Add capstone to test system requirements. Allow lazy type checks

pyproject.toml

@@ -37,6 +37,7 @@ dev = [
 test = [
     "volatility3[dev]",
     "pytest>=8.3.3,<9",
+    "capstone>=5.0.3,<6",
     "yara-x>=0.10.0,<1",
 ]
 

volatility3/framework/plugins/windows/direct_system_calls.py

@@ -112,7 +112,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface):
         syscall_finder: syscall_finder_type,
         data: bytes,
         address: int,
-    ) -> Optional[Tuple[str, capstone._cs_insn]]:
+    ) -> Optional[Tuple[str, "capstone._cs_insn"]]:
         """
         Determines if the bytes starting at `data` represent a valid syscall instrunction invocation block