Merge branch 'modxview_plugin' of github.com:Abyss-W4tcher/volatility3 into modxview_plugin

Author: Abyss-W4tcher

volatility3/cli/__init__.py

@@ -367,6 +367,7 @@ def run(self):
                 plugin,
                 help=plugin_list[plugin].__doc__,
                 description=plugin_list[plugin].__doc__,
+                epilog=plugin_list[plugin].additional_description,
             )
             self.populate_requirements_argparse(plugin_parser, plugin_list[plugin])
 

volatility3/framework/interfaces/plugins.py

@@ -112,6 +112,8 @@ class PluginInterface(
     # Be careful with inheritance around this (We default to requiring a version which doesn't exist, so it must be set)
     _required_framework_version: Tuple[int, int, int] = (0, 0, 0)
     """The _version variable is a quick way for plugins to define their current interface, it should follow SemVer rules"""
+    additional_description: str = None
+    """Display additional description of the plugin after the description of the arguments. See: https://docs.python.org/3/library/argparse.html#epilog"""
 
     def __init__(
         self,

volatility3/framework/layers/registry.py

@@ -192,9 +192,9 @@ def get_key(
         while key_array and node_key:
             subkeys = node_key[-1].get_subkeys()
             for subkey in subkeys:
-                # registry keys are not case sensitive so compare lowercase
-                # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724946(v=vs.85).aspx
-                if subkey.get_name().lower() == key_array[0].lower():
+                # registry keys are not case sensitive so compare likewise
+                # https://learn.microsoft.com/en-us/windows/win32/sysinfo/structure-of-the-registry
+                if subkey.get_name().casefold() == key_array[0].casefold():
                     node_key = node_key + [subkey]
                     found_key, key_array = found_key + [key_array[0]], key_array[1:]
                     break

volatility3/framework/plugins/linux/bash.py

@@ -1,8 +1,8 @@
 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
-"""A module containing a collection of plugins that produce data typically
-found in Linux's /proc file system."""
+"""A module containing a plugin that recovers bash command history
+from bash process memory."""
 
 import datetime
 import struct

volatility3/framework/plugins/linux/check_afinfo.py

@@ -1,8 +1,8 @@
 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
-"""A module containing a collection of plugins that produce data typically
-found in Linux's /proc file system."""
+"""A module containing a plugin that verifies the operation function
+pointers of network protocols."""
 import logging
 from typing import List
 

volatility3/framework/plugins/linux/check_syscall.py

@@ -1,8 +1,7 @@
 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
-"""A module containing a collection of plugins that produce data typically
-found in Linux's /proc file system."""
+"""A module containing a plugin that checks the system call table for hooks."""
 import contextlib
 import logging
 from typing import List

volatility3/framework/plugins/linux/elfs.py

@@ -1,8 +1,8 @@
 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
-"""A module containing a collection of plugins that produce data typically
-found in Linux's /proc file system."""
+"""A module containing a plugin for enumerating memory-mapped
+ELF files across all processes."""
 
 import logging
 from typing import List, Optional, Type

volatility3/framework/plugins/linux/envars.py

@@ -5,7 +5,7 @@
 import logging
 from typing import Iterable, Tuple
 
-from volatility3.framework import renderers, interfaces
+from volatility3.framework import renderers, interfaces, exceptions
 from volatility3.framework.configuration import requirements
 from volatility3.framework.interfaces import plugins
 from volatility3.framework.objects import utility
@@ -58,10 +58,16 @@ def get_task_env_variables(
             Tuples of (key, value) representing each environment variable.
         """
 
-        task_name = utility.array_to_string(task.comm)
+        # This ensures the `task` is valid as well as its
+        # memory mapping structures
+        try:
+            task_name = utility.array_to_string(task.comm)
+            env_start = task.mm.env_start
+            env_end = task.mm.env_end
+        except exceptions.InvalidAddressException:
+            return None
+
         task_pid = task.pid
-        env_start = task.mm.env_start
-        env_end = task.mm.env_end
         env_area_size = env_end - env_start
         if not (0 < env_area_size <= env_area_max_size):
             vollog.debug(

volatility3/framework/plugins/linux/lsmod.py

@@ -1,8 +1,7 @@
 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
-"""A module containing a collection of plugins that produce data typically
-found in Linux's /proc file system."""
+"""A module containing a plugin that lists loaded kernel modules."""
 
 import logging
 from typing import List, Iterable

volatility3/framework/plugins/windows/cmdscan.py

@@ -67,6 +67,7 @@ def get_filtered_vads(
 
         Args:
             conhost_proc: the process object for conhost.exe
+            size_filter: size above which vads will not be returned
 
         Returns:
             A list of tuples of:
@@ -99,8 +100,8 @@ def get_command_history(
             kernel_layer_name: The name of the layer on which to operate
             kernel_symbol_table_name: The name of the table containing the kernel symbols
             config_path: The config path where to find symbol files
-            procs: list of process objects
-            max_history: an initial set of CommandHistorySize values
+            procs: List of process objects
+            max_history: An initial set of CommandHistorySize values
 
         Returns:
             The conhost process object, the command history structure, a dictionary of properties for
@@ -227,7 +228,6 @@ def get_command_history(
                                 "data": command_history.CommandCountMax,
                             }
                         )
-
                         command_history_properties.append(
                             {
                                 "level": 1,
@@ -236,6 +236,7 @@ def get_command_history(
                                 "data": "",
                             }
                         )
+
                         for (
                             cmd_index,
                             bucket_cmd,
@@ -352,7 +353,7 @@ def _generator(
 
     def _conhost_proc_filter(self, proc: interfaces.objects.ObjectInterface):
         """
-        Used to filter to only conhost.exe processes
+        Used to filter only conhost.exe processes
         """
         process_name = utility.array_to_string(proc.ImageFileName)