1- import datetime , logging , string
1+ import datetime
2+ import logging
3+ import string
4+ from typing import Dict , Iterable , List
25
36from volatility3 .framework import constants , exceptions
4- from volatility3 .framework .interfaces import plugins
57from volatility3 .framework .configuration import requirements
6- from volatility3 .framework .renderers import format_hints , TreeGrid
8+ from volatility3 .framework .interfaces import plugins
9+ from volatility3 .framework .renderers import TreeGrid , format_hints
10+ from volatility3 .framework .symbols .windows import extensions
711from volatility3 .plugins .windows import (
812 handles ,
913 info ,
@@ -77,14 +81,16 @@ def _is_valid_proc_name(self, str):
7781 return False
7882 return True
7983
80- def _filter_garbage_procs (self , proc_list ):
84+ def _filter_garbage_procs (
85+ self , proc_list : Iterable [extensions .EPROCESS ]
86+ ) -> List [extensions .EPROCESS ]:
8187 return [
8288 p
8389 for p in proc_list
8490 if p .is_valid () and self ._is_valid_proc_name (self ._proc_name_to_string (p ))
8591 ]
8692
87- def _translate_offset (self , offset ) :
93+ def _translate_offset (self , offset : int ) -> int :
8894 if not self .config ["physical-offsets" ]:
8995 return offset
9096
@@ -100,21 +106,25 @@ def _translate_offset(self, offset):
100106
101107 return offset
102108
103- def _proc_list_to_dict (self , tasks ):
109+ def _proc_list_to_dict (
110+ self , tasks : Iterable [extensions .EPROCESS ]
111+ ) -> Dict [int , extensions .EPROCESS ]:
104112 tasks = self ._filter_garbage_procs (tasks )
105113 return {self ._translate_offset (proc .vol .offset ): proc for proc in tasks }
106114
107115 def _check_pslist (self , tasks ):
108116 return self ._proc_list_to_dict (tasks )
109117
110- def _check_psscan (self , layer_name , symbol_table ):
118+ def _check_psscan (
119+ self , layer_name : str , symbol_table : str
120+ ) -> Dict [int , extensions .EPROCESS ]:
111121 res = psscan .PsScan .scan_processes (
112122 context = self .context , layer_name = layer_name , symbol_table = symbol_table
113123 )
114124
115125 return self ._proc_list_to_dict (res )
116126
117- def _check_thrdscan (self ):
127+ def _check_thrdscan (self ) -> Dict [ int , extensions . EPROCESS ] :
118128 ret = []
119129
120130 for ethread in thrdscan .ThrdScan .scan_threads (
@@ -135,8 +145,10 @@ def _check_thrdscan(self):
135145
136146 return self ._proc_list_to_dict (ret )
137147
138- def _check_csrss_handles (self , tasks , layer_name , symbol_table ):
139- ret = []
148+ def _check_csrss_handles (
149+ self , tasks : Iterable [extensions .EPROCESS ], layer_name : str , symbol_table : str
150+ ) -> Dict [int , extensions .EPROCESS ]:
151+ ret : List [extensions .EPROCESS ] = []
140152
141153 for p in tasks :
142154 name = self ._proc_name_to_string (p )
0 commit comments