From 85e86d45c547654afe7c2dca86f6c6d200cb05df Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 8 Mar 2023 20:42:24 +0000
Subject: [PATCH 01/34] Linux: fix black lint issues

---
 volatility3/framework/plugins/linux/envars.py | 1 -
 volatility3/framework/plugins/linux/iomem.py  | 1 -
 2 files changed, 2 deletions(-)

diff --git a/volatility3/framework/plugins/linux/envars.py b/volatility3/framework/plugins/linux/envars.py
index 028eb2a57..5cbf0f502 100644
--- a/volatility3/framework/plugins/linux/envars.py
+++ b/volatility3/framework/plugins/linux/envars.py
@@ -70,7 +70,6 @@ class Envars(plugins.PluginInterface):
 
             # if mm exists attempt to get envars
             if mm:
-
                 # get process layer to read envars from
                 proc_layer_name = task.add_process_layer()
                 if proc_layer_name is None:
diff --git a/volatility3/framework/plugins/linux/iomem.py b/volatility3/framework/plugins/linux/iomem.py
index fddea4668..8efbf3b57 100644
--- a/volatility3/framework/plugins/linux/iomem.py
+++ b/volatility3/framework/plugins/linux/iomem.py
@@ -128,7 +128,6 @@ class IOMem(interfaces.plugins.PluginInterface):
 
         # only continue if iomem_root address was located
         if iomem_root_offset is not None:
-
             # recursively parse the resources starting from the root resource at 'iomem_resource'
             for depth, (name, start, end) in self.parse_resource(
                 self.context, vmlinux_module_name, iomem_root_offset

From cfec8e4b1214329726855ffc89541f9eec29f3ec Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sat, 11 Mar 2023 15:18:58 +0000
Subject: [PATCH 02/34] Core: Pointer is_readable should check the native layer

---
 volatility3/framework/objects/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility3/framework/objects/__init__.py b/volatility3/framework/objects/__init__.py
index a04eedd87..3b1745718 100644
--- a/volatility3/framework/objects/__init__.py
+++ b/volatility3/framework/objects/__init__.py
@@ -442,7 +442,7 @@ class Pointer(Integer):
     def is_readable(self, layer_name: Optional[str] = None) -> bool:
         """Determines whether the address of this pointer can be read from
         memory."""
-        layer_name = layer_name or self.vol.layer_name
+        layer_name = layer_name or self.vol.native_layer_name
         return self._context.layers[layer_name].is_valid(self, self.vol.subtype.size)
 
     def __getattr__(self, attr: str) -> Any:

From b5ef7248ab1ef5ab5cab9fc5b6d05a88ef26c7bf Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sat, 11 Mar 2023 15:17:24 +0000
Subject: [PATCH 03/34] Linux: Fix psscan task native_layer

---
 volatility3/framework/plugins/linux/psscan.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/volatility3/framework/plugins/linux/psscan.py b/volatility3/framework/plugins/linux/psscan.py
index f4bfd347e..7b03d8c87 100644
--- a/volatility3/framework/plugins/linux/psscan.py
+++ b/volatility3/framework/plugins/linux/psscan.py
@@ -135,6 +135,7 @@ class PsScan(interfaces.plugins.PluginInterface):
             raise exceptions.LayerException(
                 kernel_layer_name, f"Layer {kernel_layer_name} has no dependencies"
             )
+        memory_layer_name = kernel_layer.dependencies[0]
         memory_layer = context.layers[kernel_layer.dependencies[0]]
 
         # scan the memory_layer for these needles
@@ -145,7 +146,8 @@ class PsScan(interfaces.plugins.PluginInterface):
             ptask = context.object(
                 vmlinux.symbol_table_name + constants.BANG + "task_struct",
                 offset=address - sched_class_offset,
-                layer_name="memory_layer",
+                layer_name=memory_layer_name,
+                native_layer_name=kernel_layer_name,
             )
 
             # sanity check exit_state

From 1b5a6b626733a289ae088e92a292d259c3e1931f Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 12 Apr 2023 19:57:15 +0100
Subject: [PATCH 04/34] Core: Bump the copyright year of the README

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 502e26f10..471735af8 100644
--- a/README.md
+++ b/README.md
@@ -107,7 +107,7 @@ The latest generated copy of the documentation can be found at: <https://volatil
 
 ## Licensing and Copyright
 
-Copyright (C) 2007-2022 Volatility Foundation
+Copyright (C) 2007-2023 Volatility Foundation
 
 All Rights Reserved
 

From 43bef641dc9b79f6ba3f5c0e345e9d76ffcd1318 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 27 Sep 2023 20:37:38 +0100
Subject: [PATCH 05/34] Revert "Linux: Fix slight issue in envvars renaming"

This reverts commit 60292c2da1efa886d0f46bd720af537a6069a623.
---
 volatility3/framework/plugins/linux/envars.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility3/framework/plugins/linux/envars.py b/volatility3/framework/plugins/linux/envars.py
index 758943312..c4e3ed3c9 100644
--- a/volatility3/framework/plugins/linux/envars.py
+++ b/volatility3/framework/plugins/linux/envars.py
@@ -1,4 +1,4 @@
-from volatility3.plugins.linux import envvars
+from volatility3.plugins import envvars
 import logging
 
 vollog = logging.getLogger(__name__)

From 56cb5ea93ba74819ba4fe3a9bec39220d6d60d43 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 27 Sep 2023 20:37:51 +0100
Subject: [PATCH 06/34] Revert "Linux: Rename linux.envars to linux.envvars"

This reverts commit d9a365d96fcd990c7faba32ab7aa63523203e9f8.
---
 volatility3/framework/plugins/linux/envars.py | 121 +++++++++++++++++-
 .../framework/plugins/linux/envvars.py        | 121 ------------------
 2 files changed, 115 insertions(+), 127 deletions(-)
 delete mode 100644 volatility3/framework/plugins/linux/envvars.py

diff --git a/volatility3/framework/plugins/linux/envars.py b/volatility3/framework/plugins/linux/envars.py
index c4e3ed3c9..5cbf0f502 100644
--- a/volatility3/framework/plugins/linux/envars.py
+++ b/volatility3/framework/plugins/linux/envars.py
@@ -1,12 +1,121 @@
-from volatility3.plugins import envvars
+# This file is Copyright 2022 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+
 import logging
 
+from volatility3.framework import exceptions, renderers
+from volatility3.framework.configuration import requirements
+from volatility3.framework.interfaces import plugins
+from volatility3.framework.objects import utility
+from volatility3.plugins.linux import pslist
+
 vollog = logging.getLogger(__name__)
 
 
-class Envars(envvars.Envvars):
-    def run(self, *args, **kwargs):
-        vollog.warning(
-            "The linux.envars plugin has been renamed to linux.envvars and will only be accessible through the new name in a future release"
+class Envars(plugins.PluginInterface):
+    """Lists processes with their environment variables"""
+
+    _required_framework_version = (2, 0, 0)
+
+    @classmethod
+    def get_requirements(cls):
+        # Since we're calling the plugin, make sure we have the plugin's requirements
+        return [
+            requirements.ModuleRequirement(
+                name="kernel",
+                description="Linux kernel",
+                architectures=["Intel32", "Intel64"],
+            ),
+            requirements.PluginRequirement(
+                name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
+            ),
+            requirements.ListRequirement(
+                name="pid",
+                description="Filter on specific process IDs",
+                element_type=int,
+                optional=True,
+            ),
+        ]
+
+    def _generator(self, tasks):
+        """Generates a listing of processes along with environment variables"""
+
+        # walk the process list and return the envars
+        for task in tasks:
+            pid = task.pid
+
+            # get process name as string
+            name = utility.array_to_string(task.comm)
+
+            # try and get task parent
+            try:
+                ppid = task.parent.pid
+            except exceptions.InvalidAddressException:
+                vollog.debug(
+                    f"Unable to read parent pid for task {pid} {name}, setting ppid to 0."
+                )
+                ppid = 0
+
+            # kernel threads never have an mm as they do not have userland mappings
+            try:
+                mm = task.mm
+            except exceptions.InvalidAddressException:
+                # no mm so cannot get envars
+                vollog.debug(
+                    f"Unable to access mm for task {pid} {name} it is likely a kernel thread, will not extract any envars."
+                )
+                mm = None
+                continue
+
+            # if mm exists attempt to get envars
+            if mm:
+                # get process layer to read envars from
+                proc_layer_name = task.add_process_layer()
+                if proc_layer_name is None:
+                    vollog.debug(
+                        f"Unable to construct process layer for task {pid} {name}, will not extract any envars."
+                    )
+                    continue
+                proc_layer = self.context.layers[proc_layer_name]
+
+                # get the size of the envars with sanity checking
+                envars_size = task.mm.env_end - task.mm.env_start
+                if not (0 < envars_size <= 8192):
+                    vollog.debug(
+                        f"Task {pid} {name} appears to have envars of size {envars_size} bytes which fails the sanity checking, will not extract any envars."
+                    )
+                    continue
+
+                # attempt to read all envars data
+                try:
+                    envar_data = proc_layer.read(task.mm.env_start, envars_size)
+                except exceptions.InvalidAddressException:
+                    vollog.debug(
+                        f"Unable to read full envars for {pid} {name} starting at virtual offset {hex(task.mm.env_start)} for {envars_size} bytes, will not extract any envars."
+                    )
+                    continue
+
+                # parse envar data, envars are null terminated, keys and values are separated by '='
+                envar_data = envar_data.rstrip(b"\x00")
+                for envar_pair in envar_data.split(b"\x00"):
+                    try:
+                        key, value = envar_pair.decode().split("=", 1)
+                    except ValueError:
+                        vollog.debug(
+                            f"Unable to extract envars for {pid} {name} starting at virtual offset {hex(task.mm.env_start)}, they don't appear to be '=' separated"
+                        )
+                        continue
+                    yield (0, (pid, ppid, name, key, value))
+
+    def run(self):
+        filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
+
+        return renderers.TreeGrid(
+            [("PID", int), ("PPID", int), ("COMM", str), ("KEY", str), ("VALUE", str)],
+            self._generator(
+                pslist.PsList.list_tasks(
+                    self.context, self.config["kernel"], filter_func=filter_func
+                )
+            ),
         )
-        return super().run(*args, **kwargs)
diff --git a/volatility3/framework/plugins/linux/envvars.py b/volatility3/framework/plugins/linux/envvars.py
deleted file mode 100644
index 1d6c8b784..000000000
--- a/volatility3/framework/plugins/linux/envvars.py
+++ /dev/null
@@ -1,121 +0,0 @@
-# This file is Copyright 2022 Volatility Foundation and licensed under the Volatility Software License 1.0
-# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
-#
-
-import logging
-
-from volatility3.framework import exceptions, renderers
-from volatility3.framework.configuration import requirements
-from volatility3.framework.interfaces import plugins
-from volatility3.framework.objects import utility
-from volatility3.plugins.linux import pslist
-
-vollog = logging.getLogger(__name__)
-
-
-class Envvars(plugins.PluginInterface):
-    """Lists processes with their environment variables"""
-
-    _required_framework_version = (2, 0, 0)
-
-    @classmethod
-    def get_requirements(cls):
-        # Since we're calling the plugin, make sure we have the plugin's requirements
-        return [
-            requirements.ModuleRequirement(
-                name="kernel",
-                description="Linux kernel",
-                architectures=["Intel32", "Intel64"],
-            ),
-            requirements.PluginRequirement(
-                name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
-            ),
-            requirements.ListRequirement(
-                name="pid",
-                description="Filter on specific process IDs",
-                element_type=int,
-                optional=True,
-            ),
-        ]
-
-    def _generator(self, tasks):
-        """Generates a listing of processes along with environment variables"""
-
-        # walk the process list and return the envars
-        for task in tasks:
-            pid = task.pid
-
-            # get process name as string
-            name = utility.array_to_string(task.comm)
-
-            # try and get task parent
-            try:
-                ppid = task.parent.pid
-            except exceptions.InvalidAddressException:
-                vollog.debug(
-                    f"Unable to read parent pid for task {pid} {name}, setting ppid to 0."
-                )
-                ppid = 0
-
-            # kernel threads never have an mm as they do not have userland mappings
-            try:
-                mm = task.mm
-            except exceptions.InvalidAddressException:
-                # no mm so cannot get envars
-                vollog.debug(
-                    f"Unable to access mm for task {pid} {name} it is likely a kernel thread, will not extract any envars."
-                )
-                mm = None
-                continue
-
-            # if mm exists attempt to get envars
-            if mm:
-                # get process layer to read envars from
-                proc_layer_name = task.add_process_layer()
-                if proc_layer_name is None:
-                    vollog.debug(
-                        f"Unable to construct process layer for task {pid} {name}, will not extract any envars."
-                    )
-                    continue
-                proc_layer = self.context.layers[proc_layer_name]
-
-                # get the size of the envars with sanity checking
-                envars_size = task.mm.env_end - task.mm.env_start
-                if not (0 < envars_size <= 8192):
-                    vollog.debug(
-                        f"Task {pid} {name} appears to have envars of size {envars_size} bytes which fails the sanity checking, will not extract any envars."
-                    )
-                    continue
-
-                # attempt to read all envars data
-                try:
-                    envar_data = proc_layer.read(task.mm.env_start, envars_size)
-                except exceptions.InvalidAddressException:
-                    vollog.debug(
-                        f"Unable to read full envars for {pid} {name} starting at virtual offset {hex(task.mm.env_start)} for {envars_size} bytes, will not extract any envars."
-                    )
-                    continue
-
-                # parse envar data, envars are null terminated, keys and values are separated by '='
-                envar_data = envar_data.rstrip(b"\x00")
-                for envar_pair in envar_data.split(b"\x00"):
-                    try:
-                        key, value = envar_pair.decode().split("=", 1)
-                    except ValueError:
-                        vollog.debug(
-                            f"Unable to extract envars for {pid} {name} starting at virtual offset {hex(task.mm.env_start)}, they don't appear to be '=' separated"
-                        )
-                        continue
-                    yield (0, (pid, ppid, name, key, value))
-
-    def run(self):
-        filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
-
-        return renderers.TreeGrid(
-            [("PID", int), ("PPID", int), ("COMM", str), ("KEY", str), ("VALUE", str)],
-            self._generator(
-                pslist.PsList.list_tasks(
-                    self.context, self.config["kernel"], filter_func=filter_func
-                )
-            ),
-        )

From 409ce95980b0e4c5a29222f4acb90b681886d16f Mon Sep 17 00:00:00 2001
From: hsarkey <hsarkey@volexity.com>
Date: Thu, 7 Dec 2023 14:04:44 -0500
Subject: [PATCH 07/34] Windows: Added '--refined' option to windows malfind
 plugin

Also updated malfind to include "\x55\x48" and "\x55\x89" as part of the refined_criteria list.
---
 volatility3/framework/plugins/windows/malfind.py | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py
index 6ed078996..1c73fdf1c 100644
--- a/volatility3/framework/plugins/windows/malfind.py
+++ b/volatility3/framework/plugins/windows/malfind.py
@@ -46,6 +46,12 @@ class Malfind(interfaces.plugins.PluginInterface):
             requirements.VersionRequirement(
                 name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0)
             ),
+            requirements.BooleanRequirement(
+                name="refined",
+                description="Refine the output. Only show regions with an MZ header or that start with well known opcode combinations (i.e. PUSH EBP). WARNING: This can cause you to overlook regions with wiped headers or shell code blocks starting with NOP sleds, etc.. However, it will in general result in less noisy output.",
+                default=False,
+                optional=True,
+            ),
         ]
 
     @classmethod
@@ -138,6 +144,9 @@ class Malfind(interfaces.plugins.PluginInterface):
                 yield vad, data
 
     def _generator(self, procs):
+        # set refined criteria
+        refined_criteria = [b"MZ", b"\x55\x8B", b"\x55\x48", b"\x55\x89"]
+
         # determine if we're on a 32 or 64 bit kernel
         kernel = self.context.modules[self.config["kernel"]]
 
@@ -151,6 +160,10 @@ class Malfind(interfaces.plugins.PluginInterface):
             for vad, data in self.list_injections(
                 self.context, kernel.layer_name, kernel.symbol_table_name, proc
             ):
+                # check if refined option was passed
+                if self.config["refined"] and data[0:2] not in refined_criteria:
+                    continue
+
                 # if we're on a 64 bit kernel, we may still need 32 bit disasm due to wow64
                 if is_32bit_arch or proc.get_is_wow64():
                     architecture = "intel"

From 52dcfb45f45b9442b944f124f66cb0c363b584af Mon Sep 17 00:00:00 2001
From: bbarnacle <bbarnacle@volexity.com>
Date: Tue, 28 Nov 2023 11:20:51 -0500
Subject: [PATCH 08/34] Windows: Add regex filtering to dumpfiles

In volatility2, the windows.dumpfiles plugin allows you to filter the dumped files
using a regular expression. This PR adds the same functionality to volatility3.

The regular expression is passed in using --regex=REGEX and all files matching
REGEX will be dumped. The --ignore-case flag can be passed to make the search
case-insensitive. The search is case-sensitive by default. The matching
volatility2 functionality can be found here:
https://github.com/volatilityfoundation/volatility/blob/a438e768194a9e05eb4d9ee
9338b881c0fa25937/volatility/plugins/dumpfiles.py#L844

Manual testing was performed on windows memory images across different windows
versions to verify the expected output.
---
 .../framework/plugins/windows/dumpfiles.py    | 32 ++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py
index dd82d897e..4aef660da 100755
--- a/volatility3/framework/plugins/windows/dumpfiles.py
+++ b/volatility3/framework/plugins/windows/dumpfiles.py
@@ -4,11 +4,12 @@
 
 import logging
 import ntpath
+import re
 from typing import List, Tuple, Type, Optional, Generator
 
 from volatility3.framework import interfaces, renderers, exceptions, constants
 from volatility3.framework.configuration import requirements
-from volatility3.framework.renderers import format_hints
+from volatility3.framework.renderers import format_hints, UnreadableValue
 from volatility3.plugins.windows import handles
 from volatility3.plugins.windows import pslist
 
@@ -53,6 +54,15 @@ class DumpFiles(interfaces.plugins.PluginInterface):
                 description="Dump a single _FILE_OBJECT at this physical address",
                 optional=True,
             ),
+            requirements.StringRequirement(
+                name="regex", description="Dump files matching REGEX", optional=True
+            ),
+            requirements.BooleanRequirement(
+                name="ignore-case",
+                description="Ignore case in pattern match",
+                default=False,
+                optional=True,
+            ),
             requirements.VersionRequirement(
                 name="pslist", component=pslist.PsList, version=(2, 0, 0)
             ),
@@ -208,6 +218,11 @@ class DumpFiles(interfaces.plugins.PluginInterface):
 
     def _generator(self, procs: List, offsets: List):
         kernel = self.context.modules[self.config["kernel"]]
+        if self.config["regex"]:
+            if self.config["ignore-case"]:
+                file_re = re.compile(self.config["regex"], re.I)
+            else:
+                file_re = re.compile(self.config["regex"])
 
         if procs:
             # The handles plugin doesn't expose any staticmethod/classmethod, and it also requires stashing
@@ -243,6 +258,14 @@ class DumpFiles(interfaces.plugins.PluginInterface):
                         obj_type = entry.get_object_type(type_map, cookie)
                         if obj_type == "File":
                             file_obj = entry.Body.cast("_FILE_OBJECT")
+
+                            if self.config["regex"]:
+                                name = file_obj.file_name_with_device()
+                                if isinstance(name, UnreadableValue):
+                                    continue
+                                if not file_re.search(name):
+                                    continue
+
                             for result in self.process_file_object(
                                 self.context, kernel.layer_name, self.open, file_obj
                             ):
@@ -272,6 +295,13 @@ class DumpFiles(interfaces.plugins.PluginInterface):
                         if not file_obj.is_valid():
                             continue
 
+                        if self.config["regex"]:
+                            name = file_obj.file_name_with_device()
+                            if isinstance(name, UnreadableValue):
+                                continue
+                            if not file_re.search(name):
+                                continue
+
                         for result in self.process_file_object(
                             self.context, kernel.layer_name, self.open, file_obj
                         ):

From 614d4d6f2b9eac50992c04cd08e7389be19ede99 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 17 Jan 2024 20:35:54 +0000
Subject: [PATCH 09/34] Layers: Fix cloudstorage unnecessary import

---
 volatility3/framework/layers/cloudstorage.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/volatility3/framework/layers/cloudstorage.py b/volatility3/framework/layers/cloudstorage.py
index 3f88ef34f..97ed54231 100644
--- a/volatility3/framework/layers/cloudstorage.py
+++ b/volatility3/framework/layers/cloudstorage.py
@@ -20,7 +20,6 @@ try:
 except ImportError:
     HAS_GCSFS = False
 
-from volatility3.framework import exceptions
 from volatility3.framework.layers import resources
 
 vollog = logging.getLogger(__file__)

From 01ffcd9634af3d6ef90c130f1dfd1a8910554d4d Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 17 Jan 2024 20:37:26 +0000
Subject: [PATCH 10/34] Core: Fixing None equality test in MapleTree
 implementation

---
 volatility3/framework/symbols/linux/extensions/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index d8a2867cc..d73d0cfb9 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -362,7 +362,7 @@ class maple_tree(objects.StructType):
         # None. If however you wanted to parse from a node, but ignore some parts of the tree below it then
         # this could be populated with the addresses of the nodes you wish to ignore.
 
-        if seen == None:
+        if seen is None:
             seen = set()
 
         # protect against unlikely loop

From 4b86b9ea89b5610c581a574045309b93ea8f3ef5 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 17 Jan 2024 20:40:27 +0000
Subject: [PATCH 11/34] Plugins: Remove unnecessary variable from
 windows.mftscan

---
 volatility3/framework/plugins/windows/mftscan.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py
index 7e4e1ca18..4298b4e4e 100644
--- a/volatility3/framework/plugins/windows/mftscan.py
+++ b/volatility3/framework/plugins/windows/mftscan.py
@@ -53,7 +53,6 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
         # get each of the individual Field Sets
         mft_object = symbol_table + constants.BANG + "MFT_ENTRY"
         attribute_object = symbol_table + constants.BANG + "ATTRIBUTE"
-        header_object = symbol_table + constants.BANG + "ATTR_HEADER"
         si_object = symbol_table + constants.BANG + "STANDARD_INFORMATION_ENTRY"
         fn_object = symbol_table + constants.BANG + "FILE_NAME_ENTRY"
 

From 4e89040dadfacac01ba0c0a3727969a7b0fb0047 Mon Sep 17 00:00:00 2001
From: hsarkey <hsarkey@volexity.com>
Date: Sun, 14 Jan 2024 13:20:56 -0500
Subject: [PATCH 12/34] Updated changes to the windows.malfind plugin.
 Eliminated --refined as a command line option and instead added an additional
 column called "Notes" to provide info on common headers.

---
 .../framework/plugins/windows/malfind.py      | 24 +++++++++----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py
index 1c73fdf1c..a14f8889d 100644
--- a/volatility3/framework/plugins/windows/malfind.py
+++ b/volatility3/framework/plugins/windows/malfind.py
@@ -46,12 +46,6 @@ class Malfind(interfaces.plugins.PluginInterface):
             requirements.VersionRequirement(
                 name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0)
             ),
-            requirements.BooleanRequirement(
-                name="refined",
-                description="Refine the output. Only show regions with an MZ header or that start with well known opcode combinations (i.e. PUSH EBP). WARNING: This can cause you to overlook regions with wiped headers or shell code blocks starting with NOP sleds, etc.. However, it will in general result in less noisy output.",
-                default=False,
-                optional=True,
-            ),
         ]
 
     @classmethod
@@ -144,9 +138,6 @@ class Malfind(interfaces.plugins.PluginInterface):
                 yield vad, data
 
     def _generator(self, procs):
-        # set refined criteria
-        refined_criteria = [b"MZ", b"\x55\x8B", b"\x55\x48", b"\x55\x89"]
-
         # determine if we're on a 32 or 64 bit kernel
         kernel = self.context.modules[self.config["kernel"]]
 
@@ -155,14 +146,21 @@ class Malfind(interfaces.plugins.PluginInterface):
         )
 
         for proc in procs:
+            # by default, "Notes" column will be set to none
+            notes = "None" 
             process_name = utility.array_to_string(proc.ImageFileName)
 
             for vad, data in self.list_injections(
                 self.context, kernel.layer_name, kernel.symbol_table_name, proc
             ):
-                # check if refined option was passed
-                if self.config["refined"] and data[0:2] not in refined_criteria:
-                    continue
+                # Check for unique headers and update "Notes" column if criteria is met
+                match data[0:2]:
+                    case b"MZ" | b"\x55\x8B":
+                        notes = "MZ header"
+                    case b"\x55\x8B":
+                        notes = "PE header"
+                    case b"\x55\x48" | b"\x55\x89":
+                        notes = "Function prologue"
 
                 # if we're on a 64 bit kernel, we may still need 32 bit disasm due to wow64
                 if is_32bit_arch or proc.get_is_wow64():
@@ -209,6 +207,7 @@ class Malfind(interfaces.plugins.PluginInterface):
                         vad.get_commit_charge(),
                         vad.get_private_memory(),
                         file_output,
+                        notes,
                         format_hints.HexBytes(data),
                         disasm,
                     ),
@@ -229,6 +228,7 @@ class Malfind(interfaces.plugins.PluginInterface):
                 ("CommitCharge", int),
                 ("PrivateMemory", int),
                 ("File output", str),
+                ("Notes", str),
                 ("Hexdump", format_hints.HexBytes),
                 ("Disasm", interfaces.renderers.Disassembly),
             ],

From e6e138f12d06509da829008867392bc2346f18f9 Mon Sep 17 00:00:00 2001
From: hsarkey <hsarkey@volexity.com>
Date: Wed, 17 Jan 2024 17:24:26 -0500
Subject: [PATCH 13/34] Updated windows.malfind to have a "Notes" column which
 will indicate if a process meets a "refined criteria", meaning it has a
 common header type (MZ, PE, or a function prologue).

---
 volatility3/framework/plugins/windows/malfind.py | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py
index a14f8889d..e5a842611 100644
--- a/volatility3/framework/plugins/windows/malfind.py
+++ b/volatility3/framework/plugins/windows/malfind.py
@@ -140,6 +140,9 @@ class Malfind(interfaces.plugins.PluginInterface):
     def _generator(self, procs):
         # determine if we're on a 32 or 64 bit kernel
         kernel = self.context.modules[self.config["kernel"]]
+        
+        # set refined criteria to know when to add to "Notes" column
+        refined_criteria = [b"MZ", b"\x55\x8B", b"\x55\x48", b"\x55\x89"]
 
         is_32bit_arch = not symbols.symbol_table_is_64bit(
             self.context, kernel.symbol_table_name
@@ -154,12 +157,12 @@ class Malfind(interfaces.plugins.PluginInterface):
                 self.context, kernel.layer_name, kernel.symbol_table_name, proc
             ):
                 # Check for unique headers and update "Notes" column if criteria is met
-                match data[0:2]:
-                    case b"MZ" | b"\x55\x8B":
+                if data[0:2] in refined_criteria:
+                    if data[0:2] == b"MZ":
                         notes = "MZ header"
-                    case b"\x55\x8B":
+                    elif data[0:2] == b"\x55\x8B":
                         notes = "PE header"
-                    case b"\x55\x48" | b"\x55\x89":
+                    else:
                         notes = "Function prologue"
 
                 # if we're on a 64 bit kernel, we may still need 32 bit disasm due to wow64

From ef36cb5a6c6a30f0bc986cc275c83a734b9d535b Mon Sep 17 00:00:00 2001
From: hsarkey <hsarkey@volexity.com>
Date: Wed, 17 Jan 2024 17:51:27 -0500
Subject: [PATCH 14/34] Updated windows.malfind to have a "Notes" column to
 indicate if a process meets "refined" criteria, which includes common headers
 like MZ,PE or function prologues. Fixed black formatting issue.

---
 volatility3/framework/plugins/windows/malfind.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py
index e5a842611..284144077 100644
--- a/volatility3/framework/plugins/windows/malfind.py
+++ b/volatility3/framework/plugins/windows/malfind.py
@@ -140,7 +140,7 @@ class Malfind(interfaces.plugins.PluginInterface):
     def _generator(self, procs):
         # determine if we're on a 32 or 64 bit kernel
         kernel = self.context.modules[self.config["kernel"]]
-        
+
         # set refined criteria to know when to add to "Notes" column
         refined_criteria = [b"MZ", b"\x55\x8B", b"\x55\x48", b"\x55\x89"]
 
@@ -150,7 +150,7 @@ class Malfind(interfaces.plugins.PluginInterface):
 
         for proc in procs:
             # by default, "Notes" column will be set to none
-            notes = "None" 
+            notes = "None"
             process_name = utility.array_to_string(proc.ImageFileName)
 
             for vad, data in self.list_injections(

From a50ebb6014ff11ea165454e0a08b967d01cce9e8 Mon Sep 17 00:00:00 2001
From: Calvin Kusek <ckusek@volexity.com>
Date: Tue, 2 Jan 2024 12:00:41 -0500
Subject: [PATCH 15/34] Windows: Display additional process info for
 windows.pstree

---
 .../framework/plugins/windows/pstree.py       | 24 ++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/volatility3/framework/plugins/windows/pstree.py b/volatility3/framework/plugins/windows/pstree.py
index a39fe7485..2be96277c 100644
--- a/volatility3/framework/plugins/windows/pstree.py
+++ b/volatility3/framework/plugins/windows/pstree.py
@@ -5,7 +5,7 @@ import datetime
 import logging
 from typing import Callable, Dict, Set, Tuple
 
-from volatility3.framework import objects, interfaces, renderers
+from volatility3.framework import objects, interfaces, renderers, exceptions
 from volatility3.framework.configuration import requirements
 from volatility3.framework.renderers import format_hints
 from volatility3.plugins.windows import pslist
@@ -132,6 +132,25 @@ class PsTree(interfaces.plugins.PluginInterface):
                 proc.get_exit_time(),
             )
 
+            try:
+                audit = proc.SeAuditProcessCreationInfo.ImageFileName.Name
+                # If 'audit' is set to the empty string, display NotAvailableValue
+                row += (audit.get_string() or renderers.NotAvailableValue(),)
+            except exceptions.InvalidAddressException:
+                row += (renderers.NotAvailableValue(),)
+
+            try:
+                process_params = proc.get_peb().ProcessParameters
+                row += (
+                    process_params.CommandLine.get_string(),
+                    process_params.ImagePathName.get_string(),
+                )
+            except exceptions.InvalidAddressException:
+                row += (
+                    renderers.NotAvailableValue(),
+                    renderers.NotAvailableValue(),
+                )
+
             yield (self._levels[pid] - 1, row)
             for child_pid in self._children.get(pid, []):
                 yield from yield_processes(
@@ -161,6 +180,9 @@ class PsTree(interfaces.plugins.PluginInterface):
                 ("Wow64", bool),
                 ("CreateTime", datetime.datetime),
                 ("ExitTime", datetime.datetime),
+                ("Audit", str),
+                ("Cmd", str),
+                ("Path", str),
             ],
             self._generator(
                 filter_func=pslist.PsList.create_pid_filter(

From ae5375a622c82177f6b29adfb8b0f410ecb03059 Mon Sep 17 00:00:00 2001
From: Brandon Barnacle <bbarnacle@volexity.com>
Date: Wed, 17 Jan 2024 09:49:39 -0500
Subject: [PATCH 16/34] PR comment changes

Change the --regex flag to --filter. Add a check so that --filter
cannot be used with --physaddr or --virtaddr. Change
self.config["filter"] check to check if file_re has been set.
---
 .../framework/plugins/windows/dumpfiles.py    | 21 +++++++++++--------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py
index 4aef660da..8865007d8 100755
--- a/volatility3/framework/plugins/windows/dumpfiles.py
+++ b/volatility3/framework/plugins/windows/dumpfiles.py
@@ -55,11 +55,11 @@ class DumpFiles(interfaces.plugins.PluginInterface):
                 optional=True,
             ),
             requirements.StringRequirement(
-                name="regex", description="Dump files matching REGEX", optional=True
+                name="filter", description="Dump files matching regular expression FILTER", optional=True
             ),
             requirements.BooleanRequirement(
                 name="ignore-case",
-                description="Ignore case in pattern match",
+                description="Ignore case in filter match",
                 default=False,
                 optional=True,
             ),
@@ -218,11 +218,11 @@ class DumpFiles(interfaces.plugins.PluginInterface):
 
     def _generator(self, procs: List, offsets: List):
         kernel = self.context.modules[self.config["kernel"]]
-        if self.config["regex"]:
-            if self.config["ignore-case"]:
-                file_re = re.compile(self.config["regex"], re.I)
-            else:
-                file_re = re.compile(self.config["regex"])
+        file_re = None
+        if self.config["filter"]:
+            flags = re.I if self.config["ignore-case"] else 0
+            file_re = re.compile(self.config["filter"], flags)
+
 
         if procs:
             # The handles plugin doesn't expose any staticmethod/classmethod, and it also requires stashing
@@ -259,7 +259,7 @@ class DumpFiles(interfaces.plugins.PluginInterface):
                         if obj_type == "File":
                             file_obj = entry.Body.cast("_FILE_OBJECT")
 
-                            if self.config["regex"]:
+                            if file_re:
                                 name = file_obj.file_name_with_device()
                                 if isinstance(name, UnreadableValue):
                                     continue
@@ -295,7 +295,7 @@ class DumpFiles(interfaces.plugins.PluginInterface):
                         if not file_obj.is_valid():
                             continue
 
-                        if self.config["regex"]:
+                        if file_re:
                             name = file_obj.file_name_with_device()
                             if isinstance(name, UnreadableValue):
                                 continue
@@ -345,6 +345,9 @@ class DumpFiles(interfaces.plugins.PluginInterface):
         procs = list()
         kernel = self.context.modules[self.config["kernel"]]
 
+        if self.config["filter"] and (self.config["virtaddr"] or self.config["physaddr"]):
+            raise ValueError("Cannot use filter flag with an address flag")
+
         if self.config.get("virtaddr", None) is not None:
             offsets.append((self.config["virtaddr"], True))
         elif self.config.get("physaddr", None) is not None:

From 4dc6f637b055f912bafaa9f6079759539277d60f Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sun, 28 Jan 2024 23:50:45 +0000
Subject: [PATCH 17/34] Core: Apply black 24.1.0 to the whole codebase

---
 volatility3/cli/text_renderer.py              |  8 +++---
 volatility3/framework/__init__.py             |  6 ++---
 volatility3/framework/automagic/mac.py        |  6 ++---
 volatility3/framework/automagic/module.py     |  6 ++---
 .../framework/automagic/symbol_finder.py      | 12 ++++-----
 volatility3/framework/automagic/windows.py    | 20 +++++++-------
 .../framework/configuration/requirements.py   |  6 ++---
 volatility3/framework/layers/avml.py          |  6 ++---
 volatility3/framework/layers/elf.py           |  6 ++---
 volatility3/framework/layers/intel.py         |  6 ++---
 volatility3/framework/layers/lime.py          |  6 ++---
 volatility3/framework/layers/qemu.py          |  6 ++---
 volatility3/framework/layers/xen.py           |  6 ++---
 volatility3/framework/objects/__init__.py     |  6 ++---
 volatility3/framework/plugins/mac/pslist.py   |  4 +--
 .../framework/plugins/windows/crashinfo.py    |  6 ++---
 .../framework/plugins/windows/mftscan.py      |  1 -
 .../framework/plugins/windows/netscan.py      | 10 ++++---
 .../plugins/windows/registry/printkey.py      |  6 ++---
 volatility3/framework/renderers/conversion.py |  6 ++---
 volatility3/framework/symbols/__init__.py     | 26 +++++++++----------
 .../symbols/windows/extensions/__init__.py    |  6 ++---
 volatility3/plugins/windows/statistics.py     | 10 +++----
 23 files changed, 88 insertions(+), 93 deletions(-)

diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py
index ffb8d516b..6e58ee68d 100644
--- a/volatility3/cli/text_renderer.py
+++ b/volatility3/cli/text_renderer.py
@@ -389,9 +389,11 @@ class JsonRenderer(CLIRenderer):
         interfaces.renderers.Disassembly: quoted_optional(display_disassembly),
         format_hints.MultiTypeData: quoted_optional(multitypedata_as_text),
         bytes: optional(lambda x: " ".join([f"{b:02x}" for b in x])),
-        datetime.datetime: lambda x: x.isoformat()
-        if not isinstance(x, interfaces.renderers.BaseAbsentValue)
-        else None,
+        datetime.datetime: lambda x: (
+            x.isoformat()
+            if not isinstance(x, interfaces.renderers.BaseAbsentValue)
+            else None
+        ),
         "default": lambda x: x,
     }
 
diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py
index 9c17846a8..1565b2267 100644
--- a/volatility3/framework/__init__.py
+++ b/volatility3/framework/__init__.py
@@ -206,9 +206,9 @@ def _zipwalk(path: str):
             if not file.is_dir():
                 dirlist = zip_results.get(os.path.dirname(file.filename), [])
                 dirlist.append(os.path.basename(file.filename))
-                zip_results[
-                    os.path.join(path, os.path.dirname(file.filename))
-                ] = dirlist
+                zip_results[os.path.join(path, os.path.dirname(file.filename))] = (
+                    dirlist
+                )
     for value in zip_results:
         yield value, zip_results[value]
 
diff --git a/volatility3/framework/automagic/mac.py b/volatility3/framework/automagic/mac.py
index aa75fbc3d..e51753139 100644
--- a/volatility3/framework/automagic/mac.py
+++ b/volatility3/framework/automagic/mac.py
@@ -138,9 +138,9 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
                 config_path = join("automagic", "MacIntelHelper", new_layer_name)
                 context.config[join(config_path, "memory_layer")] = layer_name
                 context.config[join(config_path, "page_map_offset")] = dtb
-                context.config[
-                    join(config_path, MacSymbolFinder.banner_config_key)
-                ] = str(banner, "latin-1")
+                context.config[join(config_path, MacSymbolFinder.banner_config_key)] = (
+                    str(banner, "latin-1")
+                )
 
                 new_layer = intel.Intel32e(
                     context,
diff --git a/volatility3/framework/automagic/module.py b/volatility3/framework/automagic/module.py
index ee56a040c..ff13db905 100644
--- a/volatility3/framework/automagic/module.py
+++ b/volatility3/framework/automagic/module.py
@@ -34,9 +34,9 @@ class KernelModule(interfaces.automagic.AutomagicInterface):
             return None
         # The requirement is unfulfilled and is a ModuleRequirement
 
-        context.config[
-            interfaces.configuration.path_join(new_config_path, "class")
-        ] = "volatility3.framework.contexts.Module"
+        context.config[interfaces.configuration.path_join(new_config_path, "class")] = (
+            "volatility3.framework.contexts.Module"
+        )
 
         for req in requirement.requirements:
             if (
diff --git a/volatility3/framework/automagic/symbol_finder.py b/volatility3/framework/automagic/symbol_finder.py
index bf1c8ff16..21e594549 100644
--- a/volatility3/framework/automagic/symbol_finder.py
+++ b/volatility3/framework/automagic/symbol_finder.py
@@ -150,12 +150,12 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface):
                 clazz = self.symbol_class
                 # Set the discovered options
                 path_join = interfaces.configuration.path_join
-                context.config[
-                    path_join(config_path, requirement.name, "class")
-                ] = clazz
-                context.config[
-                    path_join(config_path, requirement.name, "isf_url")
-                ] = isf_path
+                context.config[path_join(config_path, requirement.name, "class")] = (
+                    clazz
+                )
+                context.config[path_join(config_path, requirement.name, "isf_url")] = (
+                    isf_path
+                )
                 context.config[
                     path_join(config_path, requirement.name, "symbol_mask")
                 ] = layer.address_mask
diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py
index a8530829b..52296f5ad 100644
--- a/volatility3/framework/automagic/windows.py
+++ b/volatility3/framework/automagic/windows.py
@@ -402,19 +402,19 @@ class WinSwapLayers(interfaces.automagic.AutomagicInterface):
                     if swap_location:
                         context.config[current_layer_path] = current_layer_name
                         try:
-                            context.config[
-                                layer_loc_path
-                            ] = requirements.URIRequirement.location_from_file(
-                                swap_location
+                            context.config[layer_loc_path] = (
+                                requirements.URIRequirement.location_from_file(
+                                    swap_location
+                                )
                             )
                         except ValueError:
                             vollog.warning(
                                 f"Volatility swap_location {swap_location} could not be validated - swap layer disabled"
                             )
                             continue
-                        context.config[
-                            layer_class_path
-                        ] = "volatility3.framework.layers.physical.FileLayer"
+                        context.config[layer_class_path] = (
+                            "volatility3.framework.layers.physical.FileLayer"
+                        )
 
                     # Add the requirement
                     new_req = requirements.TranslationLayerRequirement(
@@ -424,9 +424,9 @@ class WinSwapLayers(interfaces.automagic.AutomagicInterface):
                     )
                     swap_req.add_requirement(new_req)
 
-                context.config[
-                    path_join(swap_sub_config, "number_of_elements")
-                ] = counter
+                context.config[path_join(swap_sub_config, "number_of_elements")] = (
+                    counter
+                )
                 context.config[swap_sub_config] = True
 
                 swap_req.construct(context, swap_config)
diff --git a/volatility3/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py
index abdffdbe4..1c0622574 100644
--- a/volatility3/framework/configuration/requirements.py
+++ b/volatility3/framework/configuration/requirements.py
@@ -550,9 +550,9 @@ class VersionRequirement(interfaces.configuration.RequirementInterface):
         config_path = interfaces.configuration.path_join(config_path, self.name)
         if not self.matches_required(self._version, self._component.version):
             return {config_path: self}
-        context.config[
-            interfaces.configuration.path_join(config_path, self.name)
-        ] = True
+        context.config[interfaces.configuration.path_join(config_path, self.name)] = (
+            True
+        )
         return {}
 
     @classmethod
diff --git a/volatility3/framework/layers/avml.py b/volatility3/framework/layers/avml.py
index c825464cc..2e5572192 100644
--- a/volatility3/framework/layers/avml.py
+++ b/volatility3/framework/layers/avml.py
@@ -224,7 +224,7 @@ class AVMLStacker(interfaces.automagic.StackerLayerInterface):
         except exceptions.LayerException:
             return None
         new_name = context.layers.free_layer_name("AVMLLayer")
-        context.config[
-            interfaces.configuration.path_join(new_name, "base_layer")
-        ] = layer_name
+        context.config[interfaces.configuration.path_join(new_name, "base_layer")] = (
+            layer_name
+        )
         return AVMLLayer(context, new_name, new_name)
diff --git a/volatility3/framework/layers/elf.py b/volatility3/framework/layers/elf.py
index a10d36592..b2fd6d4d1 100644
--- a/volatility3/framework/layers/elf.py
+++ b/volatility3/framework/layers/elf.py
@@ -115,9 +115,9 @@ class Elf64Stacker(interfaces.automagic.StackerLayerInterface):
             vollog.log(constants.LOGLEVEL_VVVV, f"Exception: {excp}")
             return None
         new_name = context.layers.free_layer_name("Elf64Layer")
-        context.config[
-            interfaces.configuration.path_join(new_name, "base_layer")
-        ] = layer_name
+        context.config[interfaces.configuration.path_join(new_name, "base_layer")] = (
+            layer_name
+        )
 
         try:
             return Elf64Layer(context, new_name, new_name)
diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py
index 7d3b86a12..ae477854d 100644
--- a/volatility3/framework/layers/intel.py
+++ b/volatility3/framework/layers/intel.py
@@ -277,9 +277,9 @@ class Intel(linear.LinearlyMappedLayer):
         This allows translation layers to provide maps of contiguous
         regions in one layer
         """
-        stashed_offset = (
-            stashed_mapped_offset
-        ) = stashed_size = stashed_mapped_size = stashed_map_layer = None
+        stashed_offset = stashed_mapped_offset = stashed_size = stashed_mapped_size = (
+            stashed_map_layer
+        ) = None
         for offset, size, mapped_offset, mapped_size, map_layer in self._mapping(
             offset, length, ignore_errors
         ):
diff --git a/volatility3/framework/layers/lime.py b/volatility3/framework/layers/lime.py
index 28d646640..8b93932ab 100644
--- a/volatility3/framework/layers/lime.py
+++ b/volatility3/framework/layers/lime.py
@@ -104,7 +104,7 @@ class LimeStacker(interfaces.automagic.StackerLayerInterface):
         except LimeFormatException:
             return None
         new_name = context.layers.free_layer_name("LimeLayer")
-        context.config[
-            interfaces.configuration.path_join(new_name, "base_layer")
-        ] = layer_name
+        context.config[interfaces.configuration.path_join(new_name, "base_layer")] = (
+            layer_name
+        )
         return LimeLayer(context, new_name, new_name)
diff --git a/volatility3/framework/layers/qemu.py b/volatility3/framework/layers/qemu.py
index 501b8655e..ff483291c 100644
--- a/volatility3/framework/layers/qemu.py
+++ b/volatility3/framework/layers/qemu.py
@@ -486,9 +486,9 @@ class QemuStacker(interfaces.automagic.StackerLayerInterface):
         except exceptions.LayerException:
             return None
         new_name = context.layers.free_layer_name("QemuSuspendLayer")
-        context.config[
-            interfaces.configuration.path_join(new_name, "base_layer")
-        ] = layer_name
+        context.config[interfaces.configuration.path_join(new_name, "base_layer")] = (
+            layer_name
+        )
         layer = QemuSuspendLayer(context, new_name, new_name)
         cls.stacker_slow_warning()
         return layer
diff --git a/volatility3/framework/layers/xen.py b/volatility3/framework/layers/xen.py
index f7881a091..927b30430 100644
--- a/volatility3/framework/layers/xen.py
+++ b/volatility3/framework/layers/xen.py
@@ -173,8 +173,8 @@ class XenCoreDumpStacker(elf.Elf64Stacker):
             vollog.log(constants.LOGLEVEL_VVVV, f"Exception: {excp}")
             return None
         new_name = context.layers.free_layer_name("XenCoreDumpLayer")
-        context.config[
-            interfaces.configuration.path_join(new_name, "base_layer")
-        ] = layer_name
+        context.config[interfaces.configuration.path_join(new_name, "base_layer")] = (
+            layer_name
+        )
 
         return XenCoreDumpLayer(context, new_name, new_name)
diff --git a/volatility3/framework/objects/__init__.py b/volatility3/framework/objects/__init__.py
index 831856e3d..316a30bec 100644
--- a/volatility3/framework/objects/__init__.py
+++ b/volatility3/framework/objects/__init__.py
@@ -768,12 +768,10 @@ class Array(interfaces.objects.ObjectInterface, collections.abc.Sequence):
             raise IndexError(f"Member not present in array template: {child}")
 
     @overload
-    def __getitem__(self, i: int) -> interfaces.objects.Template:
-        ...
+    def __getitem__(self, i: int) -> interfaces.objects.Template: ...
 
     @overload
-    def __getitem__(self, s: slice) -> List[interfaces.objects.Template]:
-        ...
+    def __getitem__(self, s: slice) -> List[interfaces.objects.Template]: ...
 
     def __getitem__(self, i):
         """Returns the i-th item from the array."""
diff --git a/volatility3/framework/plugins/mac/pslist.py b/volatility3/framework/plugins/mac/pslist.py
index 88045a277..9b570f3f9 100644
--- a/volatility3/framework/plugins/mac/pslist.py
+++ b/volatility3/framework/plugins/mac/pslist.py
@@ -49,9 +49,7 @@ class PsList(interfaces.plugins.PluginInterface):
         ]
 
     @classmethod
-    def get_list_tasks(
-        cls, method: str
-    ) -> Callable[
+    def get_list_tasks(cls, method: str) -> Callable[
         [interfaces.context.ContextInterface, str, Callable[[int], bool]],
         Iterable[interfaces.objects.ObjectInterface],
     ]:
diff --git a/volatility3/framework/plugins/windows/crashinfo.py b/volatility3/framework/plugins/windows/crashinfo.py
index 4ecd85087..862eb6080 100644
--- a/volatility3/framework/plugins/windows/crashinfo.py
+++ b/volatility3/framework/plugins/windows/crashinfo.py
@@ -46,9 +46,9 @@ class Crashinfo(interfaces.plugins.PluginInterface):
             bitmap_size = format_hints.Hex(summary_header.BitmapSize)
             bitmap_pages = format_hints.Hex(summary_header.Pages)
         else:
-            bitmap_header_size = (
-                bitmap_size
-            ) = bitmap_pages = renderers.NotApplicableValue()
+            bitmap_header_size = bitmap_size = bitmap_pages = (
+                renderers.NotApplicableValue()
+            )
 
         yield (
             0,
diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py
index 4298b4e4e..91a2e9152 100644
--- a/volatility3/framework/plugins/windows/mftscan.py
+++ b/volatility3/framework/plugins/windows/mftscan.py
@@ -175,7 +175,6 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
 
 
 class ADS(interfaces.plugins.PluginInterface):
-
     """Scans for Alternate Data Stream"""
 
     _required_framework_version = (2, 0, 0)
diff --git a/volatility3/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py
index d0bbd5cbd..62ead3ab7 100644
--- a/volatility3/framework/plugins/windows/netscan.py
+++ b/volatility3/framework/plugins/windows/netscan.py
@@ -487,10 +487,12 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
             if not isinstance(row_data[9], datetime.datetime):
                 continue
             row_data = [
-                "N/A"
-                if isinstance(i, renderers.UnreadableValue)
-                or isinstance(i, renderers.UnparsableValue)
-                else i
+                (
+                    "N/A"
+                    if isinstance(i, renderers.UnreadableValue)
+                    or isinstance(i, renderers.UnparsableValue)
+                    else i
+                )
                 for i in row_data
             ]
             description = (
diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py
index e248c19bc..180f8f9d9 100644
--- a/volatility3/framework/plugins/windows/registry/printkey.py
+++ b/volatility3/framework/plugins/windows/registry/printkey.py
@@ -193,9 +193,9 @@ class PrintKey(interfaces.plugins.PluginInterface):
                     vollog.debug(
                         "Couldn't read registry value type, so data is unreadable"
                     )
-                    value_data: Union[
-                        interfaces.renderers.BaseAbsentValue, bytes
-                    ] = renderers.UnreadableValue()
+                    value_data: Union[interfaces.renderers.BaseAbsentValue, bytes] = (
+                        renderers.UnreadableValue()
+                    )
                 else:
                     try:
                         value_data = node.decode_data()
diff --git a/volatility3/framework/renderers/conversion.py b/volatility3/framework/renderers/conversion.py
index bf7da9ecb..bb18fcc8a 100644
--- a/volatility3/framework/renderers/conversion.py
+++ b/volatility3/framework/renderers/conversion.py
@@ -28,9 +28,9 @@ def wintime_to_datetime(
 def unixtime_to_datetime(
     unixtime: int,
 ) -> Union[interfaces.renderers.BaseAbsentValue, datetime.datetime]:
-    ret: Union[
-        interfaces.renderers.BaseAbsentValue, datetime.datetime
-    ] = renderers.UnparsableValue()
+    ret: Union[interfaces.renderers.BaseAbsentValue, datetime.datetime] = (
+        renderers.UnparsableValue()
+    )
 
     if unixtime > 0:
         with contextlib.suppress(ValueError):
diff --git a/volatility3/framework/symbols/__init__.py b/volatility3/framework/symbols/__init__.py
index 10cf39cf1..d1e7a104d 100644
--- a/volatility3/framework/symbols/__init__.py
+++ b/volatility3/framework/symbols/__init__.py
@@ -35,9 +35,9 @@ class SymbolSpace(interfaces.symbols.SymbolSpaceInterface):
 
     def __init__(self) -> None:
         super().__init__()
-        self._dict: Dict[
-            str, interfaces.symbols.BaseSymbolTableInterface
-        ] = collections.OrderedDict()
+        self._dict: Dict[str, interfaces.symbols.BaseSymbolTableInterface] = (
+            collections.OrderedDict()
+        )
         # Permanently cache all resolved symbols
         self._resolved: Dict[str, interfaces.objects.Template] = {}
         self._resolved_symbols: Dict[str, interfaces.objects.Template] = {}
@@ -73,9 +73,9 @@ class SymbolSpace(interfaces.symbols.SymbolSpaceInterface):
         self, offset: int, size: int = 0, table_name: str = None
     ) -> Iterable[str]:
         """Returns all symbols that exist at a specific relative address."""
-        table_list: Iterable[
-            interfaces.symbols.BaseSymbolTableInterface
-        ] = self._dict.values()
+        table_list: Iterable[interfaces.symbols.BaseSymbolTableInterface] = (
+            self._dict.values()
+        )
         if table_name is not None:
             if table_name in self._dict:
                 table_list = [self._dict[table_name]]
@@ -179,15 +179,15 @@ class SymbolSpace(interfaces.symbols.SymbolSpaceInterface):
                         if child.vol.type_name not in self._resolved:
                             traverse_list.append(child.vol.type_name)
                             try:
-                                self._resolved[
-                                    child.vol.type_name
-                                ] = self._weak_resolve(
-                                    SymbolType.TYPE, child.vol.type_name
+                                self._resolved[child.vol.type_name] = (
+                                    self._weak_resolve(
+                                        SymbolType.TYPE, child.vol.type_name
+                                    )
                                 )
                             except exceptions.SymbolError:
-                                self._resolved[
-                                    child.vol.type_name
-                                ] = self.UnresolvedTemplate(child.vol.type_name)
+                                self._resolved[child.vol.type_name] = (
+                                    self.UnresolvedTemplate(child.vol.type_name)
+                                )
                         # Stash the replacement
                         replacements.add((traverser, child))
                     elif child.children:
diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py
index d435851d7..846e5bd90 100755
--- a/volatility3/framework/symbols/windows/extensions/__init__.py
+++ b/volatility3/framework/symbols/windows/extensions/__init__.py
@@ -452,9 +452,9 @@ class FILE_OBJECT(objects.StructType, pool.ExecutiveObject):
         ].is_valid(self.FileName.Buffer)
 
     def file_name_with_device(self) -> Union[str, interfaces.renderers.BaseAbsentValue]:
-        name: Union[
-            str, interfaces.renderers.BaseAbsentValue
-        ] = renderers.UnreadableValue()
+        name: Union[str, interfaces.renderers.BaseAbsentValue] = (
+            renderers.UnreadableValue()
+        )
 
         # this pointer needs to be checked against native_layer_name because the object may
         # be instantiated from a primary (virtual) layer or a memory (physical) layer.
diff --git a/volatility3/plugins/windows/statistics.py b/volatility3/plugins/windows/statistics.py
index 9915312e3..7f56b75f8 100644
--- a/volatility3/plugins/windows/statistics.py
+++ b/volatility3/plugins/windows/statistics.py
@@ -31,13 +31,9 @@ class Statistics(plugins.PluginInterface):
         # Do mass mapping and determine the number of different layers and how many pages go to each one
         layer = self.context.layers[self.config["primary"]]
 
-        page_count = (
-            swap_count
-        ) = (
-            invalid_page_count
-        ) = (
-            large_page_count
-        ) = large_swap_count = large_invalid_count = other_invalid = 0
+        page_count = swap_count = invalid_page_count = large_page_count = (
+            large_swap_count
+        ) = large_invalid_count = other_invalid = 0
 
         if isinstance(layer, intel.Intel):
             page_addr = 0

From 497d291ef4393e2580052a3dfddbef10e4dc2338 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Mon, 29 Jan 2024 00:07:40 +0000
Subject: [PATCH 18/34] Windows: Fix black on dumpfiles

---
 volatility3/framework/plugins/windows/dumpfiles.py | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py
index 8865007d8..48539c752 100755
--- a/volatility3/framework/plugins/windows/dumpfiles.py
+++ b/volatility3/framework/plugins/windows/dumpfiles.py
@@ -55,7 +55,9 @@ class DumpFiles(interfaces.plugins.PluginInterface):
                 optional=True,
             ),
             requirements.StringRequirement(
-                name="filter", description="Dump files matching regular expression FILTER", optional=True
+                name="filter",
+                description="Dump files matching regular expression FILTER",
+                optional=True,
             ),
             requirements.BooleanRequirement(
                 name="ignore-case",
@@ -223,7 +225,6 @@ class DumpFiles(interfaces.plugins.PluginInterface):
             flags = re.I if self.config["ignore-case"] else 0
             file_re = re.compile(self.config["filter"], flags)
 
-
         if procs:
             # The handles plugin doesn't expose any staticmethod/classmethod, and it also requires stashing
             # private variables, so we need an instance (for now, anyway). We _could_ call Handles._generator()
@@ -345,7 +346,9 @@ class DumpFiles(interfaces.plugins.PluginInterface):
         procs = list()
         kernel = self.context.modules[self.config["kernel"]]
 
-        if self.config["filter"] and (self.config["virtaddr"] or self.config["physaddr"]):
+        if self.config["filter"] and (
+            self.config["virtaddr"] or self.config["physaddr"]
+        ):
             raise ValueError("Cannot use filter flag with an address flag")
 
         if self.config.get("virtaddr", None) is not None:

From 837d3b7b9fce65d5ef6543b6db9ecbad5092d4b0 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Thu, 14 Dec 2023 13:47:00 -0600
Subject: [PATCH 19/34] Windows: Add parsing of service binary/dll

Parses the binary or dll associated with each service from the Windows
SYSTEM hive and includes it in the output for each service.
---
 .../framework/plugins/windows/svcscan.py      | 139 +++++++++++++++++-
 1 file changed, 133 insertions(+), 6 deletions(-)

diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py
index 60562915e..720f745d8 100644
--- a/volatility3/framework/plugins/windows/svcscan.py
+++ b/volatility3/framework/plugins/windows/svcscan.py
@@ -4,20 +4,30 @@
 
 import logging
 import os
-from typing import List
+from typing import Dict, List, NamedTuple, Union
 
-from volatility3.framework import interfaces, renderers, constants, symbols, exceptions
+from volatility3.framework import constants, exceptions, interfaces, renderers, symbols
 from volatility3.framework.configuration import requirements
 from volatility3.framework.layers import scanners
 from volatility3.framework.renderers import format_hints
 from volatility3.framework.symbols import intermed
 from volatility3.framework.symbols.windows import versions
 from volatility3.framework.symbols.windows.extensions import services
-from volatility3.plugins.windows import poolscanner, vadyarascan, pslist
+from volatility3.plugins.windows import poolscanner, pslist, vadyarascan
+from volatility3.plugins.windows.registry import hivelist
 
 vollog = logging.getLogger(__name__)
 
 
+ServiceBinaryInfo = NamedTuple(
+    "ServiceBinaryInfo",
+    [
+        ("dll", Union[str, interfaces.renderers.BaseAbsentValue]),
+        ("binary", Union[str, interfaces.renderers.BaseAbsentValue]),
+    ],
+)
+
+
 class SvcScan(interfaces.plugins.PluginInterface):
     """Scans for windows services."""
 
@@ -42,10 +52,16 @@ class SvcScan(interfaces.plugins.PluginInterface):
             requirements.PluginRequirement(
                 name="vadyarascan", plugin=vadyarascan.VadYaraScan, version=(1, 0, 0)
             ),
+            requirements.PluginRequirement(
+                name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0)
+            ),
         ]
 
     @staticmethod
-    def get_record_tuple(service_record: interfaces.objects.ObjectInterface):
+    def get_record_tuple(
+        service_record: interfaces.objects.ObjectInterface,
+        binary_info: ServiceBinaryInfo,
+    ):
         return (
             format_hints.Hex(service_record.vol.offset),
             service_record.Order,
@@ -56,6 +72,8 @@ class SvcScan(interfaces.plugins.PluginInterface):
             service_record.get_name(),
             service_record.get_display(),
             service_record.get_binary(),
+            binary_info.binary,
+            binary_info.dll,
         )
 
     @staticmethod
@@ -150,6 +168,86 @@ class SvcScan(interfaces.plugins.PluginInterface):
             native_types=native_types,
         )
 
+    def _get_service_key(self, kernel):
+        for hive in hivelist.HiveList.list_hives(
+            context=self.context,
+            base_config_path=self.config_path,
+            layer_name=kernel.layer_name,
+            symbol_table=kernel.symbol_table_name,
+            filter_string="machine\\system",
+            hive_offsets=None,
+        ):
+            # Get ControlSet\Services.
+            try:
+                return hive.get_key(r"CurrentControlSet\Services")
+            except (KeyError, exceptions.InvalidAddressException):
+                try:
+                    return hive.get_key(r"ControlSet001\Services")
+                except (KeyError, exceptions.InvalidAddressException):
+                    pass
+
+            return None
+
+    @staticmethod
+    def _get_service_dll(
+        service_key,
+    ) -> Union[str, interfaces.renderers.BaseAbsentValue]:
+        try:
+            param_key = next(
+                key
+                for key in service_key.get_subkeys()
+                if key.get_name() == "Parameters"
+            )
+            return (
+                next(
+                    val
+                    for val in param_key.get_values()
+                    if val.get_name() == "ServiceDll"
+                )
+                .decode_data()
+                .decode("utf-16")
+                .rstrip("\x00")
+            )
+
+        except UnicodeDecodeError:
+            return renderers.UnparsableValue()
+        except StopIteration:
+            return renderers.UnreadableValue()
+
+    @staticmethod
+    def _get_service_binary(
+        service_key,
+    ) -> Union[str, interfaces.renderers.BaseAbsentValue]:
+        try:
+            return (
+                next(
+                    val
+                    for val in service_key.get_values()
+                    if val.get_name() == "ImagePath"
+                )
+                .decode_data()
+                .decode("utf-16")
+                .rstrip("\x00")
+            )
+
+        except UnicodeDecodeError:
+            return renderers.UnparsableValue()
+        except StopIteration:
+            return renderers.UnreadableValue()
+
+    @staticmethod
+    def _get_service_binary_map(
+        services_key: interfaces.objects.ObjectInterface,
+    ) -> Dict[str, ServiceBinaryInfo]:
+        services = services_key.get_subkeys()
+        return {
+            service_key.get_name(): ServiceBinaryInfo(
+                SvcScan._get_service_dll(service_key),
+                SvcScan._get_service_binary(service_key),
+            )
+            for service_key in services
+        }
+
     def _generator(self):
         kernel = self.context.modules[self.config["kernel"]]
 
@@ -157,6 +255,15 @@ class SvcScan(interfaces.plugins.PluginInterface):
             self.context, kernel.symbol_table_name, self.config_path
         )
 
+        # Building the dictionary ahead of time is much better for performance
+        # vs looking up each service's DLL individually.
+        services_key = self._get_service_key(kernel)
+        service_binary_dll_map = (
+            self._get_service_binary_map(services_key)
+            if services_key is not None
+            else {}
+        )
+
         relative_tag_offset = self.context.symbol_space.get_type(
             service_table_name + constants.BANG + "_SERVICE_RECORD"
         ).relative_child_offset("Tag")
@@ -209,7 +316,16 @@ class SvcScan(interfaces.plugins.PluginInterface):
                     if not service_record.is_valid():
                         continue
 
-                    yield (0, self.get_record_tuple(service_record))
+                    service_info = service_binary_dll_map.get(
+                        service_record.get_name(),
+                        ServiceBinaryInfo(
+                            renderers.UnreadableValue(), renderers.UnreadableValue()
+                        ),
+                    )
+                    yield (
+                        0,
+                        self.get_record_tuple(service_record, service_info),
+                    )
                 else:
                     service_header = self.context.object(
                         service_table_name + constants.BANG + "_SERVICE_HEADER",
@@ -227,7 +343,16 @@ class SvcScan(interfaces.plugins.PluginInterface):
                         if service_record in seen:
                             break
                         seen.append(service_record)
-                        yield (0, self.get_record_tuple(service_record))
+                        service_info = service_binary_dll_map.get(
+                            service_record.get_name(),
+                            ServiceBinaryInfo(
+                                renderers.UnreadableValue(), renderers.UnreadableValue()
+                            ),
+                        )
+                        yield (
+                            0,
+                            self.get_record_tuple(service_record, service_info),
+                        )
 
     def run(self):
         return renderers.TreeGrid(
@@ -241,6 +366,8 @@ class SvcScan(interfaces.plugins.PluginInterface):
                 ("Name", str),
                 ("Display", str),
                 ("Binary", str),
+                ("Binary (Registry)", str),
+                ("Dll", str),
             ],
             self._generator(),
         )

From 77b01106356ab30ec531799a66d38db3951033c4 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Thu, 14 Dec 2023 14:16:40 -0600
Subject: [PATCH 20/34] Windows: Fixes svc symbols and OS version detection

There were some changes made to the service structures between certain
versions of Windows that caused the PID/binary path to fail to parse
across quite a few samples. This adds the appropriate version detection
logic and updated symbol files to ensure that services are parsed
correctly across Windows versions.
---
 volatility3/framework/interfaces/context.py   |   2 +-
 .../framework/plugins/windows/svcscan.py      |  50 +++-
 .../services/services-win10-17763-x86.json    | 248 +++++++++++++++++
 .../services/services-win10-18362-x64.json    | 255 ++++++++++++++++++
 .../services/services-win10-18362-x86.json    | 248 +++++++++++++++++
 .../services/services-win10-19041-x64.json    | 255 ++++++++++++++++++
 .../services/services-win10-19041-x86.json    | 248 +++++++++++++++++
 .../services/services-win10-25398-x64.json    | 255 ++++++++++++++++++
 .../framework/symbols/windows/versions.py     |  34 +++
 9 files changed, 1584 insertions(+), 11 deletions(-)
 create mode 100644 volatility3/framework/symbols/windows/services/services-win10-17763-x86.json
 create mode 100644 volatility3/framework/symbols/windows/services/services-win10-18362-x64.json
 create mode 100644 volatility3/framework/symbols/windows/services/services-win10-18362-x86.json
 create mode 100644 volatility3/framework/symbols/windows/services/services-win10-19041-x64.json
 create mode 100644 volatility3/framework/symbols/windows/services/services-win10-19041-x86.json
 create mode 100644 volatility3/framework/symbols/windows/services/services-win10-25398-x64.json

diff --git a/volatility3/framework/interfaces/context.py b/volatility3/framework/interfaces/context.py
index 29cb41379..a95f2b464 100644
--- a/volatility3/framework/interfaces/context.py
+++ b/volatility3/framework/interfaces/context.py
@@ -87,7 +87,7 @@ class ContextInterface(metaclass=ABCMeta):
         offset: int,
         native_layer_name: str = None,
         **arguments,
-    ):
+    ) -> "interfaces.objects.ObjectInterface":
         """Object factory, takes a context, symbol, offset and optional
         layer_name.
 
diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py
index 720f745d8..74fe2d802 100644
--- a/volatility3/framework/plugins/windows/svcscan.py
+++ b/volatility3/framework/plugins/windows/svcscan.py
@@ -106,26 +106,46 @@ class SvcScan(interfaces.plugins.PluginInterface):
             and is_64bit
         ):
             symbol_filename = "services-xp-2003-x64"
+        elif (
+            versions.is_win10_25398_or_later(context=context, symbol_table=symbol_table)
+            and is_64bit
+        ):
+            symbol_filename = "services-win10-25398-x64"
+        elif (
+            versions.is_win10_19041_or_later(context=context, symbol_table=symbol_table)
+            and is_64bit
+        ):
+            symbol_filename = "services-win10-19041-x64"
+        elif (
+            versions.is_win10_19041_or_later(context=context, symbol_table=symbol_table)
+            and not is_64bit
+        ):
+            symbol_filename = "services-win10-19041-x86"
+        elif (
+            versions.is_win10_18362_or_later(context=context, symbol_table=symbol_table)
+            and is_64bit
+        ):
+            symbol_filename = "services-win10-18362-x64"
+        elif (
+            versions.is_win10_18362_or_later(context=context, symbol_table=symbol_table)
+            and not is_64bit
+        ):
+            symbol_filename = "services-win10-18362-x86"
         elif (
             versions.is_win10_16299_or_later(context=context, symbol_table=symbol_table)
             and is_64bit
         ):
             symbol_filename = "services-win10-16299-x64"
+        elif (
+            versions.is_win10_17763_or_later(context=context, symbol_table=symbol_table)
+            and not is_64bit
+        ):
+            symbol_filename = "services-win10-17763-x86"
         elif (
             versions.is_win10_16299_or_later(context=context, symbol_table=symbol_table)
             and not is_64bit
         ):
             symbol_filename = "services-win10-16299-x86"
-        elif (
-            versions.is_win10_up_to_15063(context=context, symbol_table=symbol_table)
-            and is_64bit
-        ):
-            symbol_filename = "services-win8-x64"
-        elif (
-            versions.is_win10_up_to_15063(context=context, symbol_table=symbol_table)
-            and not is_64bit
-        ):
-            symbol_filename = "services-win8-x86"
         elif (
             versions.is_win10_15063(context=context, symbol_table=symbol_table)
             and is_64bit
@@ -136,6 +156,16 @@ class SvcScan(interfaces.plugins.PluginInterface):
             and not is_64bit
         ):
             symbol_filename = "services-win10-15063-x86"
+        elif (
+            versions.is_win10_up_to_15063(context=context, symbol_table=symbol_table)
+            and is_64bit
+        ):
+            symbol_filename = "services-win8-x64"
+        elif (
+            versions.is_win10_up_to_15063(context=context, symbol_table=symbol_table)
+            and not is_64bit
+        ):
+            symbol_filename = "services-win8-x86"
         elif (
             versions.is_windows_8_or_later(context=context, symbol_table=symbol_table)
             and is_64bit
diff --git a/volatility3/framework/symbols/windows/services/services-win10-17763-x86.json b/volatility3/framework/symbols/windows/services/services-win10-17763-x86.json
new file mode 100644
index 000000000..8f2854721
--- /dev/null
+++ b/volatility3/framework/symbols/windows/services/services-win10-17763-x86.json
@@ -0,0 +1,248 @@
+{
+    "symbols": {}, 
+    "enums": {
+        "StateEnum": {
+            "base": "long", 
+            "constants": {
+                "SERVICE_START_PENDING": 2, 
+                "SERVICE_STOP_PENDING": 3, 
+                "SERVICE_STOPPED": 1, 
+                "SERVICE_CONTINUE_PENDING": 5, 
+                "SERVICE_PAUSE_PENDING": 6, 
+                "SERVICE_PAUSED": 7, 
+                "SERVICE_RUNNING": 4
+            }, 
+            "size": 4
+        }, 
+        "StartEnum": {
+            "base": "long", 
+            "constants": {
+                "SERVICE_DEMAND_START": 3, 
+                "SERVICE_AUTO_START": 2, 
+                "SERVICE_BOOT_START": 0, 
+                "SERVICE_DISABLED": 4, 
+                "SERVICE_SYSTEM_START": 1
+            }, 
+            "size": 4
+        }
+    }, 
+    "base_types": {
+        "unsigned long": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "unsigned char": {
+            "kind": "char", 
+            "size": 1, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "pointer": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "unsigned int": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        },
+        "unsigned short": {
+            "kind": "int",
+            "size": 2,
+            "signed": false,
+            "endian": "little"
+        },
+        "long": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        }
+    }, 
+    "user_types": {
+        "_SERVICE_LIST_ENTRY": {
+            "fields": {
+                "Flink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 4
+                }, 
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_LIST_ENTRY"
+                        }
+                    }, 
+                    "offset": 0
+                }
+            }, 
+            "kind": "struct", 
+            "size": 8
+        }, 
+        "_SERVICE_PROCESS": {
+            "fields": {
+                "BinaryPath": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 12
+                }, 
+                "ProcessId": {
+                    "type": {
+                        "kind": "base", 
+                        "name": "unsigned int"
+                    }, 
+                    "offset": 20
+                }
+            }, 
+            "kind": "struct", 
+            "size": 20
+        }, 
+        "_SERVICE_HEADER": {
+            "fields": {
+                "Tag": {
+                    "type": {
+                        "count": 4, 
+                        "subtype": {
+                            "kind": "base", 
+                            "name": "unsigned char"
+                        }, 
+                        "kind": "array"
+                    }, 
+                    "offset": 0
+                }, 
+                "ServiceRecord": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_RECORD"
+                        }
+                    }, 
+                    "offset": 12
+                }
+            }, 
+            "kind": "struct", 
+            "size": 12
+        }, 
+        "_SERVICE_RECORD": {
+            "fields": {
+                "DisplayName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 48
+                }, 
+                "ServiceProcess": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_PROCESS"
+                        }
+                    },
+                    "offset": 160
+                }, 
+                "PrevEntry": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_RECORD"
+                        }
+                    },
+                    "offset": 12
+                }, 
+                "Start": {
+                    "type": {
+                        "kind": "enum", 
+                        "name": "StartEnum"
+                    }, 
+                    "offset": 24
+                }, 
+                "State": {
+                    "type": {
+                        "kind": "enum", 
+                        "name": "StateEnum"
+                    }, 
+                    "offset": 56
+                }, 
+                "ServiceName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    }, 
+                    "offset": 44
+                },
+                "Tag": {
+                    "type": {
+                        "count": 4,
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned char"
+                        },
+                        "kind": "array"
+                    },
+                    "offset": 0
+                },
+                "DriverName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 160
+                }, 
+                "Type": {
+                    "type": {
+                        "kind": "base", 
+                        "name": "unsigned long"
+                    }, 
+                    "offset": 52
+                }, 
+                "Order": {
+                    "type": {
+                        "kind": "base", 
+                        "name": "unsigned int"
+                    }, 
+                    "offset": 20
+                }
+            }, 
+            "kind": "struct", 
+            "size": 156
+        }
+    }, 
+    "metadata": {
+        "producer": {
+            "version": "0.0.1", 
+            "name": "vtypes_to_json.py", 
+            "datetime": "2019-04-17T13:45:16.417006"
+        }, 
+        "format": "4.1.0"
+    }
+}
diff --git a/volatility3/framework/symbols/windows/services/services-win10-18362-x64.json b/volatility3/framework/symbols/windows/services/services-win10-18362-x64.json
new file mode 100644
index 000000000..a6a80c1d3
--- /dev/null
+++ b/volatility3/framework/symbols/windows/services/services-win10-18362-x64.json
@@ -0,0 +1,255 @@
+{
+    "symbols": {}, 
+    "enums": {
+        "StateEnum": {
+            "base": "long", 
+            "constants": {
+                "SERVICE_START_PENDING": 2, 
+                "SERVICE_STOP_PENDING": 3, 
+                "SERVICE_STOPPED": 1, 
+                "SERVICE_CONTINUE_PENDING": 5, 
+                "SERVICE_PAUSE_PENDING": 6, 
+                "SERVICE_PAUSED": 7, 
+                "SERVICE_RUNNING": 4
+            }, 
+            "size": 4
+        }, 
+        "StartEnum": {
+            "base": "long", 
+            "constants": {
+                "SERVICE_DEMAND_START": 3, 
+                "SERVICE_AUTO_START": 2, 
+                "SERVICE_BOOT_START": 0, 
+                "SERVICE_DISABLED": 4, 
+                "SERVICE_SYSTEM_START": 1
+            }, 
+            "size": 4
+        }
+    }, 
+    "base_types": {
+        "unsigned long": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "unsigned char": {
+            "kind": "char", 
+            "size": 1, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "pointer": {
+            "kind": "int", 
+            "size": 8, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "unsigned int": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        },
+        "unsigned short": {
+            "kind": "int",
+            "size": 2,
+            "signed": false,
+            "endian": "little"
+        },
+        "long": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        }
+    }, 
+    "user_types": {
+        "_SERVICE_LIST_ENTRY": {
+            "fields": {
+                "Flink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_LIST_ENTRY"
+                        }
+                    }, 
+                    "offset": 16
+                }, 
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_LIST_ENTRY"
+                        }
+                    }, 
+                    "offset": 0
+                }
+            }, 
+            "kind": "struct", 
+            "size": 16
+        }, 
+        "_SERVICE_PROCESS": {
+            "fields": {
+                "BinaryPath": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 24
+                }, 
+                "ProcessId": {
+                    "type": {
+                        "kind": "base", 
+                        "name": "unsigned int"
+                    }, 
+                    "offset": 40
+                }
+            }, 
+            "kind": "struct", 
+            "size": 40
+        }, 
+        "_SERVICE_HEADER": {
+            "fields": {
+                "Tag": {
+                    "type": {
+                        "count": 4, 
+                        "subtype": {
+                            "kind": "base", 
+                            "name": "unsigned char"
+                        }, 
+                        "kind": "array"
+                    }, 
+                    "offset": 0
+                }, 
+                "ServiceRecord": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_RECORD"
+                        }
+                    },
+                    "offset": 16
+                }
+            }, 
+            "kind": "struct", 
+            "size": 16
+        }, 
+        "_SERVICE_RECORD": {
+            "fields": {
+                "ServiceList": {
+                    "type": {
+                        "kind": "struct", 
+                        "name": "_SERVICE_LIST_ENTRY"
+                    }, 
+                    "offset": 0
+                }, 
+                "Tag": {
+                    "type": {
+                        "count": 4, 
+                        "subtype": {
+                            "kind": "base", 
+                            "name": "unsigned char"
+                        }, 
+                        "kind": "array"
+                    }, 
+                    "offset": 32
+                }, 
+                "DisplayName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 64
+                }, 
+                "ServiceProcess": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_PROCESS"
+                        }
+                    },
+                    "offset": 240
+                }, 
+                "PrevEntry": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_RECORD"
+                        }
+                    },
+                    "offset": 16
+                }, 
+                "Start": {
+                    "type": {
+                        "kind": "enum", 
+                        "name": "StartEnum"
+                    }, 
+                    "offset": 36
+                }, 
+                "State": {
+                    "type": {
+                        "kind": "enum", 
+                        "name": "StateEnum"
+                    }, 
+                    "offset": 76
+                }, 
+                "ServiceName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 56
+                }, 
+                "DriverName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 240
+                }, 
+                "Type": {
+                    "type": {
+                        "kind": "base", 
+                        "name": "unsigned long"
+                    }, 
+                    "offset": 72
+                }, 
+                "Order": {
+                    "type": {
+                        "kind": "base", 
+                        "name": "unsigned int"
+                    }, 
+                    "offset": 32
+                }
+            }, 
+            "kind": "struct", 
+            "size": 248
+        }
+    }, 
+    "metadata": {
+        "producer": {
+            "version": "0.0.1", 
+            "name": "vtypes_to_json.py", 
+            "datetime": "2019-04-17T13:45:16.417006"
+        }, 
+        "format": "4.1.0"
+    }
+}
diff --git a/volatility3/framework/symbols/windows/services/services-win10-18362-x86.json b/volatility3/framework/symbols/windows/services/services-win10-18362-x86.json
new file mode 100644
index 000000000..4684dfe5b
--- /dev/null
+++ b/volatility3/framework/symbols/windows/services/services-win10-18362-x86.json
@@ -0,0 +1,248 @@
+{
+    "symbols": {}, 
+    "enums": {
+        "StateEnum": {
+            "base": "long", 
+            "constants": {
+                "SERVICE_START_PENDING": 2, 
+                "SERVICE_STOP_PENDING": 3, 
+                "SERVICE_STOPPED": 1, 
+                "SERVICE_CONTINUE_PENDING": 5, 
+                "SERVICE_PAUSE_PENDING": 6, 
+                "SERVICE_PAUSED": 7, 
+                "SERVICE_RUNNING": 4
+            }, 
+            "size": 4
+        }, 
+        "StartEnum": {
+            "base": "long", 
+            "constants": {
+                "SERVICE_DEMAND_START": 3, 
+                "SERVICE_AUTO_START": 2, 
+                "SERVICE_BOOT_START": 0, 
+                "SERVICE_DISABLED": 4, 
+                "SERVICE_SYSTEM_START": 1
+            }, 
+            "size": 4
+        }
+    }, 
+    "base_types": {
+        "unsigned long": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "unsigned char": {
+            "kind": "char", 
+            "size": 1, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "pointer": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "unsigned int": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        },
+        "unsigned short": {
+            "kind": "int",
+            "size": 2,
+            "signed": false,
+            "endian": "little"
+        },
+        "long": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        }
+    }, 
+    "user_types": {
+        "_SERVICE_LIST_ENTRY": {
+            "fields": {
+                "Flink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 4
+                }, 
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_LIST_ENTRY"
+                        }
+                    }, 
+                    "offset": 0
+                }
+            }, 
+            "kind": "struct", 
+            "size": 8
+        }, 
+        "_SERVICE_PROCESS": {
+            "fields": {
+                "BinaryPath": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 12
+                }, 
+                "ProcessId": {
+                    "type": {
+                        "kind": "base", 
+                        "name": "unsigned int"
+                    }, 
+                    "offset": 20
+                }
+            }, 
+            "kind": "struct", 
+            "size": 20
+        }, 
+        "_SERVICE_HEADER": {
+            "fields": {
+                "Tag": {
+                    "type": {
+                        "count": 4, 
+                        "subtype": {
+                            "kind": "base", 
+                            "name": "unsigned char"
+                        }, 
+                        "kind": "array"
+                    }, 
+                    "offset": 0
+                }, 
+                "ServiceRecord": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_RECORD"
+                        }
+                    }, 
+                    "offset": 12
+                }
+            }, 
+            "kind": "struct", 
+            "size": 12
+        }, 
+        "_SERVICE_RECORD": {
+            "fields": {
+                "DisplayName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 48
+                }, 
+                "ServiceProcess": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_PROCESS"
+                        }
+                    },
+                    "offset": 164
+                }, 
+                "PrevEntry": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_RECORD"
+                        }
+                    },
+                    "offset": 12
+                }, 
+                "Start": {
+                    "type": {
+                        "kind": "enum", 
+                        "name": "StartEnum"
+                    }, 
+                    "offset": 24
+                }, 
+                "State": {
+                    "type": {
+                        "kind": "enum", 
+                        "name": "StateEnum"
+                    }, 
+                    "offset": 56
+                }, 
+                "ServiceName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    }, 
+                    "offset": 44
+                },
+                "Tag": {
+                    "type": {
+                        "count": 4,
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned char"
+                        },
+                        "kind": "array"
+                    },
+                    "offset": 0
+                },
+                "DriverName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 164
+                }, 
+                "Type": {
+                    "type": {
+                        "kind": "base", 
+                        "name": "unsigned long"
+                    }, 
+                    "offset": 52
+                }, 
+                "Order": {
+                    "type": {
+                        "kind": "base", 
+                        "name": "unsigned int"
+                    }, 
+                    "offset": 20
+                }
+            }, 
+            "kind": "struct", 
+            "size": 156
+        }
+    }, 
+    "metadata": {
+        "producer": {
+            "version": "0.0.1", 
+            "name": "vtypes_to_json.py", 
+            "datetime": "2019-04-17T13:45:16.417006"
+        }, 
+        "format": "4.1.0"
+    }
+}
diff --git a/volatility3/framework/symbols/windows/services/services-win10-19041-x64.json b/volatility3/framework/symbols/windows/services/services-win10-19041-x64.json
new file mode 100644
index 000000000..e44dbbd37
--- /dev/null
+++ b/volatility3/framework/symbols/windows/services/services-win10-19041-x64.json
@@ -0,0 +1,255 @@
+{
+    "symbols": {}, 
+    "enums": {
+        "StateEnum": {
+            "base": "long", 
+            "constants": {
+                "SERVICE_START_PENDING": 2, 
+                "SERVICE_STOP_PENDING": 3, 
+                "SERVICE_STOPPED": 1, 
+                "SERVICE_CONTINUE_PENDING": 5, 
+                "SERVICE_PAUSE_PENDING": 6, 
+                "SERVICE_PAUSED": 7, 
+                "SERVICE_RUNNING": 4
+            }, 
+            "size": 4
+        }, 
+        "StartEnum": {
+            "base": "long", 
+            "constants": {
+                "SERVICE_DEMAND_START": 3, 
+                "SERVICE_AUTO_START": 2, 
+                "SERVICE_BOOT_START": 0, 
+                "SERVICE_DISABLED": 4, 
+                "SERVICE_SYSTEM_START": 1
+            }, 
+            "size": 4
+        }
+    }, 
+    "base_types": {
+        "unsigned long": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "unsigned char": {
+            "kind": "char", 
+            "size": 1, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "pointer": {
+            "kind": "int", 
+            "size": 8, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "unsigned int": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        },
+        "unsigned short": {
+            "kind": "int",
+            "size": 2,
+            "signed": false,
+            "endian": "little"
+        },
+        "long": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        }
+    }, 
+    "user_types": {
+        "_SERVICE_LIST_ENTRY": {
+            "fields": {
+                "Flink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_LIST_ENTRY"
+                        }
+                    }, 
+                    "offset": 16
+                }, 
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_LIST_ENTRY"
+                        }
+                    }, 
+                    "offset": 0
+                }
+            }, 
+            "kind": "struct", 
+            "size": 16
+        }, 
+        "_SERVICE_PROCESS": {
+            "fields": {
+                "BinaryPath": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 24
+                }, 
+                "ProcessId": {
+                    "type": {
+                        "kind": "base", 
+                        "name": "unsigned int"
+                    }, 
+                    "offset": 40
+                }
+            }, 
+            "kind": "struct", 
+            "size": 40
+        }, 
+        "_SERVICE_HEADER": {
+            "fields": {
+                "Tag": {
+                    "type": {
+                        "count": 4, 
+                        "subtype": {
+                            "kind": "base", 
+                            "name": "unsigned char"
+                        }, 
+                        "kind": "array"
+                    }, 
+                    "offset": 0
+                }, 
+                "ServiceRecord": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_RECORD"
+                        }
+                    },
+                    "offset": 16
+                }
+            }, 
+            "kind": "struct", 
+            "size": 16
+        }, 
+        "_SERVICE_RECORD": {
+            "fields": {
+                "ServiceList": {
+                    "type": {
+                        "kind": "struct", 
+                        "name": "_SERVICE_LIST_ENTRY"
+                    }, 
+                    "offset": 0
+                }, 
+                "Tag": {
+                    "type": {
+                        "count": 4, 
+                        "subtype": {
+                            "kind": "base", 
+                            "name": "unsigned char"
+                        }, 
+                        "kind": "array"
+                    }, 
+                    "offset": 32
+                }, 
+                "DisplayName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 64
+                }, 
+                "ServiceProcess": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_PROCESS"
+                        }
+                    },
+                    "offset": 296
+                }, 
+                "PrevEntry": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_RECORD"
+                        }
+                    },
+                    "offset": 16
+                }, 
+                "Start": {
+                    "type": {
+                        "kind": "enum", 
+                        "name": "StartEnum"
+                    }, 
+                    "offset": 36
+                }, 
+                "State": {
+                    "type": {
+                        "kind": "enum", 
+                        "name": "StateEnum"
+                    }, 
+                    "offset": 76
+                }, 
+                "ServiceName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 56
+                }, 
+                "DriverName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 296
+                }, 
+                "Type": {
+                    "type": {
+                        "kind": "base", 
+                        "name": "unsigned long"
+                    }, 
+                    "offset": 72
+                }, 
+                "Order": {
+                    "type": {
+                        "kind": "base", 
+                        "name": "unsigned int"
+                    }, 
+                    "offset": 32
+                }
+            }, 
+            "kind": "struct", 
+            "size": 296
+        }
+    }, 
+    "metadata": {
+        "producer": {
+            "version": "0.0.1", 
+            "name": "David McDonald", 
+            "datetime": "2023-11-16T15:05:35-06:00"
+        }, 
+        "format": "4.1.0"
+    }
+}
diff --git a/volatility3/framework/symbols/windows/services/services-win10-19041-x86.json b/volatility3/framework/symbols/windows/services/services-win10-19041-x86.json
new file mode 100644
index 000000000..cc5ed9a73
--- /dev/null
+++ b/volatility3/framework/symbols/windows/services/services-win10-19041-x86.json
@@ -0,0 +1,248 @@
+{
+    "symbols": {}, 
+    "enums": {
+        "StateEnum": {
+            "base": "long", 
+            "constants": {
+                "SERVICE_START_PENDING": 2, 
+                "SERVICE_STOP_PENDING": 3, 
+                "SERVICE_STOPPED": 1, 
+                "SERVICE_CONTINUE_PENDING": 5, 
+                "SERVICE_PAUSE_PENDING": 6, 
+                "SERVICE_PAUSED": 7, 
+                "SERVICE_RUNNING": 4
+            }, 
+            "size": 4
+        }, 
+        "StartEnum": {
+            "base": "long", 
+            "constants": {
+                "SERVICE_DEMAND_START": 3, 
+                "SERVICE_AUTO_START": 2, 
+                "SERVICE_BOOT_START": 0, 
+                "SERVICE_DISABLED": 4, 
+                "SERVICE_SYSTEM_START": 1
+            }, 
+            "size": 4
+        }
+    }, 
+    "base_types": {
+        "unsigned long": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "unsigned char": {
+            "kind": "char", 
+            "size": 1, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "pointer": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "unsigned int": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        },
+        "unsigned short": {
+            "kind": "int",
+            "size": 2,
+            "signed": false,
+            "endian": "little"
+        },
+        "long": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        }
+    }, 
+    "user_types": {
+        "_SERVICE_LIST_ENTRY": {
+            "fields": {
+                "Flink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 4
+                }, 
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_LIST_ENTRY"
+                        }
+                    }, 
+                    "offset": 0
+                }
+            }, 
+            "kind": "struct", 
+            "size": 8
+        }, 
+        "_SERVICE_PROCESS": {
+            "fields": {
+                "BinaryPath": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 12
+                }, 
+                "ProcessId": {
+                    "type": {
+                        "kind": "base", 
+                        "name": "unsigned int"
+                    }, 
+                    "offset": 20
+                }
+            }, 
+            "kind": "struct", 
+            "size": 20
+        }, 
+        "_SERVICE_HEADER": {
+            "fields": {
+                "Tag": {
+                    "type": {
+                        "count": 4, 
+                        "subtype": {
+                            "kind": "base", 
+                            "name": "unsigned char"
+                        }, 
+                        "kind": "array"
+                    }, 
+                    "offset": 0
+                }, 
+                "ServiceRecord": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_RECORD"
+                        }
+                    }, 
+                    "offset": 16
+                }
+            }, 
+            "kind": "struct", 
+            "size": 12
+        }, 
+        "_SERVICE_RECORD": {
+            "fields": {
+                "DisplayName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 48
+                }, 
+                "ServiceProcess": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_PROCESS"
+                        }
+                    },
+                    "offset": 192
+                }, 
+                "PrevEntry": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_RECORD"
+                        }
+                    },
+                    "offset": 12
+                }, 
+                "Start": {
+                    "type": {
+                        "kind": "enum", 
+                        "name": "StartEnum"
+                    }, 
+                    "offset": 24
+                }, 
+                "State": {
+                    "type": {
+                        "kind": "enum", 
+                        "name": "StateEnum"
+                    }, 
+                    "offset": 56
+                }, 
+                "ServiceName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    }, 
+                    "offset": 44
+                },
+                "Tag": {
+                    "type": {
+                        "count": 4,
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned char"
+                        },
+                        "kind": "array"
+                    },
+                    "offset": 0
+                },
+                "DriverName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 192
+                }, 
+                "Type": {
+                    "type": {
+                        "kind": "base", 
+                        "name": "unsigned long"
+                    }, 
+                    "offset": 52
+                }, 
+                "Order": {
+                    "type": {
+                        "kind": "base", 
+                        "name": "unsigned int"
+                    }, 
+                    "offset": 20
+                }
+            }, 
+            "kind": "struct", 
+            "size": 192
+        }
+    }, 
+    "metadata": {
+        "producer": {
+            "version": "0.0.1", 
+            "name": "vtypes_to_json.py", 
+            "datetime": "2019-04-17T13:45:16.417006"
+        }, 
+        "format": "4.1.0"
+    }
+}
diff --git a/volatility3/framework/symbols/windows/services/services-win10-25398-x64.json b/volatility3/framework/symbols/windows/services/services-win10-25398-x64.json
new file mode 100644
index 000000000..cd29abc43
--- /dev/null
+++ b/volatility3/framework/symbols/windows/services/services-win10-25398-x64.json
@@ -0,0 +1,255 @@
+{
+    "symbols": {}, 
+    "enums": {
+        "StateEnum": {
+            "base": "long", 
+            "constants": {
+                "SERVICE_START_PENDING": 2, 
+                "SERVICE_STOP_PENDING": 3, 
+                "SERVICE_STOPPED": 1, 
+                "SERVICE_CONTINUE_PENDING": 5, 
+                "SERVICE_PAUSE_PENDING": 6, 
+                "SERVICE_PAUSED": 7, 
+                "SERVICE_RUNNING": 4
+            }, 
+            "size": 4
+        }, 
+        "StartEnum": {
+            "base": "long", 
+            "constants": {
+                "SERVICE_DEMAND_START": 3, 
+                "SERVICE_AUTO_START": 2, 
+                "SERVICE_BOOT_START": 0, 
+                "SERVICE_DISABLED": 4, 
+                "SERVICE_SYSTEM_START": 1
+            }, 
+            "size": 4
+        }
+    }, 
+    "base_types": {
+        "unsigned long": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "unsigned char": {
+            "kind": "char", 
+            "size": 1, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "pointer": {
+            "kind": "int", 
+            "size": 8, 
+            "signed": false, 
+            "endian": "little"
+        }, 
+        "unsigned int": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        },
+        "unsigned short": {
+            "kind": "int",
+            "size": 2,
+            "signed": false,
+            "endian": "little"
+        },
+        "long": {
+            "kind": "int", 
+            "size": 4, 
+            "signed": false, 
+            "endian": "little"
+        }
+    }, 
+    "user_types": {
+        "_SERVICE_LIST_ENTRY": {
+            "fields": {
+                "Flink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_LIST_ENTRY"
+                        }
+                    }, 
+                    "offset": 16
+                }, 
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_LIST_ENTRY"
+                        }
+                    }, 
+                    "offset": 0
+                }
+            }, 
+            "kind": "struct", 
+            "size": 16
+        }, 
+        "_SERVICE_PROCESS": {
+            "fields": {
+                "BinaryPath": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 24
+                }, 
+                "ProcessId": {
+                    "type": {
+                        "kind": "base", 
+                        "name": "unsigned int"
+                    }, 
+                    "offset": 40
+                }
+            }, 
+            "kind": "struct", 
+            "size": 40
+        }, 
+        "_SERVICE_HEADER": {
+            "fields": {
+                "Tag": {
+                    "type": {
+                        "count": 4, 
+                        "subtype": {
+                            "kind": "base", 
+                            "name": "unsigned char"
+                        }, 
+                        "kind": "array"
+                    }, 
+                    "offset": 0
+                }, 
+                "ServiceRecord": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_RECORD"
+                        }
+                    },
+                    "offset": 16
+                }
+            }, 
+            "kind": "struct", 
+            "size": 16
+        }, 
+        "_SERVICE_RECORD": {
+            "fields": {
+                "ServiceList": {
+                    "type": {
+                        "kind": "struct", 
+                        "name": "_SERVICE_LIST_ENTRY"
+                    }, 
+                    "offset": 0
+                }, 
+                "Tag": {
+                    "type": {
+                        "count": 4, 
+                        "subtype": {
+                            "kind": "base", 
+                            "name": "unsigned char"
+                        }, 
+                        "kind": "array"
+                    }, 
+                    "offset": 32
+                }, 
+                "DisplayName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 64
+                }, 
+                "ServiceProcess": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_PROCESS"
+                        }
+                    },
+                    "offset": 336
+                }, 
+                "PrevEntry": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SERVICE_RECORD"
+                        }
+                    },
+                    "offset": 16
+                }, 
+                "Start": {
+                    "type": {
+                        "kind": "enum", 
+                        "name": "StartEnum"
+                    }, 
+                    "offset": 36
+                }, 
+                "State": {
+                    "type": {
+                        "kind": "enum", 
+                        "name": "StateEnum"
+                    }, 
+                    "offset": 84
+                }, 
+                "ServiceName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 56
+                }, 
+                "DriverName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned short"
+                        }
+                    },
+                    "offset": 296
+                }, 
+                "Type": {
+                    "type": {
+                        "kind": "base", 
+                        "name": "unsigned long"
+                    }, 
+                    "offset": 80
+                }, 
+                "Order": {
+                    "type": {
+                        "kind": "base", 
+                        "name": "unsigned int"
+                    }, 
+                    "offset": 32
+                }
+            }, 
+            "kind": "struct", 
+            "size": 336
+        }
+    }, 
+    "metadata": {
+        "producer": {
+            "version": "0.0.1", 
+            "name": "David McDonald", 
+            "datetime": "2023-11-16T15:05:35-06:00"
+        }, 
+        "format": "4.1.0"
+    }
+}
diff --git a/volatility3/framework/symbols/windows/versions.py b/volatility3/framework/symbols/windows/versions.py
index 84ce65432..6e2c2e9bd 100644
--- a/volatility3/framework/symbols/windows/versions.py
+++ b/volatility3/framework/symbols/windows/versions.py
@@ -151,11 +151,45 @@ is_win10_16299_or_later = OsDistinguisher(
     ],
 )
 
+is_win10_17763_or_later = OsDistinguisher(
+    version_check=lambda x: x >= (10, 0, 17763),
+    fallback_checks=[
+        ("_EPROCESS", "TrustletIdentity", False),
+        ("ParentSecurityDomain", None, False),
+    ],
+)
+
+is_win10_18362_or_later = OsDistinguisher(
+    version_check=lambda x: x >= (10, 0, 18362),
+    fallback_checks=[
+        ("ObHeaderCookie", None, True),
+        ("_CM_CACHED_VALUE_INDEX", None, False),
+        ("_WNF_PROCESS_CONTEXT", None, True),
+    ],
+)
+
 is_win10_18363_or_later = OsDistinguisher(
     version_check=lambda x: x >= (10, 0, 18363),
     fallback_checks=[("_KQOS_GROUPING_SETS", None, True)],
 )
 
+is_win10_19041_or_later = OsDistinguisher(
+    version_check=lambda x: x >= (10, 0, 19041),
+    fallback_checks=[
+        ("_EPROCESS", "TimerResolutionIgnore", True),
+        ("_EPROCESS", "VmProcessorHostTransition", True),
+        ("_KQOS_GROUPING_SETS", None, True),
+    ],
+)
+
+is_win10_25398_or_later = OsDistinguisher(
+    version_check=lambda x: x >= (10, 0, 25398),
+    fallback_checks=[
+        ("_EPROCESS", "MmSlabIdentity", True),
+        ("_EPROCESS", "EnableProcessImpersonationLogging", True),
+    ],
+)
+
 is_windows_10 = OsDistinguisher(
     version_check=lambda x: x >= (10, 0),
     fallback_checks=[("ObHeaderCookie", None, True)],

From 86d6b4f7245a553bb2b7db6a3d844375a57f8cd4 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Tue, 16 Jan 2024 10:08:14 -0600
Subject: [PATCH 21/34] Bump plugin version

---
 volatility3/framework/plugins/windows/svcscan.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py
index 74fe2d802..7688594d2 100644
--- a/volatility3/framework/plugins/windows/svcscan.py
+++ b/volatility3/framework/plugins/windows/svcscan.py
@@ -32,7 +32,7 @@ class SvcScan(interfaces.plugins.PluginInterface):
     """Scans for windows services."""
 
     _required_framework_version = (2, 0, 0)
-    _version = (1, 0, 0)
+    _version = (2, 0, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:

From 4b400b6df612fe0f3a796c06dbfb7fa272e5d0fd Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Tue, 16 Jan 2024 10:09:36 -0600
Subject: [PATCH 22/34] Refactor out code duplication in OS version checks

---
 .../framework/plugins/windows/svcscan.py      | 132 ++++++------------
 1 file changed, 39 insertions(+), 93 deletions(-)

diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py
index 7688594d2..4f20ed346 100644
--- a/volatility3/framework/plugins/windows/svcscan.py
+++ b/volatility3/framework/plugins/windows/svcscan.py
@@ -4,9 +4,16 @@
 
 import logging
 import os
-from typing import Dict, List, NamedTuple, Union
+from typing import Dict, List, NamedTuple, Optional, Tuple, Union, cast
 
-from volatility3.framework import constants, exceptions, interfaces, renderers, symbols
+from volatility3.framework import (
+    constants,
+    exceptions,
+    interfaces,
+    objects,
+    renderers,
+    symbols,
+)
 from volatility3.framework.configuration import requirements
 from volatility3.framework.layers import scanners
 from volatility3.framework.renderers import format_hints
@@ -76,6 +83,28 @@ class SvcScan(interfaces.plugins.PluginInterface):
             binary_info.dll,
         )
 
+    # These checks must be completed from newest -> oldest OS version.
+    _win_version_file_map: List[Tuple[versions.OsDistinguisher, bool, str]] = [
+        (versions.is_win10_25398_or_later, True, "services-win10-25398-x64"),
+        (versions.is_win10_19041_or_later, True, "services-win10-19041-x64"),
+        (versions.is_win10_19041_or_later, False, "services-win10-19041-x86"),
+        (versions.is_win10_18362_or_later, True, "services-win10-18362-x64"),
+        (versions.is_win10_18362_or_later, False, "services-win10-18362-x86"),
+        (versions.is_win10_17763_or_later, False, "services-win10-17763-x86"),
+        (versions.is_win10_16299_or_later, True, "services-win10-16299-x64"),
+        (versions.is_win10_16299_or_later, False, "services-win10-16299-x86"),
+        (versions.is_win10_15063, True, "services-win10-15063-x64"),
+        (versions.is_win10_15063, False, "services-win10-15063-x86"),
+        (versions.is_win10_up_to_15063, True, "services-win8-x64"),
+        (versions.is_win10_up_to_15063, False, "services-win8-x86"),
+        (versions.is_windows_8_or_later, True, "services-win8-x64"),
+        (versions.is_windows_8_or_later, True, "services-win8-x86"),
+        (versions.is_vista_or_later, True, "services-vista-x64"),
+        (versions.is_vista_or_later, False, "services-vista-x86"),
+        (versions.is_windows_xp, False, "services-xp-x86"),
+        (versions.is_xp_or_2003, True, "services-xp-2003-x64"),
+    ]
+
     @staticmethod
     def create_service_table(
         context: interfaces.context.ContextInterface,
@@ -96,97 +125,14 @@ class SvcScan(interfaces.plugins.PluginInterface):
         native_types = context.symbol_space[symbol_table].natives
         is_64bit = symbols.symbol_table_is_64bit(context, symbol_table)
 
-        if (
-            versions.is_windows_xp(context=context, symbol_table=symbol_table)
-            and not is_64bit
-        ):
-            symbol_filename = "services-xp-x86"
-        elif (
-            versions.is_xp_or_2003(context=context, symbol_table=symbol_table)
-            and is_64bit
-        ):
-            symbol_filename = "services-xp-2003-x64"
-        elif (
-            versions.is_win10_25398_or_later(context=context, symbol_table=symbol_table)
-            and is_64bit
-        ):
-            symbol_filename = "services-win10-25398-x64"
-        elif (
-            versions.is_win10_19041_or_later(context=context, symbol_table=symbol_table)
-            and is_64bit
-        ):
-            symbol_filename = "services-win10-19041-x64"
-        elif (
-            versions.is_win10_19041_or_later(context=context, symbol_table=symbol_table)
-            and not is_64bit
-        ):
-            symbol_filename = "services-win10-19041-x86"
-        elif (
-            versions.is_win10_18362_or_later(context=context, symbol_table=symbol_table)
-            and is_64bit
-        ):
-            symbol_filename = "services-win10-18362-x64"
-        elif (
-            versions.is_win10_18362_or_later(context=context, symbol_table=symbol_table)
-            and not is_64bit
-        ):
-            symbol_filename = "services-win10-18362-x86"
-        elif (
-            versions.is_win10_16299_or_later(context=context, symbol_table=symbol_table)
-            and is_64bit
-        ):
-            symbol_filename = "services-win10-16299-x64"
-        elif (
-            versions.is_win10_17763_or_later(context=context, symbol_table=symbol_table)
-            and not is_64bit
-        ):
-            symbol_filename = "services-win10-17763-x86"
-        elif (
-            versions.is_win10_16299_or_later(context=context, symbol_table=symbol_table)
-            and not is_64bit
-        ):
-            symbol_filename = "services-win10-16299-x86"
-        elif (
-            versions.is_win10_15063(context=context, symbol_table=symbol_table)
-            and is_64bit
-        ):
-            symbol_filename = "services-win10-15063-x64"
-        elif (
-            versions.is_win10_15063(context=context, symbol_table=symbol_table)
-            and not is_64bit
-        ):
-            symbol_filename = "services-win10-15063-x86"
-        elif (
-            versions.is_win10_up_to_15063(context=context, symbol_table=symbol_table)
-            and is_64bit
-        ):
-            symbol_filename = "services-win8-x64"
-        elif (
-            versions.is_win10_up_to_15063(context=context, symbol_table=symbol_table)
-            and not is_64bit
-        ):
-            symbol_filename = "services-win8-x86"
-        elif (
-            versions.is_windows_8_or_later(context=context, symbol_table=symbol_table)
-            and is_64bit
-        ):
-            symbol_filename = "services-win8-x64"
-        elif (
-            versions.is_windows_8_or_later(context=context, symbol_table=symbol_table)
-            and not is_64bit
-        ):
-            symbol_filename = "services-win8-x86"
-        elif (
-            versions.is_vista_or_later(context=context, symbol_table=symbol_table)
-            and is_64bit
-        ):
-            symbol_filename = "services-vista-x64"
-        elif (
-            versions.is_vista_or_later(context=context, symbol_table=symbol_table)
-            and not is_64bit
-        ):
-            symbol_filename = "services-vista-x86"
-        else:
+        try:
+            symbol_filename = next(
+                filename
+                for version_check, for_64bit, filename in SvcScan._win_version_file_map
+                if is_64bit == for_64bit
+                and version_check(context=context, symbol_table=symbol_table)
+            )
+        except StopIteration:
             raise NotImplementedError("This version of Windows is not supported!")
 
         return intermed.IntermediateSymbolTable.create(

From 5541378afe86d41734c05f6b84bbafcd26d46644 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Tue, 16 Jan 2024 10:09:59 -0600
Subject: [PATCH 23/34] Create unique config path

---
 volatility3/framework/plugins/windows/svcscan.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py
index 4f20ed346..d16bee113 100644
--- a/volatility3/framework/plugins/windows/svcscan.py
+++ b/volatility3/framework/plugins/windows/svcscan.py
@@ -147,7 +147,9 @@ class SvcScan(interfaces.plugins.PluginInterface):
     def _get_service_key(self, kernel):
         for hive in hivelist.HiveList.list_hives(
             context=self.context,
-            base_config_path=self.config_path,
+            base_config_path=interfaces.configuration.path_join(
+                self.config_path, "hivelist"
+            ),
             layer_name=kernel.layer_name,
             symbol_table=kernel.symbol_table_name,
             filter_string="machine\\system",

From f5c1bf0f1f5c177b2dcee9d09d3ab522ba83f41e Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Tue, 16 Jan 2024 10:10:20 -0600
Subject: [PATCH 24/34] Remove argument that matches default

---
 volatility3/framework/plugins/windows/svcscan.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py
index d16bee113..b77491a65 100644
--- a/volatility3/framework/plugins/windows/svcscan.py
+++ b/volatility3/framework/plugins/windows/svcscan.py
@@ -153,7 +153,6 @@ class SvcScan(interfaces.plugins.PluginInterface):
             layer_name=kernel.layer_name,
             symbol_table=kernel.symbol_table_name,
             filter_string="machine\\system",
-            hive_offsets=None,
         ):
             # Get ControlSet\Services.
             try:

From c517a44cde3cb87d48da3a72d685630eca7acaa1 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Tue, 16 Jan 2024 10:10:54 -0600
Subject: [PATCH 25/34] Add type hints/casts to _get_service_key method

---
 volatility3/framework/plugins/windows/svcscan.py | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py
index b77491a65..dd2f76890 100644
--- a/volatility3/framework/plugins/windows/svcscan.py
+++ b/volatility3/framework/plugins/windows/svcscan.py
@@ -144,7 +144,7 @@ class SvcScan(interfaces.plugins.PluginInterface):
             native_types=native_types,
         )
 
-    def _get_service_key(self, kernel):
+    def _get_service_key(self, kernel) -> Optional[objects.StructType]:
         for hive in hivelist.HiveList.list_hives(
             context=self.context,
             base_config_path=interfaces.configuration.path_join(
@@ -156,10 +156,14 @@ class SvcScan(interfaces.plugins.PluginInterface):
         ):
             # Get ControlSet\Services.
             try:
-                return hive.get_key(r"CurrentControlSet\Services")
+                return cast(
+                    objects.StructType, hive.get_key(r"CurrentControlSet\Services")
+                )
             except (KeyError, exceptions.InvalidAddressException):
                 try:
-                    return hive.get_key(r"ControlSet001\Services")
+                    return cast(
+                        objects.StructType, hive.get_key(r"ControlSet001\Services")
+                    )
                 except (KeyError, exceptions.InvalidAddressException):
                     pass
 

From 42c2a86a37ace33cf93d28efd491b00e8c29dd53 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Tue, 16 Jan 2024 10:11:16 -0600
Subject: [PATCH 26/34] Add logging for when a Services key cannot be retrieved

---
 volatility3/framework/plugins/windows/svcscan.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py
index dd2f76890..095661880 100644
--- a/volatility3/framework/plugins/windows/svcscan.py
+++ b/volatility3/framework/plugins/windows/svcscan.py
@@ -165,6 +165,10 @@ class SvcScan(interfaces.plugins.PluginInterface):
                         objects.StructType, hive.get_key(r"ControlSet001\Services")
                     )
                 except (KeyError, exceptions.InvalidAddressException):
+                    vollog.log(
+                        constants.LOGLEVEL_VVVV,
+                        "Could not retrieve any control set from SYSTEM hive",
+                    )
                     pass
 
             return None

From 4192e8a711aff985352f3347dc8cd289894a812f Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Thu, 18 Jan 2024 12:22:23 -0600
Subject: [PATCH 27/34] Fix condition in OsDistinguisher

---
 volatility3/framework/symbols/windows/versions.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility3/framework/symbols/windows/versions.py b/volatility3/framework/symbols/windows/versions.py
index 6e2c2e9bd..e1e74afc0 100644
--- a/volatility3/framework/symbols/windows/versions.py
+++ b/volatility3/framework/symbols/windows/versions.py
@@ -155,7 +155,7 @@ is_win10_17763_or_later = OsDistinguisher(
     version_check=lambda x: x >= (10, 0, 17763),
     fallback_checks=[
         ("_EPROCESS", "TrustletIdentity", False),
-        ("ParentSecurityDomain", None, False),
+        ("ParentSecurityDomain", None, True),
     ],
 )
 

From 43e8e01daff8dc1ff88b9edfc6d5d6b2fac33417 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Tue, 30 Jan 2024 09:26:17 -0600
Subject: [PATCH 28/34] Removes unnecessary pass and deindents return stmt

---
 volatility3/framework/plugins/windows/svcscan.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py
index 095661880..10de46e2a 100644
--- a/volatility3/framework/plugins/windows/svcscan.py
+++ b/volatility3/framework/plugins/windows/svcscan.py
@@ -169,9 +169,8 @@ class SvcScan(interfaces.plugins.PluginInterface):
                         constants.LOGLEVEL_VVVV,
                         "Could not retrieve any control set from SYSTEM hive",
                     )
-                    pass
 
-            return None
+        return None
 
     @staticmethod
     def _get_service_dll(

From 470c750d82ee0208f673472bcf2bf6632ae4190f Mon Sep 17 00:00:00 2001
From: hsarkey <hsarkey@volexity.com>
Date: Wed, 31 Jan 2024 16:00:29 -0500
Subject: [PATCH 29/34] Updated to use dictionary for refined criteria and
 BaseAbsentValue for when criteria is not met

---
 .../framework/plugins/windows/malfind.py       | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py
index 284144077..8c0cb68ac 100644
--- a/volatility3/framework/plugins/windows/malfind.py
+++ b/volatility3/framework/plugins/windows/malfind.py
@@ -142,15 +142,20 @@ class Malfind(interfaces.plugins.PluginInterface):
         kernel = self.context.modules[self.config["kernel"]]
 
         # set refined criteria to know when to add to "Notes" column
-        refined_criteria = [b"MZ", b"\x55\x8B", b"\x55\x48", b"\x55\x89"]
+        refined_criteria = {
+            b"MZ": "MZ header",
+            b"\x55\x8B": "PE header",
+            b"\x55\x48": "Function prologue",
+            b"\x55\x89": "Function prologue",
+        }
 
         is_32bit_arch = not symbols.symbol_table_is_64bit(
             self.context, kernel.symbol_table_name
         )
 
         for proc in procs:
-            # by default, "Notes" column will be set to none
-            notes = "None"
+            # by default, "Notes" column will be set to N/A
+            notes = renderers.NotApplicableValue()
             process_name = utility.array_to_string(proc.ImageFileName)
 
             for vad, data in self.list_injections(
@@ -158,12 +163,7 @@ class Malfind(interfaces.plugins.PluginInterface):
             ):
                 # Check for unique headers and update "Notes" column if criteria is met
                 if data[0:2] in refined_criteria:
-                    if data[0:2] == b"MZ":
-                        notes = "MZ header"
-                    elif data[0:2] == b"\x55\x8B":
-                        notes = "PE header"
-                    else:
-                        notes = "Function prologue"
+                    notes = refined_criteria[data[0:2]]
 
                 # if we're on a 64 bit kernel, we may still need 32 bit disasm due to wow64
                 if is_32bit_arch or proc.get_is_wow64():

From 6d093a4e4338aaee5b69384f1652cda994a3e1d3 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 31 Jan 2024 21:04:16 +0000
Subject: [PATCH 30/34] Documentation: Update copyright in README.md for 2024

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 471735af8..f69acb3bb 100644
--- a/README.md
+++ b/README.md
@@ -107,7 +107,7 @@ The latest generated copy of the documentation can be found at: <https://volatil
 
 ## Licensing and Copyright
 
-Copyright (C) 2007-2023 Volatility Foundation
+Copyright (C) 2007-2024 Volatility Foundation
 
 All Rights Reserved
 

From 7de7dfdabf8f508a133ddc0a2da20ab267815606 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 31 Jan 2024 21:04:16 +0000
Subject: [PATCH 31/34] Documentation: Update copyright in README.md for 2024

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 471735af8..f69acb3bb 100644
--- a/README.md
+++ b/README.md
@@ -107,7 +107,7 @@ The latest generated copy of the documentation can be found at: <https://volatil
 
 ## Licensing and Copyright
 
-Copyright (C) 2007-2023 Volatility Foundation
+Copyright (C) 2007-2024 Volatility Foundation
 
 All Rights Reserved
 

From 86b0fd431a283cf61eec96887bdec54fdd0cb02b Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 31 Jan 2024 21:09:48 +0000
Subject: [PATCH 32/34] Core: Apply black 24.1.0 across the whole codebase

---
 volatility3/cli/text_renderer.py              |  8 +++---
 volatility3/framework/__init__.py             |  6 ++---
 volatility3/framework/automagic/mac.py        |  6 ++---
 volatility3/framework/automagic/module.py     |  6 ++---
 .../framework/automagic/symbol_finder.py      | 12 ++++-----
 volatility3/framework/automagic/windows.py    | 20 +++++++-------
 .../framework/configuration/requirements.py   |  6 ++---
 volatility3/framework/layers/avml.py          |  6 ++---
 volatility3/framework/layers/elf.py           |  6 ++---
 volatility3/framework/layers/intel.py         |  6 ++---
 volatility3/framework/layers/lime.py          |  6 ++---
 volatility3/framework/layers/qemu.py          |  6 ++---
 volatility3/framework/layers/xen.py           |  6 ++---
 volatility3/framework/objects/__init__.py     |  6 ++---
 volatility3/framework/plugins/mac/pslist.py   |  4 +--
 .../framework/plugins/windows/crashinfo.py    |  6 ++---
 .../framework/plugins/windows/mftscan.py      |  1 -
 .../framework/plugins/windows/netscan.py      | 10 ++++---
 .../plugins/windows/registry/printkey.py      |  6 ++---
 volatility3/framework/renderers/conversion.py |  6 ++---
 volatility3/framework/symbols/__init__.py     | 26 +++++++++----------
 .../symbols/windows/extensions/__init__.py    |  6 ++---
 volatility3/plugins/windows/statistics.py     | 10 +++----
 23 files changed, 88 insertions(+), 93 deletions(-)

diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py
index ffb8d516b..6e58ee68d 100644
--- a/volatility3/cli/text_renderer.py
+++ b/volatility3/cli/text_renderer.py
@@ -389,9 +389,11 @@ class JsonRenderer(CLIRenderer):
         interfaces.renderers.Disassembly: quoted_optional(display_disassembly),
         format_hints.MultiTypeData: quoted_optional(multitypedata_as_text),
         bytes: optional(lambda x: " ".join([f"{b:02x}" for b in x])),
-        datetime.datetime: lambda x: x.isoformat()
-        if not isinstance(x, interfaces.renderers.BaseAbsentValue)
-        else None,
+        datetime.datetime: lambda x: (
+            x.isoformat()
+            if not isinstance(x, interfaces.renderers.BaseAbsentValue)
+            else None
+        ),
         "default": lambda x: x,
     }
 
diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py
index 9c17846a8..1565b2267 100644
--- a/volatility3/framework/__init__.py
+++ b/volatility3/framework/__init__.py
@@ -206,9 +206,9 @@ def _zipwalk(path: str):
             if not file.is_dir():
                 dirlist = zip_results.get(os.path.dirname(file.filename), [])
                 dirlist.append(os.path.basename(file.filename))
-                zip_results[
-                    os.path.join(path, os.path.dirname(file.filename))
-                ] = dirlist
+                zip_results[os.path.join(path, os.path.dirname(file.filename))] = (
+                    dirlist
+                )
     for value in zip_results:
         yield value, zip_results[value]
 
diff --git a/volatility3/framework/automagic/mac.py b/volatility3/framework/automagic/mac.py
index aa75fbc3d..e51753139 100644
--- a/volatility3/framework/automagic/mac.py
+++ b/volatility3/framework/automagic/mac.py
@@ -138,9 +138,9 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
                 config_path = join("automagic", "MacIntelHelper", new_layer_name)
                 context.config[join(config_path, "memory_layer")] = layer_name
                 context.config[join(config_path, "page_map_offset")] = dtb
-                context.config[
-                    join(config_path, MacSymbolFinder.banner_config_key)
-                ] = str(banner, "latin-1")
+                context.config[join(config_path, MacSymbolFinder.banner_config_key)] = (
+                    str(banner, "latin-1")
+                )
 
                 new_layer = intel.Intel32e(
                     context,
diff --git a/volatility3/framework/automagic/module.py b/volatility3/framework/automagic/module.py
index ee56a040c..ff13db905 100644
--- a/volatility3/framework/automagic/module.py
+++ b/volatility3/framework/automagic/module.py
@@ -34,9 +34,9 @@ class KernelModule(interfaces.automagic.AutomagicInterface):
             return None
         # The requirement is unfulfilled and is a ModuleRequirement
 
-        context.config[
-            interfaces.configuration.path_join(new_config_path, "class")
-        ] = "volatility3.framework.contexts.Module"
+        context.config[interfaces.configuration.path_join(new_config_path, "class")] = (
+            "volatility3.framework.contexts.Module"
+        )
 
         for req in requirement.requirements:
             if (
diff --git a/volatility3/framework/automagic/symbol_finder.py b/volatility3/framework/automagic/symbol_finder.py
index bf1c8ff16..21e594549 100644
--- a/volatility3/framework/automagic/symbol_finder.py
+++ b/volatility3/framework/automagic/symbol_finder.py
@@ -150,12 +150,12 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface):
                 clazz = self.symbol_class
                 # Set the discovered options
                 path_join = interfaces.configuration.path_join
-                context.config[
-                    path_join(config_path, requirement.name, "class")
-                ] = clazz
-                context.config[
-                    path_join(config_path, requirement.name, "isf_url")
-                ] = isf_path
+                context.config[path_join(config_path, requirement.name, "class")] = (
+                    clazz
+                )
+                context.config[path_join(config_path, requirement.name, "isf_url")] = (
+                    isf_path
+                )
                 context.config[
                     path_join(config_path, requirement.name, "symbol_mask")
                 ] = layer.address_mask
diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py
index a8530829b..52296f5ad 100644
--- a/volatility3/framework/automagic/windows.py
+++ b/volatility3/framework/automagic/windows.py
@@ -402,19 +402,19 @@ class WinSwapLayers(interfaces.automagic.AutomagicInterface):
                     if swap_location:
                         context.config[current_layer_path] = current_layer_name
                         try:
-                            context.config[
-                                layer_loc_path
-                            ] = requirements.URIRequirement.location_from_file(
-                                swap_location
+                            context.config[layer_loc_path] = (
+                                requirements.URIRequirement.location_from_file(
+                                    swap_location
+                                )
                             )
                         except ValueError:
                             vollog.warning(
                                 f"Volatility swap_location {swap_location} could not be validated - swap layer disabled"
                             )
                             continue
-                        context.config[
-                            layer_class_path
-                        ] = "volatility3.framework.layers.physical.FileLayer"
+                        context.config[layer_class_path] = (
+                            "volatility3.framework.layers.physical.FileLayer"
+                        )
 
                     # Add the requirement
                     new_req = requirements.TranslationLayerRequirement(
@@ -424,9 +424,9 @@ class WinSwapLayers(interfaces.automagic.AutomagicInterface):
                     )
                     swap_req.add_requirement(new_req)
 
-                context.config[
-                    path_join(swap_sub_config, "number_of_elements")
-                ] = counter
+                context.config[path_join(swap_sub_config, "number_of_elements")] = (
+                    counter
+                )
                 context.config[swap_sub_config] = True
 
                 swap_req.construct(context, swap_config)
diff --git a/volatility3/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py
index abdffdbe4..1c0622574 100644
--- a/volatility3/framework/configuration/requirements.py
+++ b/volatility3/framework/configuration/requirements.py
@@ -550,9 +550,9 @@ class VersionRequirement(interfaces.configuration.RequirementInterface):
         config_path = interfaces.configuration.path_join(config_path, self.name)
         if not self.matches_required(self._version, self._component.version):
             return {config_path: self}
-        context.config[
-            interfaces.configuration.path_join(config_path, self.name)
-        ] = True
+        context.config[interfaces.configuration.path_join(config_path, self.name)] = (
+            True
+        )
         return {}
 
     @classmethod
diff --git a/volatility3/framework/layers/avml.py b/volatility3/framework/layers/avml.py
index c825464cc..2e5572192 100644
--- a/volatility3/framework/layers/avml.py
+++ b/volatility3/framework/layers/avml.py
@@ -224,7 +224,7 @@ class AVMLStacker(interfaces.automagic.StackerLayerInterface):
         except exceptions.LayerException:
             return None
         new_name = context.layers.free_layer_name("AVMLLayer")
-        context.config[
-            interfaces.configuration.path_join(new_name, "base_layer")
-        ] = layer_name
+        context.config[interfaces.configuration.path_join(new_name, "base_layer")] = (
+            layer_name
+        )
         return AVMLLayer(context, new_name, new_name)
diff --git a/volatility3/framework/layers/elf.py b/volatility3/framework/layers/elf.py
index a10d36592..b2fd6d4d1 100644
--- a/volatility3/framework/layers/elf.py
+++ b/volatility3/framework/layers/elf.py
@@ -115,9 +115,9 @@ class Elf64Stacker(interfaces.automagic.StackerLayerInterface):
             vollog.log(constants.LOGLEVEL_VVVV, f"Exception: {excp}")
             return None
         new_name = context.layers.free_layer_name("Elf64Layer")
-        context.config[
-            interfaces.configuration.path_join(new_name, "base_layer")
-        ] = layer_name
+        context.config[interfaces.configuration.path_join(new_name, "base_layer")] = (
+            layer_name
+        )
 
         try:
             return Elf64Layer(context, new_name, new_name)
diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py
index 7d3b86a12..ae477854d 100644
--- a/volatility3/framework/layers/intel.py
+++ b/volatility3/framework/layers/intel.py
@@ -277,9 +277,9 @@ class Intel(linear.LinearlyMappedLayer):
         This allows translation layers to provide maps of contiguous
         regions in one layer
         """
-        stashed_offset = (
-            stashed_mapped_offset
-        ) = stashed_size = stashed_mapped_size = stashed_map_layer = None
+        stashed_offset = stashed_mapped_offset = stashed_size = stashed_mapped_size = (
+            stashed_map_layer
+        ) = None
         for offset, size, mapped_offset, mapped_size, map_layer in self._mapping(
             offset, length, ignore_errors
         ):
diff --git a/volatility3/framework/layers/lime.py b/volatility3/framework/layers/lime.py
index 28d646640..8b93932ab 100644
--- a/volatility3/framework/layers/lime.py
+++ b/volatility3/framework/layers/lime.py
@@ -104,7 +104,7 @@ class LimeStacker(interfaces.automagic.StackerLayerInterface):
         except LimeFormatException:
             return None
         new_name = context.layers.free_layer_name("LimeLayer")
-        context.config[
-            interfaces.configuration.path_join(new_name, "base_layer")
-        ] = layer_name
+        context.config[interfaces.configuration.path_join(new_name, "base_layer")] = (
+            layer_name
+        )
         return LimeLayer(context, new_name, new_name)
diff --git a/volatility3/framework/layers/qemu.py b/volatility3/framework/layers/qemu.py
index 501b8655e..ff483291c 100644
--- a/volatility3/framework/layers/qemu.py
+++ b/volatility3/framework/layers/qemu.py
@@ -486,9 +486,9 @@ class QemuStacker(interfaces.automagic.StackerLayerInterface):
         except exceptions.LayerException:
             return None
         new_name = context.layers.free_layer_name("QemuSuspendLayer")
-        context.config[
-            interfaces.configuration.path_join(new_name, "base_layer")
-        ] = layer_name
+        context.config[interfaces.configuration.path_join(new_name, "base_layer")] = (
+            layer_name
+        )
         layer = QemuSuspendLayer(context, new_name, new_name)
         cls.stacker_slow_warning()
         return layer
diff --git a/volatility3/framework/layers/xen.py b/volatility3/framework/layers/xen.py
index f7881a091..927b30430 100644
--- a/volatility3/framework/layers/xen.py
+++ b/volatility3/framework/layers/xen.py
@@ -173,8 +173,8 @@ class XenCoreDumpStacker(elf.Elf64Stacker):
             vollog.log(constants.LOGLEVEL_VVVV, f"Exception: {excp}")
             return None
         new_name = context.layers.free_layer_name("XenCoreDumpLayer")
-        context.config[
-            interfaces.configuration.path_join(new_name, "base_layer")
-        ] = layer_name
+        context.config[interfaces.configuration.path_join(new_name, "base_layer")] = (
+            layer_name
+        )
 
         return XenCoreDumpLayer(context, new_name, new_name)
diff --git a/volatility3/framework/objects/__init__.py b/volatility3/framework/objects/__init__.py
index 831856e3d..316a30bec 100644
--- a/volatility3/framework/objects/__init__.py
+++ b/volatility3/framework/objects/__init__.py
@@ -768,12 +768,10 @@ class Array(interfaces.objects.ObjectInterface, collections.abc.Sequence):
             raise IndexError(f"Member not present in array template: {child}")
 
     @overload
-    def __getitem__(self, i: int) -> interfaces.objects.Template:
-        ...
+    def __getitem__(self, i: int) -> interfaces.objects.Template: ...
 
     @overload
-    def __getitem__(self, s: slice) -> List[interfaces.objects.Template]:
-        ...
+    def __getitem__(self, s: slice) -> List[interfaces.objects.Template]: ...
 
     def __getitem__(self, i):
         """Returns the i-th item from the array."""
diff --git a/volatility3/framework/plugins/mac/pslist.py b/volatility3/framework/plugins/mac/pslist.py
index 88045a277..9b570f3f9 100644
--- a/volatility3/framework/plugins/mac/pslist.py
+++ b/volatility3/framework/plugins/mac/pslist.py
@@ -49,9 +49,7 @@ class PsList(interfaces.plugins.PluginInterface):
         ]
 
     @classmethod
-    def get_list_tasks(
-        cls, method: str
-    ) -> Callable[
+    def get_list_tasks(cls, method: str) -> Callable[
         [interfaces.context.ContextInterface, str, Callable[[int], bool]],
         Iterable[interfaces.objects.ObjectInterface],
     ]:
diff --git a/volatility3/framework/plugins/windows/crashinfo.py b/volatility3/framework/plugins/windows/crashinfo.py
index 4ecd85087..862eb6080 100644
--- a/volatility3/framework/plugins/windows/crashinfo.py
+++ b/volatility3/framework/plugins/windows/crashinfo.py
@@ -46,9 +46,9 @@ class Crashinfo(interfaces.plugins.PluginInterface):
             bitmap_size = format_hints.Hex(summary_header.BitmapSize)
             bitmap_pages = format_hints.Hex(summary_header.Pages)
         else:
-            bitmap_header_size = (
-                bitmap_size
-            ) = bitmap_pages = renderers.NotApplicableValue()
+            bitmap_header_size = bitmap_size = bitmap_pages = (
+                renderers.NotApplicableValue()
+            )
 
         yield (
             0,
diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py
index 7e4e1ca18..a266fd864 100644
--- a/volatility3/framework/plugins/windows/mftscan.py
+++ b/volatility3/framework/plugins/windows/mftscan.py
@@ -176,7 +176,6 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
 
 
 class ADS(interfaces.plugins.PluginInterface):
-
     """Scans for Alternate Data Stream"""
 
     _required_framework_version = (2, 0, 0)
diff --git a/volatility3/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py
index d0bbd5cbd..62ead3ab7 100644
--- a/volatility3/framework/plugins/windows/netscan.py
+++ b/volatility3/framework/plugins/windows/netscan.py
@@ -487,10 +487,12 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
             if not isinstance(row_data[9], datetime.datetime):
                 continue
             row_data = [
-                "N/A"
-                if isinstance(i, renderers.UnreadableValue)
-                or isinstance(i, renderers.UnparsableValue)
-                else i
+                (
+                    "N/A"
+                    if isinstance(i, renderers.UnreadableValue)
+                    or isinstance(i, renderers.UnparsableValue)
+                    else i
+                )
                 for i in row_data
             ]
             description = (
diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py
index e248c19bc..180f8f9d9 100644
--- a/volatility3/framework/plugins/windows/registry/printkey.py
+++ b/volatility3/framework/plugins/windows/registry/printkey.py
@@ -193,9 +193,9 @@ class PrintKey(interfaces.plugins.PluginInterface):
                     vollog.debug(
                         "Couldn't read registry value type, so data is unreadable"
                     )
-                    value_data: Union[
-                        interfaces.renderers.BaseAbsentValue, bytes
-                    ] = renderers.UnreadableValue()
+                    value_data: Union[interfaces.renderers.BaseAbsentValue, bytes] = (
+                        renderers.UnreadableValue()
+                    )
                 else:
                     try:
                         value_data = node.decode_data()
diff --git a/volatility3/framework/renderers/conversion.py b/volatility3/framework/renderers/conversion.py
index bf7da9ecb..bb18fcc8a 100644
--- a/volatility3/framework/renderers/conversion.py
+++ b/volatility3/framework/renderers/conversion.py
@@ -28,9 +28,9 @@ def wintime_to_datetime(
 def unixtime_to_datetime(
     unixtime: int,
 ) -> Union[interfaces.renderers.BaseAbsentValue, datetime.datetime]:
-    ret: Union[
-        interfaces.renderers.BaseAbsentValue, datetime.datetime
-    ] = renderers.UnparsableValue()
+    ret: Union[interfaces.renderers.BaseAbsentValue, datetime.datetime] = (
+        renderers.UnparsableValue()
+    )
 
     if unixtime > 0:
         with contextlib.suppress(ValueError):
diff --git a/volatility3/framework/symbols/__init__.py b/volatility3/framework/symbols/__init__.py
index 10cf39cf1..d1e7a104d 100644
--- a/volatility3/framework/symbols/__init__.py
+++ b/volatility3/framework/symbols/__init__.py
@@ -35,9 +35,9 @@ class SymbolSpace(interfaces.symbols.SymbolSpaceInterface):
 
     def __init__(self) -> None:
         super().__init__()
-        self._dict: Dict[
-            str, interfaces.symbols.BaseSymbolTableInterface
-        ] = collections.OrderedDict()
+        self._dict: Dict[str, interfaces.symbols.BaseSymbolTableInterface] = (
+            collections.OrderedDict()
+        )
         # Permanently cache all resolved symbols
         self._resolved: Dict[str, interfaces.objects.Template] = {}
         self._resolved_symbols: Dict[str, interfaces.objects.Template] = {}
@@ -73,9 +73,9 @@ class SymbolSpace(interfaces.symbols.SymbolSpaceInterface):
         self, offset: int, size: int = 0, table_name: str = None
     ) -> Iterable[str]:
         """Returns all symbols that exist at a specific relative address."""
-        table_list: Iterable[
-            interfaces.symbols.BaseSymbolTableInterface
-        ] = self._dict.values()
+        table_list: Iterable[interfaces.symbols.BaseSymbolTableInterface] = (
+            self._dict.values()
+        )
         if table_name is not None:
             if table_name in self._dict:
                 table_list = [self._dict[table_name]]
@@ -179,15 +179,15 @@ class SymbolSpace(interfaces.symbols.SymbolSpaceInterface):
                         if child.vol.type_name not in self._resolved:
                             traverse_list.append(child.vol.type_name)
                             try:
-                                self._resolved[
-                                    child.vol.type_name
-                                ] = self._weak_resolve(
-                                    SymbolType.TYPE, child.vol.type_name
+                                self._resolved[child.vol.type_name] = (
+                                    self._weak_resolve(
+                                        SymbolType.TYPE, child.vol.type_name
+                                    )
                                 )
                             except exceptions.SymbolError:
-                                self._resolved[
-                                    child.vol.type_name
-                                ] = self.UnresolvedTemplate(child.vol.type_name)
+                                self._resolved[child.vol.type_name] = (
+                                    self.UnresolvedTemplate(child.vol.type_name)
+                                )
                         # Stash the replacement
                         replacements.add((traverser, child))
                     elif child.children:
diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py
index d435851d7..846e5bd90 100755
--- a/volatility3/framework/symbols/windows/extensions/__init__.py
+++ b/volatility3/framework/symbols/windows/extensions/__init__.py
@@ -452,9 +452,9 @@ class FILE_OBJECT(objects.StructType, pool.ExecutiveObject):
         ].is_valid(self.FileName.Buffer)
 
     def file_name_with_device(self) -> Union[str, interfaces.renderers.BaseAbsentValue]:
-        name: Union[
-            str, interfaces.renderers.BaseAbsentValue
-        ] = renderers.UnreadableValue()
+        name: Union[str, interfaces.renderers.BaseAbsentValue] = (
+            renderers.UnreadableValue()
+        )
 
         # this pointer needs to be checked against native_layer_name because the object may
         # be instantiated from a primary (virtual) layer or a memory (physical) layer.
diff --git a/volatility3/plugins/windows/statistics.py b/volatility3/plugins/windows/statistics.py
index 9915312e3..7f56b75f8 100644
--- a/volatility3/plugins/windows/statistics.py
+++ b/volatility3/plugins/windows/statistics.py
@@ -31,13 +31,9 @@ class Statistics(plugins.PluginInterface):
         # Do mass mapping and determine the number of different layers and how many pages go to each one
         layer = self.context.layers[self.config["primary"]]
 
-        page_count = (
-            swap_count
-        ) = (
-            invalid_page_count
-        ) = (
-            large_page_count
-        ) = large_swap_count = large_invalid_count = other_invalid = 0
+        page_count = swap_count = invalid_page_count = large_page_count = (
+            large_swap_count
+        ) = large_invalid_count = other_invalid = 0
 
         if isinstance(layer, intel.Intel):
             page_addr = 0

From ba488c78cd02478a60ba94a72d1c6a712f02c365 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 31 Jan 2024 21:13:00 +0000
Subject: [PATCH 33/34] Documentation: Bump the copyright here to 2024

---
 doc/source/conf.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/conf.py b/doc/source/conf.py
index d601c1eee..cabfdc327 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -169,7 +169,7 @@ master_doc = "index"
 
 # General information about the project.
 project = "Volatility 3"
-copyright = "2012-2022, Volatility Foundation"
+copyright = "2012-2024, Volatility Foundation"
 
 # The version info for the project you're documenting, acts as replacement for
 # |version| and |release|, also used in various other places throughout the

From f95be04305d7fe1bedf599849d40996f82d2032b Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 31 Jan 2024 21:13:00 +0000
Subject: [PATCH 34/34] Documentation: Bump the copyright here to 2024

---
 doc/source/conf.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/source/conf.py b/doc/source/conf.py
index d601c1eee..cabfdc327 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -169,7 +169,7 @@ master_doc = "index"
 
 # General information about the project.
 project = "Volatility 3"
-copyright = "2012-2022, Volatility Foundation"
+copyright = "2012-2024, Volatility Foundation"
 
 # The version info for the project you're documenting, acts as replacement for
 # |version| and |release|, also used in various other places throughout the