Skip to content

Commit bfc7e01

Browse files
author
Dave Lassalle
committed
fix merge conflicts
2 parents ef29008 + 8de4603 commit bfc7e01

File tree

160 files changed

+5813
-1003
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

160 files changed

+5813
-1003
lines changed

‎.github/workflows/ruff.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jobs:
99
steps:
1010
- uses: actions/checkout@v4
1111

12-
- uses: astral-sh/ruff-action@v1
12+
- uses: astral-sh/ruff-action@v3.2.1
1313
with:
1414
args: check
1515
src: "."

‎.github/workflows/test.yaml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,13 +31,17 @@ jobs:
3131
gunzip linux-sample-1.bin.gz
3232
curl -sLO "https://downloads.volatilityfoundation.org/volatility3/images/win-xp-laptop-2005-06-25.img.gz"
3333
gunzip win-xp-laptop-2005-06-25.img.gz
34+
curl -sLO "https://downloads.volatilityfoundation.org/volatility3/images/win-10_19041-2025_03.dmp.gz"
35+
gunzip win-10_19041-2025_03.dmp.gz
3436
cd -
3537
3638
- name: Download and Extract symbols
3739
run: |
3840
cd ./volatility3/symbols
3941
curl -sLO https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip
42+
curl -sLO https://downloads.volatilityfoundation.org/volatility3/symbols/symbols_win-10_19041-2025_03.zip
4043
unzip linux.zip
44+
unzip symbols_win-10_19041-2025_03.zip
4145
cd -
4246
4347
- name: Testing...
@@ -47,8 +51,8 @@ jobs:
4751
pytest ./test/plugins/linux/linux.py --volatility=volshell.py --image-dir=./test_images -k test_linux_volshell -v
4852
4953
# Volatility
50-
pytest ./test/plugins/windows/windows.py --volatility=vol.py --image-dir=./test_images -k "test_windows and not test_windows_volshell" -v
51-
pytest ./test/plugins/linux/linux.py --volatility=vol.py --image-dir=./test_images -k "test_linux and not test_linux_volshell" -v
54+
pytest ./test/plugins/windows/windows.py --volatility=vol.py --image=./test_images/win-10_19041-2025_03.dmp -k "test_windows and not test_windows_volshell" -v --durations=0
55+
pytest ./test/plugins/linux/linux.py --volatility=vol.py --image-dir=./test_images -k "test_linux and not test_linux_volshell" -v --durations=0
5256
5357
- name: Clean up post-test
5458
run: |

‎doc/source/simple-plugin.rst‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,9 @@ to be able to run properly. Any that are defined as optional need not necessari
5353
description = "Process IDs to include (all other processes are excluded)",
5454
optional = True
5555
),
56-
requirements.PluginRequirement(
56+
requirements.VersionRequirement(
5757
name = 'pslist',
58-
plugin = pslist.PsList,
58+
component = pslist.PsList,
5959
version = (2, 0, 0)
6060
),
6161
]

‎test/__init__.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11
from enum import Enum
2+
from pathlib import Path
3+
4+
TESTS_ROOT_DIR = Path(__file__).parent
5+
WINDOWS_TESTS_DATA_DIR = TESTS_ROOT_DIR / "plugins" / "windows" / "test_data"
26

37

48
class Sample:
@@ -9,6 +13,8 @@ def __init__(self, path: str):
913
class WindowsSamples(Enum):
1014
WINDOWSXP_GENERIC = Sample("./test_images/win-xp-laptop-2005-06-25.img")
1115
"""WindowsXP sample from early Volatility training."""
16+
WINDOWS10_GENERIC = Sample("./test_images/win-10_19041-2025_03.dmp")
17+
"""Windows10 CrashDump sample."""
1218

1319

1420
class LinuxSamples(Enum):

‎test/plugins/linux/linux.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
class TestLinuxVolshell:
99
def test_linux_volshell(self, image, volatility, python):
1010
out = test_volatility.basic_volshell_test(
11-
image, volatility, python, globalargs=("-l",)
11+
image, volatility, python, volshellargs=("-l",)
1212
)
1313
assert out.count(b"<task_struct") > 100
1414

‎test/plugins/windows/test_data/windows.driverirp.DriverIrp.json‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
"GENERIC": [
3+
"IRP_MJ_CREATE",
4+
"IRP_MJ_CREATE_NAMED_PIPE",
5+
"IRP_MJ_CLOSE",
6+
"IRP_MJ_READ",
7+
"IRP_MJ_WRITE",
8+
"IRP_MJ_QUERY_INFORMATION",
9+
"IRP_MJ_SET_INFORMATION",
10+
"IRP_MJ_QUERY_EA",
11+
"IRP_MJ_SET_EA",
12+
"IRP_MJ_FLUSH_BUFFERS",
13+
"IRP_MJ_QUERY_VOLUME_INFORMATION",
14+
"IRP_MJ_SET_VOLUME_INFORMATION",
15+
"IRP_MJ_DIRECTORY_CONTROL",
16+
"IRP_MJ_FILE_SYSTEM_CONTROL",
17+
"IRP_MJ_DEVICE_CONTROL",
18+
"IRP_MJ_INTERNAL_DEVICE_CONTROL",
19+
"IRP_MJ_SHUTDOWN",
20+
"IRP_MJ_LOCK_CONTROL",
21+
"IRP_MJ_CLEANUP",
22+
"IRP_MJ_CREATE_MAILSLOT",
23+
"IRP_MJ_QUERY_SECURITY",
24+
"IRP_MJ_SET_SECURITY",
25+
"IRP_MJ_POWER",
26+
"IRP_MJ_SYSTEM_CONTROL",
27+
"IRP_MJ_DEVICE_CHANGE",
28+
"IRP_MJ_QUERY_QUOTA",
29+
"IRP_MJ_SET_QUOTA",
30+
"IRP_MJ_PNP"
31+
]
32+
}

‎test/plugins/windows/test_data/windows.info.Info.json‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
{
2+
"WINDOWS10_GENERIC": [
3+
{
4+
"Value": "0xf8043601f000",
5+
"Variable": "Kernel Base"
6+
},
7+
{
8+
"Value": "0x6d4000",
9+
"Variable": "DTB"
10+
},
11+
{
12+
"Value": "True",
13+
"Variable": "Is64Bit"
14+
},
15+
{
16+
"Value": "False",
17+
"Variable": "IsPAE"
18+
},
19+
{
20+
"Value": "0 WindowsIntel32e",
21+
"Variable": "layer_name"
22+
},
23+
{
24+
"Value": "1 WindowsCrashDump64Layer",
25+
"Variable": "memory_layer"
26+
},
27+
{
28+
"Value": "2 FileLayer",
29+
"Variable": "base_layer"
30+
},
31+
{
32+
"Value": "0xf80436c1fb20",
33+
"Variable": "KdDebuggerDataBlock"
34+
},
35+
{
36+
"Value": "19041.1.amd64fre.vb_release.1912",
37+
"Variable": "NTBuildLab"
38+
},
39+
{
40+
"Value": "0",
41+
"Variable": "CSDVersion"
42+
},
43+
{
44+
"Value": "0xf80436c2e420",
45+
"Variable": "KdVersionBlock"
46+
},
47+
{
48+
"Value": "15.19041",
49+
"Variable": "Major/Minor"
50+
},
51+
{
52+
"Value": "34404",
53+
"Variable": "MachineType"
54+
},
55+
{
56+
"Value": "1",
57+
"Variable": "KeNumberProcessors"
58+
},
59+
{
60+
"Value": "2025-03-06 17:59:20+00:00",
61+
"Variable": "SystemTime"
62+
},
63+
{
64+
"Value": "C:\\Windows",
65+
"Variable": "NtSystemRoot"
66+
},
67+
{
68+
"Value": "NtProductWinNt",
69+
"Variable": "NtProductType"
70+
},
71+
{
72+
"Value": "10",
73+
"Variable": "NtMajorVersion"
74+
},
75+
{
76+
"Value": "0",
77+
"Variable": "NtMinorVersion"
78+
},
79+
{
80+
"Value": "10",
81+
"Variable": "PE MajorOperatingSystemVersion"
82+
},
83+
{
84+
"Value": "0",
85+
"Variable": "PE MinorOperatingSystemVersion"
86+
},
87+
{
88+
"Value": "34404",
89+
"Variable": "PE Machine"
90+
},
91+
{
92+
"Value": "Tue Sep 26 06:53:33 2023",
93+
"Variable": "PE TimeDateStamp"
94+
}
95+
]
96+
}

0 commit comments

Comments
 (0)