volatilityfoundation / volatility3

Volatility 3.0 development
http://volatilityfoundation.org/
Other
2.61k stars 447 forks source link

syntaxwarning on python 3.12 #1105

Closed dadokkio closed 7 months ago

dadokkio commented 7 months ago

Describe the bug Running code with python 3.12 is raising syntaxwarning in https://github.com/volatilityfoundation/volatility3/blob/887747e3ceb1d40af936e8a91d65e05874f4c06a/volatility3/framework/interfaces/plugins.py#L63

Context Volatility Version: develop Operating System: docker python:3.12-slim image Python Version: 3.12 Suspected Operating System:
Command:

To Reproduce

$ python
Python 3.11.5 (main, Sep 11 2023, 13:54:46) [GCC 11.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> a = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- ()[]\{\}!$%^:#~?<>,|"
>>> 

$ python3.12
Python 3.12.2 (main, Feb 13 2024, 09:28:52) [GCC 12.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> a = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- ()[]\{\}!$%^:#~?<>,|"
<stdin>:1: SyntaxWarning: invalid escape sequence '\{'
>>> 

Additional information from stackoverflow Using invalid escape sequences in string literals has been deprecated since Python 3.6. Since then, attempting to use an invalid escape sequence has emitted a DeprecationWarning. This often goes unnoticed if you never run Python with warnings enabled. DeprecationWarnings are silenced by default.

Python 3.12 upgraded the DeprecationWarning to a SyntaxWarning. SyntaxWarnings are emitted by the compiler when the code is parsed, not when it's being run, so they cannot be ignored using a runtime warning filter. Unlike DeprecationWarnings, SyntaxWarnings are displayed by default, which is why you're seeing it now. This increase in visibility was intentional. In a future version of Python, using invalid escape sequence in string literals is planned to eventually become a hard SyntaxError.

dadokkio commented 7 months ago

Additional warnings

volatility3/framework/symbols/linux/extensions/__init__.py:1137: SyntaxWarning: invalid escape sequence '\*'
  """Helper to make sure it is comparing two pointers to 'vfsmount'.
volatility3/framework/plugins/linux/sockstat.py:80: SyntaxWarning: invalid escape sequence '\*'
  """Takes a kernel generic `sock` object and processes it with its respective socket family
volatility3/framework/plugins/linux/sockstat.py:490: SyntaxWarning: invalid escape sequence '\*'
  """Returns every single socket descriptor
volatility3/framework/plugins/windows/mftscan.py:41: SyntaxWarning: invalid escape sequence '\*'
  {"yara_rules": "/FILE0|FILE\*|BAAD/"}
volatility3/framework/plugins/windows/mftscan.py:200: SyntaxWarning: invalid escape sequence '\*'
  {"yara_rules": "/FILE0|FILE\*|BAAD/"}
Crane-Mocker commented 7 months ago

These warnings won't affect the usability.

With python 3.12.2

>>> allowed = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- ()[]\{\}!$%^:#~?<>,|"
<stdin>:1: SyntaxWarning: invalid escape sequence '\{'
>>> print(allowed)
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- ()[]\{\}!$%^:#~?<>,|
>>> allowed_0 = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- ()[]{}!$%^:#~?<>,|"
>>> print(allowed_0)
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- ()[]{}!$%^:#~?<>,|

With python 3.11.6:

>>> a = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- ()[]\{\}!$%^:#~?<>,|"
>>> print(a)
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- ()[]\{\}!$%^:#~?<>,|

Also, it is due to python 3.12, not necessarily an issue of volatility 3

dadokkio commented 7 months ago

I know this is not really an issue, but using the tool with python 3.12 is a little annoying because with just imports or automagics warnings are raised multiple times and they cannot be silenced. Since it could became a syntax error in the future maybe it could be useful to fix it. This is the reason I've opened this issue.

This is the output of a sample pslist on python3.12

root@django:/media# vol -f ./3d9f1d50-ca73-11ee-87df-0242ac12000a/linux-sample.bin linux.pslist
/usr/local/lib/python3.12/site-packages/volatility3/framework/interfaces/plugins.py:63: SyntaxWarning: invalid escape sequence '\{'
  allowed = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- ()[]\{\}!$%^:#~?<>,|"
Volatility 3 Framework 2.6.1
/usr/local/lib/python3.12/site-packages/volatility3/framework/symbols/linux/extensions/__init__.py:1137: SyntaxWarning: invalid escape sequence '\*'
  """Helper to make sure it is comparing two pointers to 'vfsmount'.
/usr/local/lib/python3.12/site-packages/volatility3/framework/plugins/linux/sockstat.py:80: SyntaxWarning: invalid escape sequence '\*'
  """Takes a kernel generic `sock` object and processes it with its respective socket family
/usr/local/lib/python3.12/site-packages/volatility3/framework/plugins/linux/sockstat.py:490: SyntaxWarning: invalid escape sequence '\*'
  """Returns every single socket descriptor
/usr/local/lib/python3.12/site-packages/volatility3/framework/plugins/windows/mftscan.py:41: SyntaxWarning: invalid escape sequence '\*'
  {"yara_rules": "/FILE0|FILE\*|BAAD/"}
/usr/local/lib/python3.12/site-packages/volatility3/framework/plugins/windows/mftscan.py:200: SyntaxWarning: invalid escape sequence '\*'
  {"yara_rules": "/FILE0|FILE\*|BAAD/"}
Progress:  100.00               Stacking attempts finished                 
OFFSET (V)      PID     TID     PPID    COMM    File output

0x88001f994740  1       1       0       init    Disabled
0x88001f994040  2       2       0       kthreadd        Disabled
0x88001f9a2780  3       3       2       ksoftirqd/0     Disabled
0x88001f9a67c0  5       5       2       kworker/u:0     Disabled
0x88001f9a60c0  6       6       2       migration/0     Disabled
0x88001f9ab800  7       7       2       watchdog/0      Disabled
0x88001f9ab100  8       8       2       cpuset  Disabled
0x88001f9af840  9       9       2       khelper Disabled
0x88001f9af140  10      10      2       kdevtmpfs       Disabled
0x88001f9c1880  11      11      2       netns   Disabled
0x88001f9c1180  12      12      2       sync_supers     Disabled
[..]