Merge branch 'volatilityfoundation:develop' into fix/workflow

Author: digitalisx

development/mac-kdk/parse_pbzx2.py

@@ -17,61 +17,54 @@ def seekread(f, offset = None, length = 0, relative = True):
         f.seek(offset, [0, 1, 2][relative])
     if length:
         return f.read(length)
+    return None
 
 
 def parse_pbzx(pbzx_path):
     section = 0
     xar_out_path = '%s.part%02d.cpio.xz' % (pbzx_path, section)
-    f = open(pbzx_path, 'rb')
-    # pbzx = f.read()
-    # f.close()
-    magic = seekread(f, length = 4)
-    if magic != 'pbzx':
-        raise RuntimeError("Error: Not a pbzx file")
-    # Read 8 bytes for initial flags
-    flags = seekread(f, length = 8)
-    # Interpret the flags as a 64-bit big-endian unsigned int
-    flags = struct.unpack('>Q', flags)[0]
-    xar_f = open(xar_out_path, 'wb')
-    while flags & (1 << 24):
-        # Read in more flags
+    with open(pbzx_path, 'rb') as f:
+        # pbzx = f.read()
+        # f.close()
+        magic = seekread(f, length = 4)
+        if magic != 'pbzx':
+            raise RuntimeError("Error: Not a pbzx file")
+        # Read 8 bytes for initial flags
         flags = seekread(f, length = 8)
+        # Interpret the flags as a 64-bit big-endian unsigned int
         flags = struct.unpack('>Q', flags)[0]
-        # Read in length
-        f_length = seekread(f, length = 8)
-        f_length = struct.unpack('>Q', f_length)[0]
-        xzmagic = seekread(f, length = 6)
-        if xzmagic != '\xfd7zXZ\x00':
-            # This isn't xz content, this is actually _raw decompressed cpio_ chunk of 16MB in size...
-            # Let's back up ...
-            seekread(f, offset = -6, length = 0)
-            # ... and split it out ...
-            f_content = seekread(f, length = f_length)
-            section += 1
-            decomp_out = '%s.part%02d.cpio' % (pbzx_path, section)
-            g = open(decomp_out, 'wb')
-            g.write(f_content)
-            g.close()
-            # Now to start the next section, which should hopefully be .xz (we'll just assume it is ...)
-            xar_f.close()
-            section += 1
-            new_out = '%s.part%02d.cpio.xz' % (pbzx_path, section)
-            xar_f = open(new_out, 'wb')
-        else:
-            f_length -= 6
-            # This part needs buffering
-            f_content = seekread(f, length = f_length)
-            tail = seekread(f, offset = -2, length = 2)
-            xar_f.write(xzmagic)
-            xar_f.write(f_content)
-            if tail != 'YZ':
-                xar_f.close()
-                raise RuntimeError("Error: Footer is not xar file footer")
-    try:
-        f.close()
-        xar_f.close()
-    except IOError:
-        pass
+        while flags & (1 << 24):
+            with open(xar_out_path, 'wb') as xar_f:
+                xar_f.seek(0, os.SEEK_END)
+                # Read in more flags
+                flags = seekread(f, length = 8)
+                flags = struct.unpack('>Q', flags)[0]
+                # Read in length
+                f_length = seekread(f, length = 8)
+                f_length = struct.unpack('>Q', f_length)[0]
+                xzmagic = seekread(f, length = 6)
+                if xzmagic != '\xfd7zXZ\x00':
+                    # This isn't xz content, this is actually _raw decompressed cpio_ chunk of 16MB in size...
+                    # Let's back up ...
+                    seekread(f, offset = -6, length = 0)
+                    # ... and split it out ...
+                    f_content = seekread(f, length = f_length)
+                    section += 1
+                    decomp_out = '%s.part%02d.cpio' % (pbzx_path, section)
+                    with open(decomp_out, 'wb') as g:
+                        g.write(f_content)
+                    # Now to start the next section, which should hopefully be .xz (we'll just assume it is ...)
+                    section += 1
+                    xar_out_path = '%s.part%02d.cpio.xz' % (pbzx_path, section)
+                else:
+                    f_length -= 6
+                    # This part needs buffering
+                    f_content = seekread(f, length = f_length)
+                    tail = seekread(f, offset = -2, length = 2)
+                    xar_f.write(xzmagic)
+                    xar_f.write(f_content)
+                    if tail != 'YZ':
+                        raise RuntimeError("Error: Footer is not xar file footer")
 
 
 def main():

doc/source/conf.py

@@ -121,6 +121,7 @@ def setup(app):
 
     extensions.append('sphinx_autodoc_typehints')
 except ImportError:
+    # If the autodoc typehints extension isn't available, carry on regardless
     pass
 
 # Add any paths that contain templates here, relative to this directory.

requirements-dev.txt

@@ -16,7 +16,7 @@ pycryptodome
 
 # This can improve error messages regarding improperly configured ISF files,
 # but is only recommended for development
-# jsonschema>=2.3.0
+jsonschema>=2.3.0
 
 # This is required for memory acquisition via leechcore/pcileech.
 leechcorepyc>=2.4.0

volatility3/cli/volshell/__init__.py

@@ -36,7 +36,6 @@ class VolShell(cli.CommandLine):
 
     def __init__(self):
         super().__init__()
-        self.output_dir = None
 
     def run(self):
         """Executes the command line module, taking the system arguments,

volatility3/cli/volshell/generic.py

@@ -324,11 +324,11 @@ def display_type(self,
                           " " * (longest_member - len_member), "  ", member_type.vol.type_name)
 
     @classmethod
-    def _display_value(self, value: Any) -> str:
+    def _display_value(cls, value: Any) -> str:
         if isinstance(value, objects.PrimitiveObject):
             return repr(value)
         elif isinstance(value, objects.Array):
-            return repr([self._display_value(val) for val in value])
+            return repr([cls._display_value(val) for val in value])
         else:
             return hex(value.vol.offset)
 
@@ -390,8 +390,8 @@ def run_script(self, location: str):
             location = "file:" + request.pathname2url(location)
         print(f"Running code from {location}\n")
         accessor = resources.ResourceAccessor()
-        with io.TextIOWrapper(accessor.open(url = location), encoding = 'utf-8') as fp:
-            self.__console.runsource(fp.read(), symbol = 'exec')
+        with accessor.open(url = location) as fp:
+            self.__console.runsource(io.TextIOWrapper(fp.read(), encoding = 'utf-8'), symbol = 'exec')
         print("\nCode complete")
 
     def load_file(self, location: str):

volatility3/framework/automagic/pdbscan.py

@@ -181,6 +181,7 @@ def test_physical_kernel(physical_layer_name: str, virtual_layer_name: str, kern
                         hex(kvo)))
             except exceptions.InvalidAddressException:
                 vollog.debug(f"Potential kernel_virtual_offset caused a page fault: {hex(kvo)}")
+            return None
 
         vollog.debug("Kernel base determination - testing fixed base address")
         return self._method_layer_pdb_scan(context, vlayer, test_physical_kernel, False, True, progress_callback)

volatility3/framework/automagic/symbol_cache.py

@@ -223,8 +223,7 @@ def get_local_locations(self) -> Generator[str, None, None]:
     def is_url_local(self, url: str) -> bool:
         """Determines whether an url is local or not"""
         parsed = urllib.parse.urlparse(url)
-        if parsed.scheme in ['file', 'jar']:
-            return True
+        return parsed.scheme in ['file', 'jar']
 
     def get_identifier(self, location: str) -> Optional[bytes]:
         results = self._database.cursor().execute('SELECT identifier FROM cache WHERE location = ?',
@@ -246,6 +245,7 @@ def get_hash(self, location: str) -> Optional[str]:
                                                   (location,)).fetchall()
         for row in results:
             return row['hash']
+        return None
 
     def update(self, progress_callback = None):
         """Locates all files under the symbol directories.  Updates the cache with additions, modifications and removals.

volatility3/framework/interfaces/automagic.py

@@ -113,7 +113,7 @@ class StackerLayerInterface(metaclass = ABCMeta):
     """The list operating systems/first-level plugin hierarchy that should exclude this stacker"""
 
     @classmethod
-    def stack(self,
+    def stack(cls,
               context: interfaces.context.ContextInterface,
               layer_name: str,
               progress_callback: constants.ProgressCallback = None) -> Optional[interfaces.layers.DataLayerInterface]:

volatility3/framework/layers/resources.py

@@ -31,6 +31,7 @@
     # Import so that the handler is found by the framework.class_subclasses callc
     import smb.SMBHandler  # lgtm [py/unused-import]
 except ImportError:
+    # If we fail to import this, it means that SMB handling won't be available
     pass
 
 vollog = logging.getLogger(__name__)

volatility3/framework/layers/vmware.py

@@ -154,7 +154,8 @@ def stack(cls,
 
             vmss_success = False
             with contextlib.suppress(IOError):
-                _ = resources.ResourceAccessor().open(vmss).read(10)
+                with resources.ResourceAccessor().open(vmss) as fp:
+                    _ = fp.read(10)
                 context.config[interfaces.configuration.path_join(current_config_path, "location")] = vmss
                 context.layers.add_layer(physical.FileLayer(context, current_config_path, current_layer_name))
                 vmss_success = True