Move some class fields to constants/locals

Author: john-cado

varc_core/systems/linux.py

@@ -18,6 +18,22 @@ class IOVec(ctypes.Structure):
         ("iov_len", ctypes.c_size_t)
     ]
 
+
+_process_vm_readv = ctypes.CDLL("libc.so.6").process_vm_readv
+_process_vm_readv.args = [ # type: ignore
+    ctypes.c_int, 
+    ctypes.POINTER(IOVec), 
+    ctypes.c_ulong, 
+    ctypes.POINTER(IOVec), 
+    ctypes.c_ulong, 
+    ctypes.c_ulong
+]
+_process_vm_readv.restype = ctypes.c_ssize_t
+
+
+_MAX_VIRTUAL_PAGE_CHUNK = 256 * 1000**2 # max number of megabytes that will be read at a time
+
+
 class LinuxSystem(BaseSystem):
 
     def __init__(
@@ -29,23 +45,11 @@ def __init__(
         **kwargs: Any
     ) -> None:
         super().__init__(include_memory=include_memory, include_open=include_open, extract_dumps=extract_dumps, yara_file=yara_file, **kwargs)
-        self.libc = ctypes.CDLL("libc.so.6")
-        self.process_vm_readv = self.libc.process_vm_readv
-        self.process_vm_readv.args = [ # type: ignore
-            ctypes.c_int, 
-            ctypes.POINTER(IOVec), 
-            ctypes.c_ulong, 
-            ctypes.POINTER(IOVec), 
-            ctypes.c_ulong, 
-            ctypes.c_ulong
-        ]
-        self.process_vm_readv.restype = ctypes.c_ssize_t
         if self.include_memory:
-            self._MAX_VIRTUAL_PAGE_CHUNK = 256 * 1000**2 # set max number of megabytes that will be read at a time
-            self.own_pid = getpid()
             if self.yara_file:
                 self.yara_scan()
             self.dump_processes()
+
             if self.extract_dumps:
                 from varc_core.utils import dumpfile_extraction
                 dumpfile_extraction.extract_dumps(Path(self.output_path))
@@ -90,7 +94,7 @@ def read_bytes(self, pid: int, address: int, byte: int) -> Optional[bytes]:
         io_dst = IOVec(ctypes.cast(ctypes.byref(buff), ctypes.c_void_p), byte)
         io_src = IOVec(ctypes.c_void_p(address), byte)
 
-        linux_syscall = self.process_vm_readv(pid, ctypes.byref(io_dst), 1, ctypes.byref(io_src), 1, 0)
+        linux_syscall = _process_vm_readv(pid, ctypes.byref(io_dst), 1, ctypes.byref(io_src), 1, 0)
 
         if linux_syscall == -1:
             return None
@@ -100,12 +104,13 @@ def read_bytes(self, pid: int, address: int, byte: int) -> Optional[bytes]:
     def dump_processes(self) -> None:
         """Dumps all processes to temp files, adds temp file to output archive then removes the temp file"""
         archive_out = self.output_path
+        own_pid = getpid()
         with zipfile.ZipFile(archive_out, "a", compression=zipfile.ZIP_DEFLATED) as zip_file:
             try:
                 for proc in tqdm(self.process_info, desc="Process dump progess", unit=" procs"):
                     # If scanning with YARA, only dump processes if they triggered a rule
                     if self.yara_hit_pids:
-                        if proc["Process ID"] not in self.yara_hit_pids or proc["Process ID"] == self.own_pid:
+                        if proc["Process ID"] not in self.yara_hit_pids or proc["Process ID"] == own_pid:
                             continue
                     pid = proc["Process ID"]
                     p_name = proc["Name"]
@@ -117,14 +122,14 @@ def dump_processes(self) -> None:
                             for map in maps:
                                 page_start = map[0]
                                 page_len = map[1] - map[0]
-                                if page_len > self._MAX_VIRTUAL_PAGE_CHUNK:
-                                    sub_chunk_count, final_chunk_size = divmod(page_len, self._MAX_VIRTUAL_PAGE_CHUNK)
+                                if page_len > _MAX_VIRTUAL_PAGE_CHUNK:
+                                    sub_chunk_count, final_chunk_size = divmod(page_len, _MAX_VIRTUAL_PAGE_CHUNK)
                                     page_len = int(page_len / sub_chunk_count)
                                     for sc in range(0, sub_chunk_count):
                                         mem_page_content = self.read_bytes(pid, page_start, page_len)
                                         if mem_page_content:
                                             tmpfile.write(mem_page_content)
-                                        page_start = page_start + self._MAX_VIRTUAL_PAGE_CHUNK
+                                        page_start = page_start + _MAX_VIRTUAL_PAGE_CHUNK
                                     mem_page_content = self.read_bytes(pid, page_start, final_chunk_size)
                                     if mem_page_content:
                                         tmpfile.write(mem_page_content)