David McDonald
41de562e55
Revert "Add versioning to MFT extension classes"
...
This reverts commit 1d20e65759
2025-04-03 17:56:16 -05:00
David McDonald
ebbbe913dc
Convert remaining values to Python primitives
2025-04-03 17:55:42 -05:00
David McDonald
1d20e65759
Add versioning to MFT extension classes
2025-04-03 17:39:14 -05:00
David McDonald
8b308133f5
Bump required version numbers
2025-04-03 17:32:25 -05:00
David McDonald
9f85e1465e
Major version bumps for all three plugins
2025-04-03 17:19:17 -05:00
David McDonald
5fda7409eb
Log InvalidAddressException instances
2025-04-03 17:18:20 -05:00
David McDonald
41cf17ed65
Refactor: Ditch dictionary usage, eliminate callbacks
...
This simplifies the design of these plugins by moving as much MFTEntry
specific data into the extension class (caching attributes, since
they'll need to be accessed repeatedly) and moving away from the
callback-based implementation to one where classmethods consume
`mft.MFTEntry` objects in order to produce their values.
These changes do two important things:
- They allow us to preserve `object.String` objects until the generator
function, which makes the public interface much better since people
can navigate back the the source of the data within their context
- Completely eliminates the `record_map` that was causing so much memory
consumption.
2025-04-03 17:18:20 -05:00
David McDonald
43e6fefe39
Add attribute iterator to MFTEntry extension class
2025-04-03 11:33:56 -05:00
David McDonald
4492da0263
Create attribute iterator method
...
Moves logic for iterating through `MFTEntry` attributes into a new
`attributes()` method on the extension class.
2025-04-03 10:40:05 -05:00
David McDonald
e84036c5a6
Add missing 'e' to variable names
2025-04-03 10:02:08 -05:00
57524edb87
Remove unnecessary quotes from type hints
...
Co-authored-by: ikelos <ikelos@users.noreply.github.com >
2025-04-03 09:58:35 -05:00
David McDonald
86c5c16ed6
Windows MFTScan Plugins: Performance fixes
...
There was a subtle issue that was causing substantial performance issues
in the MFTScan plugins. The `record_map` was purportedly of type
`Dict[str, Tuple[int, str, int]]`, but in reality, the second member was
a list, and its `str` item was actually being populated with unprocessed
values from method calls on the MFT extension classes, which actually
return `object.String`. These objects are substantially larger than
basic `str` types:
```
[ins] In [5]: pympler.asizeof.asizeof(rec_name)
Out[5]: 312648
[ins] In [6]: pympler.asizeof.asizeof(str(rec_name))
Out[6]: 64
```
This caused this dictionary to grow in size to several gigabytes on
larger samples, resulting in thrashing and OOM errors.
2025-04-02 15:46:47 -05:00
David McDonald
3c3b2b3bbd
MFT Extensions: Fix type hints
...
These type hints are a bit misleading, and have been updated to reflect
their real return type.
2025-04-02 15:16:15 -05:00
ikelos and GitHub
0fb721e219
Merge pull request #1757 from volatilityfoundation/fix_tests
...
Tests: Fix Userassist and MFTScan testdata
2025-04-02 21:04:46 +01:00
David McDonald
5befbf8629
Tests: Fix MFTScan testdata
...
These test values needed updating now that the `LayerData` type is used
and presents the data a little differently than before.
2025-04-02 14:08:18 -05:00
David McDonald
e446c1081d
Remove debugging call
2025-04-02 09:43:20 -05:00
David McDonald
0b1bbb87ee
Windows Tests: Update userassist JSON output
...
The new layer data type renders the output a little differently, and the
plugin also seems to render 'N/A' for a missing value where previously
it was an empty string.
2025-04-02 09:36:07 -05:00
Mike Auty
d3d19fe776
CLI: Handle BaseAbsentValues in JSON
2025-04-01 23:38:05 +01:00
Mike Auty
aad6a56336
Fix old typing mechanism
2025-04-01 23:20:49 +01:00
Mike Auty
e2fb96a0d3
Fix up JSON rendering of hex bytes and LayerData
2025-04-01 23:14:03 +01:00
Mike Auty
9791ae5878
Fix up direct import issue
2025-04-01 22:23:03 +01:00
ikelos and GitHub
377697cc43
Merge pull request #1622 from volatilityfoundation/feature/data-renderer
...
Feature/data renderer
2025-04-01 22:16:28 +01:00
ikelos and GitHub
e91dfb2673
Merge pull request #1755 from volatilityfoundation/update_and_fix_bugs_check_afinfo
...
Fix several bugs in check_afinfo. Update through latest kernels. Matc…
2025-04-01 22:07:26 +01:00
Andrew Case
caedfc564f
Fix black error
2025-04-01 13:34:24 +00:00
ikelos and GitHub
2ca5fd5fe5
Update volatility3/framework/plugins/linux/check_afinfo.py
...
Fix up ruff error.
2025-04-01 11:22:55 +01:00
9c58cfc2a8
Potential fix for code scanning alert no. 416: Implicit string concatenation in a list
...
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
2025-04-01 11:20:48 +01:00
Andrew Case
524d89ad6c
Fix several bugs in check_afinfo. Update through latest kernels. Match current Volatility coding standards
2025-03-31 23:08:49 +00:00
ikelos and GitHub
c0aea41168
Merge pull request #1750 from volatilityfoundation/import_checker
...
Testing: Check + fix 'import from' statements
2025-03-29 21:40:22 +00:00
David McDonald
1412004422
Make registry_layers -> registry_layer for consistency
2025-03-29 15:56:25 -05:00
David McDonald
c17bcb644b
Revert changes to intel.py
2025-03-29 15:51:19 -05:00
David McDonald
ee3d965ef6
Revert changes to configuration.py
2025-03-29 15:50:36 -05:00
David McDonald
296cb3c113
Code Analysis: Give pass to 'volatility3'
...
Also moves some code into a private method with a docstring in the
visitor class.
2025-03-29 15:49:33 -05:00
David McDonald
f72b717c00
Comment type annotation to fix circular import
2025-03-29 15:49:33 -05:00
David McDonald
a3353a3cb6
CI Testing: Renames script and updates job name
2025-03-29 15:49:33 -05:00
David McDonald
47646c12d4
Framework: Fix all direct non-module imports
...
This fixes all import from statements in the codebase that were
importing things other than modules into module namespaces from other
volatility3 modules. This should prevent accidental re-exporting.
2025-03-29 15:49:33 -05:00
David McDonald
e62cee391a
Testing: Adds validation of vol3 imports in check script
...
This checks `ast.ImportFrom` statements to see if anything other than
modules are being imported in this way. It enumerates all instances of
this and suggests a fix.
2025-03-29 15:49:33 -05:00
ikelos and GitHub
61e743036c
Merge pull request #1753 from volatilityfoundation/feature/use-less-memory-2
...
Don't completely remove the chainmap, but change one dict to a namedm…
2025-03-29 15:20:45 +00:00
Mike Auty
b73e4f0d2b
Don't completely remove the chainmap, but change one dict to a namedmapping
2025-03-29 14:32:14 +00:00
ikelos and GitHub
e1613d6ced
Merge pull request #1752 from volatilityfoundation/revert-1736-feature/use-less-memory
...
Revert "Feature/use less memory"
2025-03-29 12:59:03 +00:00
ikelos and GitHub
07f7a2e2be
Revert "Feature/use less memory"
2025-03-29 12:48:47 +00:00
ikelos and GitHub
2ff83404bc
Merge pull request #1736 from volatilityfoundation/feature/use-less-memory
...
Feature/use less memory
2025-03-29 12:33:51 +00:00
ikelos and GitHub
a79c58bcce
Merge pull request #1743 from volatilityfoundation/requirement_checks_github_action
...
Testing: Verify `VersionRequirement`s
2025-03-28 22:30:44 +00:00
David McDonald
6452fc18bd
Tone down language severity in messages
2025-03-28 15:39:09 -05:00
David McDonald
d7695ab9cf
Simplify error message output
2025-03-28 15:36:54 -05:00
David McDonald
46e3b8ffdb
Check for 'hidden' attribute when determining classes to validate
2025-03-28 15:22:37 -05:00
David McDonald
196556eab3
Test: Allow for other types of coding style violations
2025-03-28 15:18:22 -05:00
ikelos and GitHub
eec87d2512
Merge pull request #1749 from eve-mem/volshell_fix_1714
...
Volshell: handle case where paged out member would cause backtrace for dt output.
2025-03-28 19:49:47 +00:00
eve
23f2157931
Volshell: update display_type to handle struct members that are also python functions, e.g. write(). Thanks to @atcuno for the suggestion
2025-03-28 18:50:10 +00:00
eve
e21eb57b90
Volshell: handle case where paged out member would cause backtrace for dt output. Thanks to @atcuno for the code!
2025-03-28 18:40:51 +00:00
David McDonald
d0a1daf82c
ModuleExtract: Add missing requirement
2025-03-28 13:24:51 -05:00
David McDonald