Skip to content

Commit 02bda98

Browse files
author
atcuno
committed
formatting fixes
1 parent 3d1b9ef commit 02bda98

File tree

1 file changed

+20
-8
lines changed

1 file changed

+20
-8
lines changed

volatility3/framework/plugins/windows/hollowprocesses.py

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
1+
# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
22
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
33
#
44
import logging
@@ -17,14 +17,14 @@
1717
[
1818
("protection", str),
1919
("path", str),
20-
],
20+
],
2121
)
2222

2323
DLLInfo = NamedTuple(
2424
"DLLInfo",
2525
[
2626
("path", str),
27-
],
27+
],
2828
)
2929

3030
class HollowProcesses(interfaces.plugins.PluginInterface):
@@ -111,15 +111,21 @@ def _get_image_base(self, proc):
111111
def _check_load_address(self, proc, _, __):
112112
image_base = self._get_image_base(proc)
113113
if image_base is not None and image_base != proc.SectionBaseAddress:
114-
yield "The ImageBaseAddress reported from the PEB ({:#x}) does not match the process SectionBaseAddress ({:#x})".format(image_base, proc.SectionBaseAddress)
114+
yield "The ImageBaseAddress reported from the PEB ({:#x}) does not match the process SectionBaseAddress ({:#x})".format(
115+
image_base, proc.SectionBaseAddress
116+
)
115117

116118
def _check_exe_protection(self, proc, vads, __):
117119
base = proc.SectionBaseAddress
118120

119121
if base not in vads:
120-
yield "There is no VAD starting at the base address of the process executable ({:#x})".format(base)
122+
yield "There is no VAD starting at the base address of the process executable ({:#x})".format(
123+
base
124+
)
121125
elif vads[base].protection != "PAGE_EXECUTE_WRITECOPY":
122-
yield "Unexpected protection ({}) for VAD hosting the process executable ({:#x}) with path {}".format(vads[base].protection, base, vads[base].path)
126+
yield "Unexpected protection ({}) for VAD hosting the process executable ({:#x}) with path {}".format(
127+
vads[base].protection, base, vads[base].path
128+
)
123129

124130
def _check_dlls_protection(self, _, vads, dlls):
125131
for dll_base in dlls:
@@ -128,10 +134,16 @@ def _check_dlls_protection(self, _, vads, dlls):
128134
continue
129135

130136
if vads[dll_base].protection != "PAGE_EXECUTE_WRITECOPY":
131-
yield "Unexpected protection ({}) for DLL in the PEB's load order list ({:#x}) with path {}".format(vads[dll_base].protection, dll_base, dlls[dll_base].path)
137+
yield "Unexpected protection ({}) for DLL in the PEB's load order list ({:#x}) with path {}".format(
138+
vads[dll_base].protection, dll_base, dlls[dll_base].path
139+
)
132140

133141
def _generator(self, procs):
134-
checks = [self._check_load_address, self._check_exe_protection, self._check_dlls_protection]
142+
checks = [
143+
self._check_load_address,
144+
self._check_exe_protection,
145+
self._check_dlls_protection
146+
]
135147

136148
for proc in procs:
137149
proc_name = utility.array_to_string(proc.ImageFileName)

0 commit comments

Comments
 (0)