diff --git a/test/test_volatility.py b/test/test_volatility.py index a55dffb27..eb713783b 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -199,6 +199,17 @@ def test_windows_callbacks(image, volatility, python): assert out.count(b"KeBugCheckReasonCallbackListHead ") > 5 assert rc == 0 +def test_windows_devicetree(image, volatility, python): + rc, out, err = runvol_plugin("windows.devicetree.DeviceTree", image, volatility, python) + + assert out.find(b"DEV") != -1 + assert out.find(b"DRV") != -1 + assert out.find(b"ATT") != -1 + assert out.find(b"FILE_DEVICE_CONTROLLER") != -1 + assert out.find(b"FILE_DEVICE_DISK") != -1 + assert out.find(b"FILE_DEVICE_DISK_FILE_SYSTEM") != -1 + assert rc == 0 + # LINUX def test_linux_pslist(image, volatility, python):