From 46c508fff2b3cc6f173645964124f2d9c807cd44 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 16 Oct 2025 20:29:02 +0100 Subject: [PATCH] Bump removal of plugins by a year to ensure suitable time for transition --- test/plugins/windows/test_scheduled_tasks.py | 2 +- test/plugins/windows/windows.py | 7 ++++--- volatility3/framework/plugins/windows/amcache.py | 5 +++-- volatility3/framework/plugins/windows/cachedump.py | 5 +++-- volatility3/framework/plugins/windows/hashdump.py | 5 +++-- volatility3/framework/plugins/windows/lsadump.py | 5 +++-- volatility3/framework/plugins/windows/scheduled_tasks.py | 5 +++-- 7 files changed, 20 insertions(+), 14 deletions(-) diff --git a/test/plugins/windows/test_scheduled_tasks.py b/test/plugins/windows/test_scheduled_tasks.py index 15d7f79a6..3369a5a35 100644 --- a/test/plugins/windows/test_scheduled_tasks.py +++ b/test/plugins/windows/test_scheduled_tasks.py @@ -4,7 +4,7 @@ import traceback import unittest sys.path.insert(0, "../../volatility3") -from volatility3.plugins.windows import scheduled_tasks +from volatility3.plugins.windows.registry import scheduled_tasks class TestActionsDecoding(unittest.TestCase): diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py index 431461b6d..ff31ac109 100644 --- a/test/plugins/windows/windows.py +++ b/test/plugins/windows/windows.py @@ -4,6 +4,7 @@ import json import os import shutil import tempfile + from test import WindowsSamples, test_volatility @@ -437,7 +438,7 @@ class TestWindowsVadyarascan: class TestWindowsAmcache: def test_windows_generic_amcache(self, volatility, python, image): rc, out, _err = test_volatility.runvol_plugin( - "windows.amcache.Amcache", + "windows.registry.amcache.Amcache", image, volatility, python, @@ -492,7 +493,7 @@ class TestWindowsBigPools: # class TestWindowsCachedump: # def test_windows_generic_cachedump(self, volatility, python, image): # rc, out, _err = test_volatility.runvol_plugin( -# "windows.cachedump.Cachedump", +# "windows.registry.cachedump.Cachedump", # image, # volatility, # python, @@ -820,7 +821,7 @@ class TestWindowsLsadump: def test_windows_specific_lsadump(self, volatility, python): image = WindowsSamples.WINDOWSXP_GENERIC.value.path rc, out, _err = test_volatility.runvol_plugin( - "windows.lsadump.Lsadump", + "windows.registry.lsadump.Lsadump", image, volatility, python, diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index be144be91..0d1450127 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -2,7 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from volatility3.framework import interfaces, deprecation + +from volatility3.framework import deprecation, interfaces from volatility3.plugins.windows.registry import amcache vollog = logging.getLogger(__name__) @@ -12,7 +13,7 @@ class Amcache( interfaces.plugins.PluginInterface, deprecation.PluginRenameClass, replacement_class=amcache.Amcache, - removal_date="2025-09-25", + removal_date="2026-09-25", ): """Extract information on executed applications from the AmCache (deprecated).""" diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 35127c6f3..3c474bc2c 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -2,7 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from volatility3.framework import interfaces, deprecation + +from volatility3.framework import deprecation, interfaces from volatility3.plugins.windows.registry import cachedump vollog = logging.getLogger(__name__) @@ -12,7 +13,7 @@ class Cachedump( interfaces.plugins.PluginInterface, deprecation.PluginRenameClass, replacement_class=cachedump.Cachedump, - removal_date="2025-09-25", + removal_date="2026-09-25", ): """Dumps lsa secrets from memory (deprecated)""" diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index e496e77a9..c4b99d86f 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -2,7 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from volatility3.framework import interfaces, deprecation + +from volatility3.framework import deprecation, interfaces from volatility3.plugins.windows.registry import hashdump vollog = logging.getLogger(__name__) @@ -12,7 +13,7 @@ class Hashdump( interfaces.plugins.PluginInterface, deprecation.PluginRenameClass, replacement_class=hashdump.Hashdump, - removal_date="2025-09-25", + removal_date="2026-09-25", ): """Dumps user hashes from memory (deprecated)""" diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 0b36ddef0..ab81f18df 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -2,7 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from volatility3.framework import interfaces, deprecation + +from volatility3.framework import deprecation, interfaces from volatility3.plugins.windows.registry import lsadump vollog = logging.getLogger(__name__) @@ -12,7 +13,7 @@ class Lsadump( interfaces.plugins.PluginInterface, deprecation.PluginRenameClass, replacement_class=lsadump.Lsadump, - removal_date="2025-09-25", + removal_date="2026-09-25", ): """Dumps lsa secrets from memory (deprecated)""" diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index 62d8e3b88..104d062b2 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -2,7 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from volatility3.framework import interfaces, deprecation + +from volatility3.framework import deprecation, interfaces from volatility3.plugins.windows.registry import scheduled_tasks vollog = logging.getLogger(__name__) @@ -12,7 +13,7 @@ class ScheduledTasks( interfaces.plugins.PluginInterface, deprecation.PluginRenameClass, replacement_class=scheduled_tasks.ScheduledTasks, - removal_date="2025-09-25", + removal_date="2026-09-25", ): """Decodes scheduled task information from the Windows registry, including information about triggers, actions, run times, and creation times (deprecated)."""