From b04ca88d0754bfc2e79fbe70c9280eba344d8375 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 17 Dec 2024 13:28:37 -0600 Subject: [PATCH 1/2] Windows Extensions: Fixes type-hint on list_timers This method is incorrectly type-hinted as returning a `Tuple` when it should be returning an instance of the `KTIMER` extension class. This leaves the version number as is since it only updates the type-hint, but let me know if that's incorrect and we need to bump it. --- volatility3/framework/plugins/windows/timers.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/timers.py b/volatility3/framework/plugins/windows/timers.py index d49c28784..fad25df72 100644 --- a/volatility3/framework/plugins/windows/timers.py +++ b/volatility3/framework/plugins/windows/timers.py @@ -14,7 +14,7 @@ from volatility3.framework import ( ) from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints -from volatility3.framework.symbols.windows import versions +from volatility3.framework.symbols.windows import versions, extensions from volatility3.plugins.windows import ssdt, kpcrs vollog = logging.getLogger(__name__) @@ -49,7 +49,7 @@ class Timers(interfaces.plugins.PluginInterface): kernel_module_name: str, layer_name: str, symbol_table: str, - ) -> Iterable[Tuple[str, int, str]]: + ) -> Iterable[extensions.KTIMER]: """Lists all kernel timers. Args: From c134dcd64306e3c5f355f97d4e117d34c3e76f33 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 17 Dec 2024 13:55:34 -0600 Subject: [PATCH 2/2] Windows Timers: Bump patch version --- volatility3/framework/plugins/windows/timers.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/timers.py b/volatility3/framework/plugins/windows/timers.py index fad25df72..8bd7c8eb4 100644 --- a/volatility3/framework/plugins/windows/timers.py +++ b/volatility3/framework/plugins/windows/timers.py @@ -24,7 +24,7 @@ class Timers(interfaces.plugins.PluginInterface): """Print kernel timers and associated module DPCs""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: