From 13eae6c3df4557bdb471512ece88c5917ae17bbf Mon Sep 17 00:00:00 2001
From: Andrew Case <andrew@dfir.org>
Date: Mon, 9 Dec 2024 13:19:06 -0600
Subject: [PATCH] Add capstone to test system requirements. Allow lazy type
 checks

---
 pyproject.toml                                               | 1 +
 volatility3/framework/plugins/windows/direct_system_calls.py | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index fc1ab96cb..9b4b8d485 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -37,6 +37,7 @@ dev = [
 test = [
     "volatility3[dev]",
     "pytest>=8.3.3,<9",
+    "capstone>=5.0.3,<6",
     "yara-x>=0.10.0,<1",
 ]
 
diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py
index ec8cd811b..51035b2bc 100644
--- a/volatility3/framework/plugins/windows/direct_system_calls.py
+++ b/volatility3/framework/plugins/windows/direct_system_calls.py
@@ -112,7 +112,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface):
         syscall_finder: syscall_finder_type,
         data: bytes,
         address: int,
-    ) -> Optional[Tuple[str, capstone._cs_insn]]:
+    ) -> Optional[Tuple[str, "capstone._cs_insn"]]:
         """
         Determines if the bytes starting at `data` represent a valid syscall instrunction invocation block