testcases: Add basic volshell testcases for each OS image

.github/workflows/test.yaml

@@ -42,6 +42,11 @@ jobs:
 
     - name: Testing...
       run: |
+        # VolShell
+        pytest ./test/test_volatility.py --volatility=volshell.py --image-dir=./test_images -k test_windows_volshell -v
+        pytest ./test/test_volatility.py --volatility=volshell.py --image-dir=./test_images -k test_linux_volshell -v
+
+        # Volatility
         pytest ./test/test_volatility.py --volatility=vol.py --image-dir=./test_images -k test_windows -v
         pytest ./test/test_volatility.py --volatility=vol.py --image-dir=./test_images -k test_linux -v
 

test/test_volatility.py

@@ -54,13 +54,56 @@ def runvol_plugin(plugin, img, volatility, python, pluginargs=[], globalargs=[])
     return runvol(args, volatility, python)
 
 
+def runvolshell(img, volshell, python, volshellargs=[], globalargs=[]):
+    args = (
+        globalargs
+        + [
+            "--single-location",
+            img,
+            "-q",
+        ]
+        + volshellargs
+    )
+
+    return runvol(args, volshell, python)
+
+
 #
 # TESTS
 #
 
+
+def basic_volshell_test(image, volatility, python):
+    # Basic VolShell test to verify requirements and ensure VolShell runs without crashing
+
+    # FIXME: When the minimum Python version includes 3.12, replace the following with:
+    # with tempfile.NamedTemporaryFile(delete_on_close=False) as fd: ...
+    fd, filename = tempfile.mkstemp(suffix=".txt")
+    try:
+        with os.fdopen(fd, "w") as f:
+            f.write("exit()")
+
+        rc, out, _err = runvolshell(
+            img=image,
+            volshell=volatility,
+            python=python,
+            volshellargs=["--script", filename],
+        )
+    finally:
+        with contextlib.suppress(FileNotFoundError):
+            os.remove(filename)
+
+    assert rc == 0
+    assert out.count(b"\n") >= 4
+
+
 # WINDOWS
 
 
+def test_windows_volshell(image, volatility, python):
+    basic_volshell_test(image, volatility, python)
+
+
 def test_windows_pslist(image, volatility, python):
     rc, out, _err = runvol_plugin("windows.pslist.PsList", image, volatility, python)
     out = out.lower()
@@ -332,6 +375,10 @@ def test_windows_vadyarascan_yara_string(image, volatility, python):
 # LINUX
 
 
+def test_linux_volshell(image, volatility, python):
+    basic_volshell_test(image, volatility, python)
+
+
 def test_linux_pslist(image, volatility, python):
     rc, out, _err = runvol_plugin("linux.pslist.PsList", image, volatility, python)
 
@@ -770,6 +817,10 @@ def test_linux_hidden_modules(image, volatility, python):
 # MAC
 
 
+def test_mac_volshell(image, volatility, python):
+    basic_volshell_test(image, volatility, python)
+
+
 def test_mac_pslist(image, volatility, python):
     rc, out, _err = runvol_plugin("mac.pslist.PsList", image, volatility, python)
     out = out.lower()