Closed dadokkio closed 7 months ago
Additional warnings
volatility3/framework/symbols/linux/extensions/__init__.py:1137: SyntaxWarning: invalid escape sequence '\*'
"""Helper to make sure it is comparing two pointers to 'vfsmount'.
volatility3/framework/plugins/linux/sockstat.py:80: SyntaxWarning: invalid escape sequence '\*'
"""Takes a kernel generic `sock` object and processes it with its respective socket family
volatility3/framework/plugins/linux/sockstat.py:490: SyntaxWarning: invalid escape sequence '\*'
"""Returns every single socket descriptor
volatility3/framework/plugins/windows/mftscan.py:41: SyntaxWarning: invalid escape sequence '\*'
{"yara_rules": "/FILE0|FILE\*|BAAD/"}
volatility3/framework/plugins/windows/mftscan.py:200: SyntaxWarning: invalid escape sequence '\*'
{"yara_rules": "/FILE0|FILE\*|BAAD/"}
These warnings won't affect the usability.
With python 3.12.2
>>> allowed = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- ()[]\{\}!$%^:#~?<>,|"
<stdin>:1: SyntaxWarning: invalid escape sequence '\{'
>>> print(allowed)
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- ()[]\{\}!$%^:#~?<>,|
>>> allowed_0 = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- ()[]{}!$%^:#~?<>,|"
>>> print(allowed_0)
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- ()[]{}!$%^:#~?<>,|
With python 3.11.6
:
>>> a = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- ()[]\{\}!$%^:#~?<>,|"
>>> print(a)
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- ()[]\{\}!$%^:#~?<>,|
Also, it is due to python 3.12, not necessarily an issue of volatility 3
I know this is not really an issue, but using the tool with python 3.12 is a little annoying because with just imports or automagics warnings are raised multiple times and they cannot be silenced. Since it could became a syntax error in the future maybe it could be useful to fix it. This is the reason I've opened this issue.
This is the output of a sample pslist on python3.12
root@django:/media# vol -f ./3d9f1d50-ca73-11ee-87df-0242ac12000a/linux-sample.bin linux.pslist
/usr/local/lib/python3.12/site-packages/volatility3/framework/interfaces/plugins.py:63: SyntaxWarning: invalid escape sequence '\{'
allowed = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- ()[]\{\}!$%^:#~?<>,|"
Volatility 3 Framework 2.6.1
/usr/local/lib/python3.12/site-packages/volatility3/framework/symbols/linux/extensions/__init__.py:1137: SyntaxWarning: invalid escape sequence '\*'
"""Helper to make sure it is comparing two pointers to 'vfsmount'.
/usr/local/lib/python3.12/site-packages/volatility3/framework/plugins/linux/sockstat.py:80: SyntaxWarning: invalid escape sequence '\*'
"""Takes a kernel generic `sock` object and processes it with its respective socket family
/usr/local/lib/python3.12/site-packages/volatility3/framework/plugins/linux/sockstat.py:490: SyntaxWarning: invalid escape sequence '\*'
"""Returns every single socket descriptor
/usr/local/lib/python3.12/site-packages/volatility3/framework/plugins/windows/mftscan.py:41: SyntaxWarning: invalid escape sequence '\*'
{"yara_rules": "/FILE0|FILE\*|BAAD/"}
/usr/local/lib/python3.12/site-packages/volatility3/framework/plugins/windows/mftscan.py:200: SyntaxWarning: invalid escape sequence '\*'
{"yara_rules": "/FILE0|FILE\*|BAAD/"}
Progress: 100.00 Stacking attempts finished
OFFSET (V) PID TID PPID COMM File output
0x88001f994740 1 1 0 init Disabled
0x88001f994040 2 2 0 kthreadd Disabled
0x88001f9a2780 3 3 2 ksoftirqd/0 Disabled
0x88001f9a67c0 5 5 2 kworker/u:0 Disabled
0x88001f9a60c0 6 6 2 migration/0 Disabled
0x88001f9ab800 7 7 2 watchdog/0 Disabled
0x88001f9ab100 8 8 2 cpuset Disabled
0x88001f9af840 9 9 2 khelper Disabled
0x88001f9af140 10 10 2 kdevtmpfs Disabled
0x88001f9c1880 11 11 2 netns Disabled
0x88001f9c1180 12 12 2 sync_supers Disabled
[..]
Describe the bug Running code with python 3.12 is raising syntaxwarning in https://github.com/volatilityfoundation/volatility3/blob/887747e3ceb1d40af936e8a91d65e05874f4c06a/volatility3/framework/interfaces/plugins.py#L63
Context Volatility Version: develop Operating System: docker python:3.12-slim image Python Version: 3.12 Suspected Operating System:
Command:
To Reproduce
Additional information from stackoverflow Using invalid escape sequences in string literals has been deprecated since Python 3.6. Since then, attempting to use an invalid escape sequence has emitted a DeprecationWarning. This often goes unnoticed if you never run Python with warnings enabled. DeprecationWarnings are silenced by default.
Python 3.12 upgraded the DeprecationWarning to a SyntaxWarning. SyntaxWarnings are emitted by the compiler when the code is parsed, not when it's being run, so they cannot be ignored using a runtime warning filter. Unlike DeprecationWarnings, SyntaxWarnings are displayed by default, which is why you're seeing it now. This increase in visibility was intentional. In a future version of Python, using invalid escape sequence in string literals is planned to eventually become a hard SyntaxError.