mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-24 15:12:23 +02:00

Files

T

David McDonald 9f024cf0f4 Refactor: use builtin ast lib instead of treesitter

Instead of using the tree-sitter third party library, this uses Python's
`ast` module to parse the source code and traverse the tree with a
visitor pattern. This is preferred because it's native to the language
itself, and Python developers are more likely to be familiar with it.
The traversal also handles nested scopes better than the prior
implementation. For example, classes that are declared inside of other
classes can now be looked up even though they don't exist at the top
level of the module namespace, since any time a class definition is
entered, that class is pushed to the top of a stack that can be examined
when visiting inner classes.

This also adds lots of log messages at different levels, plus a command
line argument for specifying verbosity, which should help with debugging
down the line.

2025-03-28 13:22:01 -05:00

plugins

trigger tests

2025-03-26 15:59:35 +01:00

__init__.py

add windows10 sample abstraction

2025-03-12 16:09:13 +01:00

check_configurable_requirements.py

Refactor: use builtin ast lib instead of treesitter

2025-03-28 13:22:01 -05:00

conftest.py

testing: Enable automatic selection of the OS image based on the test and filename prefix, addressing an issue in the development environment.

2024-12-01 19:34:35 +11:00

known_files.json

Fix: json prettier

2022-07-21 05:49:51 +09:00

README.md

fix ci

2024-11-08 14:03:08 +01:00

test_volatility.py

correctly order volshell args

2025-03-12 16:19:08 +01:00

README.md

Volatility 3 Testing Framework

Requirements

The Volatility 3 Testing Framework requires the same version of Python as Volatility 3 itself. To install the current set of dependencies that the framework requires, use a command like this:

pip3 install -e .[test]

Quick Start: Manual Testing

To test Volatility 3 on an image, first download one with a command such as:

curl -sLO "https://downloads.volatilityfoundation.org/volatility3/images/win-xp-laptop-2005-06-25.img.gz"
gunzip win-xp-laptop-2005-06-25.img.gz

In many cases, more symbols are required to be downloaded to the ./volatility3/symbols directory.
To manually run the tests, run a command, such as:

py.test ./test/test_volatility.py --volatility=vol.py --image win-xp-laptop-2005-06-25.img -k test_windows

The above command runs all available tests for windows on the win-xp-laptop-2005-06-25.img image. To choose a more specific set of tests, change the phrase after -k in this command.

Github Actions

This framework currently tests two images (one linux image and one windows image) after every push on any branch. For more information/context, find the actions setup in ./github/workflows/test.yaml