Commit Graph
5943 Commits
Author SHA1 Message Date
David McDonald 0b1bbb87ee Windows Tests: Update userassist JSON output
The new layer data type renders the output a little differently, and the
plugin also seems to render 'N/A' for a missing value where previously
it was an empty string.
2025-04-02 09:36:07 -05:00
Mike Auty d3d19fe776 CLI: Handle BaseAbsentValues in JSON 2025-04-01 23:38:05 +01:00
Mike Auty aad6a56336 Fix old typing mechanism 2025-04-01 23:20:49 +01:00
Mike Auty e2fb96a0d3 Fix up JSON rendering of hex bytes and LayerData 2025-04-01 23:14:03 +01:00
Mike Auty 9791ae5878 Fix up direct import issue 2025-04-01 22:23:03 +01:00
ikelosandGitHub 377697cc43 Merge pull request #1622 from volatilityfoundation/feature/data-renderer
Feature/data renderer
2025-04-01 22:16:28 +01:00
ikelosandGitHub e91dfb2673 Merge pull request #1755 from volatilityfoundation/update_and_fix_bugs_check_afinfo
Fix several bugs in check_afinfo. Update through latest kernels. Matc…
2025-04-01 22:07:26 +01:00
Andrew Case caedfc564f Fix black error 2025-04-01 13:34:24 +00:00
ikelosandGitHub 2ca5fd5fe5 Update volatility3/framework/plugins/linux/check_afinfo.py
Fix up ruff error.
2025-04-01 11:22:55 +01:00
ikelosGitHubCopilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
9c58cfc2a8 Potential fix for code scanning alert no. 416: Implicit string concatenation in a list
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
2025-04-01 11:20:48 +01:00
Andrew Case 524d89ad6c Fix several bugs in check_afinfo. Update through latest kernels. Match current Volatility coding standards 2025-03-31 23:08:49 +00:00
ikelosandGitHub c0aea41168 Merge pull request #1750 from volatilityfoundation/import_checker
Testing: Check + fix 'import from' statements
2025-03-29 21:40:22 +00:00
David McDonald 1412004422 Make registry_layers -> registry_layer for consistency 2025-03-29 15:56:25 -05:00
David McDonald c17bcb644b Revert changes to intel.py 2025-03-29 15:51:19 -05:00
David McDonald ee3d965ef6 Revert changes to configuration.py 2025-03-29 15:50:36 -05:00
David McDonald 296cb3c113 Code Analysis: Give pass to 'volatility3'
Also moves some code into a private method with a docstring in the
visitor class.
2025-03-29 15:49:33 -05:00
David McDonald f72b717c00 Comment type annotation to fix circular import 2025-03-29 15:49:33 -05:00
David McDonald a3353a3cb6 CI Testing: Renames script and updates job name 2025-03-29 15:49:33 -05:00
David McDonald 47646c12d4 Framework: Fix all direct non-module imports
This fixes all import from statements in the codebase that were
importing things other than modules into module namespaces from other
volatility3 modules. This should prevent accidental re-exporting.
2025-03-29 15:49:33 -05:00
David McDonald e62cee391a Testing: Adds validation of vol3 imports in check script
This checks `ast.ImportFrom` statements to see if anything other than
modules are being imported in this way. It enumerates all instances of
this and suggests a fix.
2025-03-29 15:49:33 -05:00
ikelosandGitHub 61e743036c Merge pull request #1753 from volatilityfoundation/feature/use-less-memory-2
Don't completely remove the chainmap, but change one dict to a namedm…
2025-03-29 15:20:45 +00:00
Mike Auty b73e4f0d2b Don't completely remove the chainmap, but change one dict to a namedmapping 2025-03-29 14:32:14 +00:00
ikelosandGitHub e1613d6ced Merge pull request #1752 from volatilityfoundation/revert-1736-feature/use-less-memory
Revert "Feature/use less memory"
2025-03-29 12:59:03 +00:00
ikelosandGitHub 07f7a2e2be Revert "Feature/use less memory" 2025-03-29 12:48:47 +00:00
ikelosandGitHub 2ff83404bc Merge pull request #1736 from volatilityfoundation/feature/use-less-memory
Feature/use less memory
2025-03-29 12:33:51 +00:00
ikelosandGitHub a79c58bcce Merge pull request #1743 from volatilityfoundation/requirement_checks_github_action
Testing: Verify `VersionRequirement`s
2025-03-28 22:30:44 +00:00
David McDonald 6452fc18bd Tone down language severity in messages 2025-03-28 15:39:09 -05:00
David McDonald d7695ab9cf Simplify error message output 2025-03-28 15:36:54 -05:00
David McDonald 46e3b8ffdb Check for 'hidden' attribute when determining classes to validate 2025-03-28 15:22:37 -05:00
David McDonald 196556eab3 Test: Allow for other types of coding style violations 2025-03-28 15:18:22 -05:00
ikelosandGitHub eec87d2512 Merge pull request #1749 from eve-mem/volshell_fix_1714
Volshell: handle case where paged out member would cause backtrace for dt output.
2025-03-28 19:49:47 +00:00
eve 23f2157931 Volshell: update display_type to handle struct members that are also python functions, e.g. write(). Thanks to @atcuno for the suggestion 2025-03-28 18:50:10 +00:00
eve e21eb57b90 Volshell: handle case where paged out member would cause backtrace for dt output. Thanks to @atcuno for the code! 2025-03-28 18:40:51 +00:00
David McDonald d0a1daf82c ModuleExtract: Add missing requirement 2025-03-28 13:24:51 -05:00
David McDonald 27e59263a6 Docstring: explain version-checking script
This documents the general behavior and expectations of the
version-checking CI script.
2025-03-28 13:22:01 -05:00
David McDonald 03c6477902 Volshell: Attempt to resolve requirement conflicts
This change sets the `script`, `script-only`, and `primary` requirements
to only apply to the `generic.Volshell` class. `regex-scanner` is okay
to be shared between the base and inherited classes, but `script` and
`script-only` have to be generic-only in order to avoid conflicts when
populating the argparse parser.

`primary` must be generic-only in order to avoid ending up unsatisfied
when superclass requirements require a module, suppressing construction
of the `primary` layer.
2025-03-28 13:22:01 -05:00
David McDonald 9f024cf0f4 Refactor: use builtin ast lib instead of treesitter
Instead of using the tree-sitter third party library, this uses Python's
`ast` module to parse the source code and traverse the tree with a
visitor pattern. This is preferred because it's native to the language
itself, and Python developers are more likely to be familiar with it.
The traversal also handles nested scopes better than the prior
implementation. For example, classes that are declared inside of other
classes can now be looked up even though they don't exist at the top
level of the module namespace, since any time a class definition is
entered, that class is pushed to the top of a stack that can be examined
when visiting inner classes.

This also adds lots of log messages at different levels, plus a command
line argument for specifying verbosity, which should help with debugging
down the line.
2025-03-28 13:22:01 -05:00
David McDonald 68116556a8 Add calls to super().get_requirements() on inherited classes 2025-03-28 13:22:01 -05:00
David McDonald 0f73686364 Framework: Fix remaining missing requirements
This adds all of the missing requirements discovered via the new code
analysis script.
2025-03-28 13:22:01 -05:00
David McDonald 2ad1536b4e Testing: Verify VersionRequirements
This adds a script and GitHub action to the `test` directory that
dynamically imports all modules in `volatility3`, searches for usages of
`VersionableInterface` objects within classes that inherit from
`ConfigurableInterface` but don't enumerate the used component as a
requirement in `get_requirements()`, and returns -1 if any violations
are found.

Fixes
2025-03-28 13:21:10 -05:00
ikelosandGitHub 49d0404031 Merge pull request #1747 from volatilityfoundation/issues/update-api-changes-log
Update the various MINOR version bumps to the current version
2025-03-28 16:37:40 +00:00
ikelosandGitHub f844f80d2a Update API_CHANGES.md
Fix typo highlighted by @eve-mem
2025-03-28 14:29:35 +00:00
ikelosandGitHub d77d69cffa Merge pull request #1746 from volatilityfoundation/fix_hidden_modules
Fix hidden_modules to actually list hidden modules...
2025-03-28 01:48:12 +00:00
Mike Auty ee0ad0b4af Update the various MINOR version bumps to the current version 2025-03-28 01:46:14 +00:00
Andrew Case a3069a3192 Fix hidden_modules to actually list hidden modules... 2025-03-27 20:06:09 -05:00
ikelosandGitHub e8e8e76e79 Merge pull request #1740 from volatilityfoundation/lkm_extraction
Add module extraction API. Add plugin to directly extract modules. Ho…
2025-03-28 00:55:57 +00:00
Andrew Case 61575ca2b1 Require parity framework version 2025-03-27 19:30:58 -05:00
Andrew Case aab95ea18e Add required interface version to plugin 2025-03-27 18:39:29 -05:00
Andrew Case 5cfd55eba8 ordering fix 2025-03-27 17:17:08 -05:00
Andrew Case ed7e013aac Bug fix 2025-03-27 17:06:14 -05:00