volatility3.framework.layers.resources module

class JarHandler

Bases: urllib.request.BaseHandler

Handles the jar scheme for URIs.

Reference used for the schema syntax: http://docs.netkernel.org/book/view/book:mod:reference/doc:layer1:schemes:jar

Actual reference (found from https://www.w3.org/wiki/UriSchemes/jar) seemed not to return: http://developer.java.sun.com/developer/onlineTraining/protocolhandlers/

add_parent(parent)

close()

static default_open(req)

Handles the request if it’s the jar scheme.

Return type

Optional[Any]

handler_order = 500

class ResourceAccessor(progress_callback=None, context=None)

Bases: object

Object for openning URLs as files (downloading locally first if necessary)

Creates a resource accessor.

Note: context is an SSL context, not a volatility context

list_handlers = True

open(url, mode='rb')

Returns a file-like object for a particular URL opened in mode.

If the file is remote, it will be downloaded and locally cached

Return type

Any

uses_cache(url)

Determines whether a URLs contents should be cached

Return type

bool

cascadeCloseFile(new_fp, original_fp)

Really horrible solution for ensuring files aren’t left open

Parameters

• new_fp (IO[bytes]) – The file pointer constructed based on the original file pointer

• original_fp (IO[bytes]) – The original file pointer that should be closed when the new file pointer is closed, but isn’t

Return type

IO[bytes]