exceptions.InvalidAddressException(self.name, current_offset, @@ -358,7 +358,7 @@ class TranslationLayerInterface(DataLayerInterface, metaclass = ABCMeta): progress: ProgressValue, iterator_value: int) -> typing.List[typing.Any]: size_to_scan = min(max_address - min_address, scanner.chunk_size + scanner.overlap) - result: typing.List[typing.Any] = [] + result = [] # type: typing.List[typing.Any] for map in self.mapping(iterator_value, size_to_scan, ignore_errors = True): offset, mapped_offset, length, layer = map progress.value += length @@ -371,7 +371,7 @@ class Memory(validity.ValidityRoutines, collections.abc.Mapping): """Container for multiple layers of data""" def __init__(self) -> None: - self._layers: typing.Dict[str, DataLayerInterface] = {} + self._layers = {} # type: typing.Dict[str, DataLayerInterface] def read(self, layer: str, diff --git a/volatility/framework/interfaces/objects.py b/volatility/framework/interfaces/objects.py index dcfb47e0b..3588312fa 100644 --- a/volatility/framework/interfaces/objects.py +++ b/volatility/framework/interfaces/objects.py @@ -202,7 +202,7 @@ class Template(validity.ValidityRoutines): # Allow the updating of template arguments whilst still in template form super().__init__() self._arguments = arguments - empty_dict: typing.Dict[str, typing.Any] = {} + empty_dict = {} # type: typing.Dict[str, typing.Any] self._vol = collections.ChainMap(empty_dict, self._arguments, {'type_name': type_name}) @property diff --git a/volatility/framework/interfaces/renderers.py b/volatility/framework/interfaces/renderers.py index bbd156b4f..c5f7454f4 100644 --- a/volatility/framework/interfaces/renderers.py +++ b/volatility/framework/interfaces/renderers.py @@ -30,7 +30,7 @@ class Renderer(validity.ValidityRoutines, metaclass = ABCMeta): class ColumnSortKey(metaclass = ABCMeta): - ascending: bool = True + ascending = True # type: bool @abstractmethod def __call__(self, values: typing.List[typing.Any]) -> typing.Any: @@ -91,7 +91,7 @@ class TreeGrid(object, metaclass = ABCMeta): and to create cycles. """ - simple_types: typing.ClassVar[typing.Set[typing.Type]] = {int, str, float, bytes} + simple_types = {int, str, float, bytes} # type: typing.ClassVar[typing.Set[typing.Type]] def __init__(self, columns: ColumnsType, generator: typing.Generator) -> None: """Constructs a TreeGrid object using a specific set of columns diff --git a/volatility/framework/layers/__init__.py b/volatility/framework/layers/__init__.py index 9baebf90b..2a83d83c7 100644 --- a/volatility/framework/layers/__init__.py +++ b/volatility/framework/layers/__init__.py @@ -48,7 +48,7 @@ class ResourceAccessor(object): """ self._progress_callback = progress_callback self._context = context - self._cached_files: typing.List[str] = [] + self._cached_files = [] # type: typing.List[str] self._handlers = list(framework.class_subclasses(request.BaseHandler)) vollog.log(constants.LOGLEVEL_VVV, "Available URL handlers: {}".format(", ".join([x.__name__ for x in self._handlers]))) diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index 70eeb57b1..ee964c709 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -30,7 +30,7 @@ class Function(interfaces.objects.ObjectInterface): class PrimitiveObject(interfaces.objects.ObjectInterface): """PrimitiveObject is an interface for any objects that should simulate a Python primitive""" - _struct_type: typing.Type = int + _struct_type = int # type: typing.Type def __init__(self, context, type_name, object_info, struct_format): super().__init__(context = context, diff --git a/volatility/framework/objects/templates.py b/volatility/framework/objects/templates.py index 5ce73b862..34bf1ff4a 100644 --- a/volatility/framework/objects/templates.py +++ b/volatility/framework/objects/templates.py @@ -74,9 +74,9 @@ class ReferenceTemplate(interfaces.objects.Template): raise exceptions.SymbolError( "Template contains no information about its structure: {}".format(self.vol.type_name)) - size: typing.ClassVar[typing.Any] = property(_unresolved) - replace_child: typing.ClassVar[typing.Any] = _unresolved - relative_child_offset: typing.ClassVar[typing.Any] = _unresolved + size = property(_unresolved) # type: typing.ClassVar[typing.Any] + replace_child = _unresolved # type: typing.ClassVar[typing.Any] + relative_child_offset = _unresolved # type: typing.ClassVar[typing.Any] def __call__(self, context, object_info): template = context.symbol_space.get_type(self.vol.type_name)