Skip to content

Commit 1952079

Browse files
atcunoatcuno
authored
Merge branch 'develop' into threads_useful_columns
2 parents 57c0763 + 083dae7 commit 1952079

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

93 files changed

+407
-249
lines changed

‎doc/source/simple-plugin.rst‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,9 @@ to be able to run properly. Any that are defined as optional need not necessari
5353
description = "Process IDs to include (all other processes are excluded)",
5454
optional = True
5555
),
56-
requirements.PluginRequirement(
56+
requirements.VersionRequirement(
5757
name = 'pslist',
58-
plugin = pslist.PsList,
58+
component = pslist.PsList,
5959
version = (2, 0, 0)
6060
),
6161
]

‎volatility3/cli/volshell/generic.py‎

Lines changed: 18 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,13 @@ def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]
6060
description="File to load and execute at start",
6161
default=None,
6262
optional=True,
63-
)
63+
),
64+
requirements.BooleanRequirement(
65+
name="script-only",
66+
description="Exit volshell after the script specified in --script completes",
67+
default=False,
68+
optional=True,
69+
),
6470
]
6571
return reqs + [
6672
requirements.TranslationLayerRequirement(
@@ -135,6 +141,9 @@ def in_prompt_tokens(self, cli=None):
135141
if self.config.get("script", None) is not None:
136142
self.run_script(location=self.config["script"])
137143

144+
if self.config.get("script-only"):
145+
exit()
146+
138147
if has_ipython:
139148
self.__console()
140149
else:
@@ -310,23 +319,25 @@ def display_bytes(self, offset, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None
310319
self._display_data(offset, remaining_data)
311320

312321
def display_quadwords(
313-
self, offset, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None
322+
self, offset, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None, byteorder="@"
314323
):
315324
"""Displays quad-word values (8 bytes) and corresponding ASCII characters"""
316325
remaining_data = self._read_data(offset, count=count, layer_name=layer_name)
317-
self._display_data(offset, remaining_data, format_string="Q")
326+
self._display_data(offset, remaining_data, format_string=f"{byteorder}Q")
318327

319328
def display_doublewords(
320-
self, offset, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None
329+
self, offset, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None, byteorder="@"
321330
):
322331
"""Displays double-word values (4 bytes) and corresponding ASCII characters"""
323332
remaining_data = self._read_data(offset, count=count, layer_name=layer_name)
324-
self._display_data(offset, remaining_data, format_string="I")
333+
self._display_data(offset, remaining_data, format_string=f"{byteorder}I")
325334

326-
def display_words(self, offset, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None):
335+
def display_words(
336+
self, offset, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None, byteorder="@"
337+
):
327338
"""Displays word values (2 bytes) and corresponding ASCII characters"""
328339
remaining_data = self._read_data(offset, count=count, layer_name=layer_name)
329-
self._display_data(offset, remaining_data, format_string="H")
340+
self._display_data(offset, remaining_data, format_string=f"{byteorder}H")
330341

331342
def regex_scan(self, pattern, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None):
332343
"""Scans for regex pattern in layer using RegExScanner."""

‎volatility3/cli/volshell/linux.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@ def get_requirements(cls):
3030
requirements.ModuleRequirement(
3131
name="kernel", description="Linux kernel module"
3232
),
33-
requirements.PluginRequirement(
34-
name="pslist", plugin=pslist.PsList, version=(4, 0, 0)
33+
requirements.VersionRequirement(
34+
name="pslist", component=pslist.PsList, version=(4, 0, 0)
3535
),
3636
requirements.IntRequirement(
3737
name="pid", description="Process ID", optional=True

‎volatility3/cli/volshell/mac.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ def get_requirements(cls):
1919
requirements.ModuleRequirement(
2020
name="kernel", description="Darwin kernel module"
2121
),
22-
requirements.PluginRequirement(
23-
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
22+
requirements.VersionRequirement(
23+
name="pslist", component=pslist.PsList, version=(3, 0, 0)
2424
),
2525
requirements.IntRequirement(
2626
name="pid", description="Process ID", optional=True

‎volatility3/cli/volshell/windows.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,8 @@ class Volshell(generic.Volshell):
1717
def get_requirements(cls):
1818
return [
1919
requirements.ModuleRequirement(name="kernel", description="Windows kernel"),
20-
requirements.PluginRequirement(
21-
name="pslist", plugin=pslist.PsList, version=(3, 0, 0)
20+
requirements.VersionRequirement(
21+
name="pslist", component=pslist.PsList, version=(3, 0, 0)
2222
),
2323
requirements.IntRequirement(
2424
name="pid", description="Process ID", optional=True

‎volatility3/framework/plugins/linux/bash.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]
3232
description="Linux kernel",
3333
architectures=["Intel32", "Intel64"],
3434
),
35-
requirements.PluginRequirement(
36-
name="pslist", plugin=pslist.PsList, version=(4, 0, 0)
35+
requirements.VersionRequirement(
36+
name="pslist", component=pslist.PsList, version=(4, 0, 0)
3737
),
3838
requirements.ListRequirement(
3939
name="pid",

‎volatility3/framework/plugins/linux/boottime.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,8 @@ def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]
2525
description="Linux kernel",
2626
architectures=["Intel32", "Intel64"],
2727
),
28-
requirements.PluginRequirement(
29-
name="pslist", plugin=pslist.PsList, version=(4, 0, 0)
28+
requirements.VersionRequirement(
29+
name="pslist", component=pslist.PsList, version=(4, 0, 0)
3030
),
3131
]
3232

‎volatility3/framework/plugins/linux/capabilities.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,8 +60,8 @@ def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]
6060
description="Linux kernel",
6161
architectures=["Intel32", "Intel64"],
6262
),
63-
requirements.PluginRequirement(
64-
name="pslist", plugin=pslist.PsList, version=(4, 0, 0)
63+
requirements.VersionRequirement(
64+
name="pslist", component=pslist.PsList, version=(4, 0, 0)
6565
),
6666
requirements.ListRequirement(
6767
name="pids",

‎volatility3/framework/plugins/linux/check_creds.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@ def get_requirements(cls):
2222
description="Linux kernel",
2323
architectures=["Intel32", "Intel64"],
2424
),
25-
requirements.PluginRequirement(
26-
name="pslist", plugin=pslist.PsList, version=(4, 0, 0)
25+
requirements.VersionRequirement(
26+
name="pslist", component=pslist.PsList, version=(4, 0, 0)
2727
),
2828
]
2929

‎volatility3/framework/plugins/linux/elfs.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,8 @@ def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]
3535
description="Linux kernel",
3636
architectures=["Intel32", "Intel64"],
3737
),
38-
requirements.PluginRequirement(
39-
name="pslist", plugin=pslist.PsList, version=(4, 0, 0)
38+
requirements.VersionRequirement(
39+
name="pslist", component=pslist.PsList, version=(4, 0, 0)
4040
),
4141
requirements.ListRequirement(
4242
name="pid",

0 commit comments

Comments
 (0)