From fd9d3ec04c967c5e1a16d7735cf7f064d2b82a47 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 16 Dec 2024 18:17:42 -0600 Subject: [PATCH] Windows: Typing - Remove type casts, add signature Removes the needless `int` casts, and adds the return type to the `get_session_id` method signature. --- volatility3/framework/plugins/windows/modules.py | 16 +++++++--------- .../symbols/windows/extensions/__init__.py | 4 ++-- 2 files changed, 9 insertions(+), 11 deletions(-) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 5ff252074..b9d754328 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -2,14 +2,14 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import List, Iterable, Generator +from typing import Generator, Iterable, List -from volatility3.framework import exceptions, interfaces, constants, renderers +from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows.extensions import pe -from volatility3.plugins.windows import pslist, pedump +from volatility3.plugins.windows import pedump, pslist vollog = logging.getLogger(__name__) @@ -183,12 +183,10 @@ class Modules(interfaces.plugins.PluginInterface): # stores its session ID at offset 8 as an unsigned long, we # create an unsigned long at that offset and use that # instead. - session_id = int( - context.object( - layer_name=layer_name, - object_type=symbol_table + constants.BANG + "unsigned long", - offset=proc.Session + 8, - ) + session_id = context.object( + layer_name=layer_name, + object_type=symbol_table + constants.BANG + "unsigned long", + offset=proc.Session + 8, ) if session_id in seen_ids: diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 78f59fc0c..12f84ca90 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -797,7 +797,7 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): return renderers.UnreadableValue() - def get_session_id(self): + def get_session_id(self) -> Union[int, interfaces.renderers.BaseAbsentValue]: try: if self.has_member("Session"): if self.Session == 0: @@ -836,7 +836,7 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): offset=self.Session + 8, absolute=True, ) - return int(session_id) + return session_id except exceptions.InvalidAddressException: vollog.log(