ikelos and GitHub
3e2d831be3
Merge pull request #1890 from volatilityfoundation/issues/registry-plugin-expiry-date
...
Update Registry plugin expiry date
2025-11-09 17:56:53 +00:00
Mike Auty
46c508fff2
Bump removal of plugins by a year to ensure suitable time for transition
2025-10-16 20:29:02 +01:00
Mike Auty
841b2b6435
Ruff fixes that black agrees with
2025-09-29 23:04:01 +01:00
ikelos and GitHub
78e05f9c8f
Merge pull request #1861 from kyrre/feature/parquet-arrow-renderer
...
Feature/parquet arrow renderer
2025-09-15 10:00:03 +01:00
ikelos and GitHub
81f2e7376a
Update test/renderers/test_parquet_renderers.py
2025-09-15 08:58:04 +01:00
Kyrre-Wahl-Kongsgard
533b305afb
Added tests for the Parquet and Arrow renderers
2025-08-02 18:07:05 +02:00
SolitudePy
215ba1dfaa
Plugins: categorize ldrmodules as a malware plugin
2025-06-13 17:42:17 +03:00
ikelos and GitHub
470c53c5f7
Merge branch 'develop' into check_creds_malware
2025-06-11 22:21:59 +01:00
ikelos and GitHub
76db04c494
Merge pull request #1807 from volatilityfoundation/bugfix/windows_thrdscan_tuple_unpacking
...
Windows Thrdscan: Fix broken tuple unpacking
2025-06-11 14:06:43 +01:00
ikelos and GitHub
58f441186c
Merge pull request #1850 from SolitudePy/malware_plugins_category
...
Malware categorization: linux.tty_check, linux.netfilter, linux.modxview
2025-06-10 21:20:12 +01:00
ikelos and GitHub
43ed10a4f8
Merge pull request #1846 from SolitudePy/linux_malware_plugins
...
Malware categorization: linux.malfind & linux.keyboard_notifiers
2025-06-10 21:07:42 +01:00
ikelos and GitHub
58e41d754a
Merge pull request #1845 from SolitudePy/categorize_linux_malware
...
Malware categorization: linux.check_afinfo & linux.hidden_modules
2025-06-10 21:05:41 +01:00
ikelos and GitHub
9596893f1b
Merge pull request #1844 from SolitudePy/check_syscall_malware
...
Malware categorization: linux.check_syscall
2025-06-10 21:02:34 +01:00
ikelos and GitHub
e06910c763
Merge pull request #1843 from SolitudePy/check_modules_malware
...
Malware categorization: linux.check_modules
2025-06-10 21:00:02 +01:00
SolitudePy
8040c049e0
Tests: change class name for tty_check
2025-06-10 20:30:05 +03:00
SolitudePy
e3877f68ec
Plugins: categorize linux.tty_check as a malware plugin
2025-06-10 19:37:57 +03:00
SolitudePy
77801e4cb0
Plugins: categorize linux.netfilter as a malware plugin
2025-06-10 19:22:12 +03:00
SolitudePy
a06d59bc52
Plugins: categorize linux.malfind as a malware plugin
2025-06-07 22:58:46 +03:00
SolitudePy
faf7d781be
Plugins: categorize linux.keyboard_notifiers as a malware plugin
2025-06-07 22:55:29 +03:00
SolitudePy
1d2b78976a
Plugins: categorize linux.hidden_modules as a malware plugin
2025-06-07 19:54:44 +03:00
SolitudePy
962665b412
Plugins: categorize linux.check_afinfo as a malware plugin + test fix
2025-06-07 19:44:50 +03:00
SolitudePy
70514396b3
linux.malware.check_syscall - fix test
2025-06-07 19:35:26 +03:00
SolitudePy
4b279f9633
linux.malware.check_modules - fix test
2025-06-07 19:30:04 +03:00
SolitudePy
4bc1bb818d
linux.malware.check_idt - fix doc & test deps
2025-06-07 19:23:13 +03:00
SolitudePy
85a5eb5d41
linux.malware.check_creds - fix deps in: test, doc
2025-06-07 18:42:42 +03:00
David McDonald
90a3829ee7
Windows Timeliner: Add basic test
...
This is enough to ensure that the return code is nonzero and there was
some valid output.
2025-05-15 17:28:26 -05:00
David McDonald
2199375dd5
Tests: Add symlinkscan specific test
2025-04-15 10:49:43 -05:00
David McDonald
32e9cee6dd
Tests: Add Symlinkscan generic test
...
This should be enough to prevent serious regressions that break all
output.
2025-04-15 10:49:43 -05:00
David McDonald
5befbf8629
Tests: Fix MFTScan testdata
...
These test values needed updating now that the `LayerData` type is used
and presents the data a little differently than before.
2025-04-02 14:08:18 -05:00
David McDonald
0b1bbb87ee
Windows Tests: Update userassist JSON output
...
The new layer data type renders the output a little differently, and the
plugin also seems to render 'N/A' for a missing value where previously
it was an empty string.
2025-04-02 09:36:07 -05:00
David McDonald
296cb3c113
Code Analysis: Give pass to 'volatility3'
...
Also moves some code into a private method with a docstring in the
visitor class.
2025-03-29 15:49:33 -05:00
David McDonald
a3353a3cb6
CI Testing: Renames script and updates job name
2025-03-29 15:49:33 -05:00
David McDonald
e62cee391a
Testing: Adds validation of vol3 imports in check script
...
This checks `ast.ImportFrom` statements to see if anything other than
modules are being imported in this way. It enumerates all instances of
this and suggests a fix.
2025-03-29 15:49:33 -05:00
David McDonald
6452fc18bd
Tone down language severity in messages
2025-03-28 15:39:09 -05:00
David McDonald
d7695ab9cf
Simplify error message output
2025-03-28 15:36:54 -05:00
David McDonald
46e3b8ffdb
Check for 'hidden' attribute when determining classes to validate
2025-03-28 15:22:37 -05:00
David McDonald
196556eab3
Test: Allow for other types of coding style violations
2025-03-28 15:18:22 -05:00
David McDonald
27e59263a6
Docstring: explain version-checking script
...
This documents the general behavior and expectations of the
version-checking CI script.
2025-03-28 13:22:01 -05:00
David McDonald
9f024cf0f4
Refactor: use builtin ast lib instead of treesitter
...
Instead of using the tree-sitter third party library, this uses Python's
`ast` module to parse the source code and traverse the tree with a
visitor pattern. This is preferred because it's native to the language
itself, and Python developers are more likely to be familiar with it.
The traversal also handles nested scopes better than the prior
implementation. For example, classes that are declared inside of other
classes can now be looked up even though they don't exist at the top
level of the module namespace, since any time a class definition is
entered, that class is pushed to the top of a stack that can be examined
when visiting inner classes.
This also adds lots of log messages at different levels, plus a command
line argument for specifying verbosity, which should help with debugging
down the line.
2025-03-28 13:22:01 -05:00
David McDonald
2ad1536b4e
Testing: Verify VersionRequirements
...
This adds a script and GitHub action to the `test` directory that
dynamically imports all modules in `volatility3`, searches for usages of
`VersionableInterface` objects within classes that inherit from
`ConfigurableInterface` but don't enumerate the used component as a
requirement in `get_requirements()`, and returns -1 if any violations
are found.
Fixes
2025-03-28 13:21:10 -05:00
Abyss Watcher
dca182dc72
trigger tests
2025-03-26 15:59:35 +01:00
Abyss Watcher
b80a34110e
adjust thrdscan
2025-03-26 14:41:05 +01:00
Abyss Watcher
d70d8820a9
use winxp against scanner plugins (performances)
2025-03-25 11:41:28 +01:00
Abyss Watcher
951d1f6c48
fix pstree data test name
2025-03-12 16:55:20 +01:00
Abyss Watcher
cd2d396c9e
tmp commit to resolve pstree case sensitive filename
2025-03-12 16:54:49 +01:00
Abyss Watcher
c4054b4122
correct pstree json name
2025-03-12 16:51:14 +01:00
Abyss Watcher
489265e86c
make modules test specific
2025-03-12 16:28:19 +01:00
Abyss Watcher
d37f7b98f5
first windows testing enhancement iteration
2025-03-12 16:22:54 +01:00
Abyss Watcher
a539047516
correctly order volshell args
2025-03-12 16:19:08 +01:00
Abyss Watcher
ca20b6e979
enhance and extend testing helper functions
2025-03-12 16:10:12 +01:00
