WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add in Zstd support (only present in >=python-3.14)

Browse Source
This commit is contained in:
Mike Auty
2026-03-09 21:36:13 +00:00
parent 8c67953c50
commit 449a193791
1 changed files with 22 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/layers/resources.py
+22 -6
View File
@@ -14,7 +14,7 @@ import sys
import urllib.parse
import urllib.request
import zipfile
from typing import Any, IO, List, Optional
from typing import IO, Any, List, Optional
from urllib import error
from volatility3 import framework
@@ -27,6 +27,13 @@ try:
except ImportError:
HAS_MAGIC = False
try:
import zstd
ZSTD_SUPPORTED = True
except ImportError:
ZSTD_SUPPORTED = False
try:
# Import so that the handler is found by the framework.class_subclasses callc
from smb import SMBHandler as SMBHandler # lgtm [py/unused-import]
@@ -232,21 +239,26 @@ class ResourceAccessor:
# Only file's python has magic.detect_from_fobj
if detected:
inside_compressed_file = False
if detected.mime_type == "application/x-xz":
curfile = cascadeCloseFile(
lzma.LZMAFile(curfile, mode), curfile
)
inside_compressed_file = True
elif detected.mime_type == "application/x-bzip2":
curfile = cascadeCloseFile(bz2.BZ2File(curfile, mode), curfile)
inside_compressed_file = True
elif detected.mime_type == "application/x-gzip":
curfile = cascadeCloseFile(
gzip.GzipFile(fileobj=curfile, mode=mode), curfile
)
if detected.mime_type in [
"application/x-xz",
"application/x-bzip2",
"application/x-gzip",
]:
inside_compressed_file = True
elif detected.mime_type == "application/zstd" and ZSTD_SUPPORTED:
curfile = cascadeCloseFile(
zstd.ZstdFile(fileobj=curfile, mode=mode), curfile
)
inside_compressed_file = True
if inside_compressed_file:
# Read and rewind to ensure we're inside any compressed file layers
curfile.read(1)
curfile.seek(0)
@@ -272,6 +284,10 @@ class ResourceAccessor:
curfile = cascadeCloseFile(
gzip.GzipFile(fileobj=curfile, mode=mode), curfile
)
elif extension == "zstd" and ZSTD_SUPPORTED:
curfile = cascadeCloseFile(
zstd.ZstdFile(fileobj=curfile, mode=mode), curfile
)
else:
stop = True