Merge branch 'volatilityfoundation:develop' into linux_sockscan

test/plugins/linux/linux.py

@@ -29,7 +29,7 @@ class TestLinuxPslist:
 class TestLinuxCheckIdt:
     def test_linux_generic_check_idt(self, image, volatility, python):
         rc, out, _err = test_volatility.runvol_plugin(
-            "linux.check_idt.Check_idt", image, volatility, python
+            "linux.malware.check_idt.Check_idt", image, volatility, python
         )
 
         assert rc == 0
@@ -41,7 +41,7 @@ class TestLinuxCheckIdt:
 class TestLinuxCheckSyscall:
     def test_linux_generic_check_syscall(self, image, volatility, python):
         rc, out, _err = test_volatility.runvol_plugin(
-            "linux.check_syscall.Check_syscall", image, volatility, python
+            "linux.malware.check_syscall.Check_syscall", image, volatility, python
         )
 
         assert rc == 0
@@ -89,7 +89,7 @@ class TestLinuxProcMaps:
 class TestLinuxTtyCheck:
     def test_linux_generic_tty_check(self, image, volatility, python):
         rc, out, _err = test_volatility.runvol_plugin(
-            "linux.tty_check.tty_check", image, volatility, python
+            "linux.malware.tty_check.Tty_Check", image, volatility, python
         )
 
         assert rc == 0
@@ -200,7 +200,7 @@ class TestLinuxCapabilities:
 class TestLinuxCheckCreds:
     def test_linux_generic_check_creds(self, image, volatility, python):
         rc, out, _err = test_volatility.runvol_plugin(
-            "linux.check_creds.Check_creds", image, volatility, python
+            "linux.malware.check_creds.Check_creds", image, volatility, python
         )
 
         # linux-sample-1.bin has no processes sharing credentials.
@@ -251,7 +251,7 @@ class TestLinuxKthreads:
 class TestLinuxMalfind:
     def test_linux_generic_malfind(self, image, volatility, python):
         rc, out, _err = test_volatility.runvol_plugin(
-            "linux.malfind.Malfind", image, volatility, python
+            "linux.malware.malfind.Malfind", image, volatility, python
         )
 
         # linux-sample-1.bin has no process memory ranges with potential injected code.
@@ -426,7 +426,7 @@ class TestLinuxPageCacheInodepages:
 class TestLinuxCheckAfinfo:
     def test_linux_generic_check_afinfo(self, image, volatility, python):
         rc, out, _err = test_volatility.runvol_plugin(
-            "linux.check_afinfo.Check_afinfo", image, volatility, python
+            "linux.malware.check_afinfo.Check_afinfo", image, volatility, python
         )
 
         # linux-sample-1.bin has no suspicious results.
@@ -438,7 +438,7 @@ class TestLinuxCheckAfinfo:
 class TestLinuxCheckModules:
     def test_linux_generic_check_modules(self, image, volatility, python):
         rc, out, _err = test_volatility.runvol_plugin(
-            "linux.check_modules.Check_modules", image, volatility, python
+            "linux.malware.check_modules.Check_modules", image, volatility, python
         )
 
         # linux-sample-1.bin has no suspicious results.
@@ -479,7 +479,10 @@ class TestLinuxIomem:
 class TestLinuxKeyboardNotifiers:
     def test_linux_generic_keyboard_notifiers(self, image, volatility, python):
         rc, out, _err = test_volatility.runvol_plugin(
-            "linux.keyboard_notifiers.Keyboard_notifiers", image, volatility, python
+            "linux.malware.keyboard_notifiers.Keyboard_notifiers",
+            image,
+            volatility,
+            python,
         )
 
         # linux-sample-1.bin has no suspicious results for this plugin.
@@ -501,7 +504,7 @@ class TestLinuxKmesg:
 class TestLinuxNetfilter:
     def test_linux_generic_netfilter(self, image, volatility, python):
         rc, out, _err = test_volatility.runvol_plugin(
-            "linux.netfilter.Netfilter", image, volatility, python
+            "linux.malware.netfilter.Netfilter", image, volatility, python
         )
 
         # linux-sample-1.bin has no suspicious results for this plugin.
@@ -525,7 +528,7 @@ class TestLinuxHiddenModules:
         # TODO: this check should be specific, against a distinct infected sample
         image = LinuxSamples.LINUX_GENERIC.value.path
         rc, out, _err = test_volatility.runvol_plugin(
-            "linux.hidden_modules.Hidden_modules", image, volatility, python
+            "linux.malware.hidden_modules.Hidden_modules", image, volatility, python
         )
 
         # linux-sample-1.bin has no hidden modules.

test/plugins/windows/windows.py

@@ -4,6 +4,7 @@ import json
 import os
 import shutil
 import tempfile
+
 from test import WindowsSamples, test_volatility
 
 
@@ -59,6 +60,16 @@ class TestWindowsPslist:
         assert test_volatility.match_output_row(expected_row, json.loads(out))
 
 
+class TestWindowsTimeliner:
+    def test_windows_specific_timeliner(self, volatility, python):
+        image = WindowsSamples.WINDOWSXP_GENERIC.value.path
+        rc, out, _err = test_volatility.runvol_plugin(
+            "timeliner.Timeliner", image, volatility, python
+        )
+        assert rc == 0
+        assert out.count(b"\n") > 10
+
+
 class TestWindowsPsscan:
     def test_windows_specific_psscan(self, volatility, python):
         image = WindowsSamples.WINDOWSXP_GENERIC.value.path
@@ -427,7 +438,7 @@ class TestWindowsVadyarascan:
 class TestWindowsAmcache:
     def test_windows_generic_amcache(self, volatility, python, image):
         rc, out, _err = test_volatility.runvol_plugin(
-            "windows.amcache.Amcache",
+            "windows.registry.amcache.Amcache",
             image,
             volatility,
             python,
@@ -482,7 +493,7 @@ class TestWindowsBigPools:
 # class TestWindowsCachedump:
 #     def test_windows_generic_cachedump(self, volatility, python, image):
 #         rc, out, _err = test_volatility.runvol_plugin(
-#             "windows.cachedump.Cachedump",
+#             "windows.registry.cachedump.Cachedump",
 #             image,
 #             volatility,
 #             python,
@@ -772,19 +783,19 @@ class TestWindowsSymlinkScan:
         assert test_volatility.count_entries_flat(json_out) > 5
         expected_rows = [
             {
-              "CreateTime": "2005-06-25T16:47:28+00:00",
-              "From Name": "AUX",
-              "Offset": 453082584,
-              "To Name": "\\DosDevices\\COM1",
-              "__children": []
+                "CreateTime": "2005-06-25T16:47:28+00:00",
+                "From Name": "AUX",
+                "Offset": 453082584,
+                "To Name": "\\DosDevices\\COM1",
+                "__children": [],
             },
             {
-              "CreateTime": "2005-06-25T16:47:28+00:00",
-              "From Name": "UNC",
-              "Offset": 453176664,
-              "To Name": "\\Device\\Mup",
-              "__children": []
-            }
+                "CreateTime": "2005-06-25T16:47:28+00:00",
+                "From Name": "UNC",
+                "Offset": 453176664,
+                "To Name": "\\Device\\Mup",
+                "__children": [],
+            },
         ]
 
         for expected_row in expected_rows:
@@ -795,7 +806,7 @@ class TestWindowsLdrModules:
     def test_windows_specific_ldrmodules(self, volatility, python):
         image = WindowsSamples.WINDOWSXP_GENERIC.value.path
         rc, out, _err = test_volatility.runvol_plugin(
-            "windows.ldrmodules.LdrModules",
+            "windows.malware.ldrmodules.LdrModules",
             image,
             volatility,
             python,
@@ -810,7 +821,7 @@ class TestWindowsLsadump:
     def test_windows_specific_lsadump(self, volatility, python):
         image = WindowsSamples.WINDOWSXP_GENERIC.value.path
         rc, out, _err = test_volatility.runvol_plugin(
-            "windows.lsadump.Lsadump",
+            "windows.registry.lsadump.Lsadump",
             image,
             volatility,
             python,