diff --git a/volatility/framework/symbols/windows/extensions/__init__.py b/volatility/framework/symbols/windows/extensions/__init__.py index 6dcf753ba..68037c83d 100644 --- a/volatility/framework/symbols/windows/extensions/__init__.py +++ b/volatility/framework/symbols/windows/extensions/__init__.py @@ -1,14 +1,14 @@ import collections.abc -import typing -import logging import datetime +import logging +import typing -from volatility.framework import constants, objects, interfaces -from volatility.framework import exceptions +from volatility.framework import constants, exceptions, interfaces, objects from volatility.framework.symbols import generic vollog = logging.getLogger(__name__) + # Keep these in a basic module, to prevent import cycles when symbol providers require them class _EX_FAST_REF(objects.Struct): @@ -173,24 +173,23 @@ class _EPROCESS(generic.GenericIntelProcess): "{}{}_LDR_DATA_TABLE_ENTRY".format(sym_table, constants.BANG), "InLoadOrderLinks"): yield entry - @property - def helper_handle_count(self): + def get_handle_count(self): try: if hasattr(self, "ObjectTable"): if hasattr(self.ObjectTable, "HandleCount"): return self.ObjectTable.HandleCount except exceptions.PagedInvalidAddressException: - vollog.log(constants.LOGLEVEL_VVV, "Cannot access _EPROCESS.ObjectTable.HandleCount at {0:#x}".format(self.vol.offset)) + vollog.log(constants.LOGLEVEL_VVV, + "Cannot access _EPROCESS.ObjectTable.HandleCount at {0:#x}".format(self.vol.offset)) - return -1 # TODO: followup after decision around returning None + return -1 # TODO: followup after decision around returning None - @property - def helper_session_id(self): + def get_session_id(self): try: if hasattr(self, "Session"): if self.Session == 0: - return -1 # TODO: followup after decision around returning None + return -1 # TODO: followup after decision around returning None layer_name = self.vol.layer_name symbol_table_name = self.get_symbol_table().name @@ -202,28 +201,26 @@ class _EPROCESS(generic.GenericIntelProcess): return session.SessionId except exceptions.PagedInvalidAddressException: - vollog.log(constants.LOGLEVEL_VVV, "Cannot access _EPROCESS.Session.SessionId at {0:#x}".format(self.vol.offset)) + vollog.log(constants.LOGLEVEL_VVV, + "Cannot access _EPROCESS.Session.SessionId at {0:#x}".format(self.vol.offset)) - return -1 # TODO: followup after decision around returning None + return -1 # TODO: followup after decision around returning None - @property - def helper_create_time(self): + def get_create_time(self): unix_time = self.CreateTime.QuadPart // 10000000 if unix_time == 0: - return "" # TODO: followup after decision around returning None + return "" # TODO: followup after decision around returning None unix_time = unix_time - 11644473600 return str(datetime.datetime.utcfromtimestamp(unix_time)) - @property - def helper_exit_time(self): + def get_exit_time(self): unix_time = self.ExitTime.QuadPart // 10000000 if unix_time == 0: - return "" # TODO: followup after decision around returning None + return "" # TODO: followup after decision around returning None unix_time = unix_time - 11644473600 return str(datetime.datetime.utcfromtimestamp(unix_time)) - @property - def helper_wow_64_process(self): + def get_wow_64_process(self): if hasattr(self, "Wow64Process"): return self.Wow64Process @@ -232,15 +229,15 @@ class _EPROCESS(generic.GenericIntelProcess): raise AttributeError("Unable to find Wow64Process") - @property - def helper_is_wow64(self): + def get_is_wow64(self): try: - value = self.helper_wow_64_process + value = self.get_wow_64_process() except AttributeError: return False - + return value != 0 and value != None + class _LIST_ENTRY(objects.Struct, collections.abc.Iterable): def to_list(self, symbol_type: str, diff --git a/volatility/plugins/windows/pslist.py b/volatility/plugins/windows/pslist.py index 94118bebb..4248565c1 100644 --- a/volatility/plugins/windows/pslist.py +++ b/volatility/plugins/windows/pslist.py @@ -1,7 +1,7 @@ import volatility.framework.interfaces.plugins as plugins from volatility.framework import renderers -from volatility.framework.renderers import format_hints from volatility.framework.configuration import requirements +from volatility.framework.renderers import format_hints class PsList(plugins.PluginInterface): @@ -33,7 +33,7 @@ class PsList(plugins.PluginInterface): else: layer_name = self.config['primary'] memory = self.context.memory[layer_name] - (_, offset, _, _) = list(memory.mapping(offset=proc.vol.offset, length=0))[0] + (_, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0] yield (0, (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId, @@ -42,11 +42,11 @@ class PsList(plugins.PluginInterface): errors = 'replace'), format_hints.Hex(offset), proc.ActiveThreads, - proc.helper_handle_count, - proc.helper_session_id, - proc.helper_is_wow64, - proc.helper_create_time, - proc.helper_exit_time)) + proc.get_handle_count(), + proc.get_session_id(), + proc.get_is_wow64(), + proc.get_create_time(), + proc.get_exit_time())) def list_processes(self): """Lists all the processes in the primary layer that are in the pid config option"""