Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature : Hibernation Layer and plugins. #1036

Open
wants to merge 27 commits into
base: develop
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from 24 commits
Commits
Show all changes
27 commits
Select commit Hold shift + click to select a range
b0cbd3c
Adding hibernation support
k1nd0ne Oct 26, 2023
c91e417
Fixing Huffman
forensicxlab Oct 27, 2023
5c44467
Adapting comments to the codec instead of the volatility3 prefetch pl…
k1nd0ne Oct 27, 2023
a13e105
Update the Xpress LZ77+Huffman decoder
k1nd0ne Oct 30, 2023
3568d3f
Code comments and cleaning.
k1nd0ne Oct 30, 2023
7e87e2d
Plugins added : hibernation.Info and hibernation.Dump. Support for ad…
k1nd0ne Nov 3, 2023
142baa6
Adding support for Windows 10 2016 1607
k1nd0ne Nov 3, 2023
cfab14f
Only parse the kernel section if the user is using the 'windows.hiber…
k1nd0ne Nov 3, 2023
f6b960a
Quick code review and comments to make it more readable. Enhanced plu…
k1nd0ne Feb 4, 2024
8db03c3
using black on the codecs
k1nd0ne Feb 4, 2024
d152b48
fixing mistakes in the lz77+huffman decompression algorithm
k1nd0ne Feb 4, 2024
6213d45
Adding codecs + black
k1nd0ne Jul 15, 2024
2bebe91
Formatting using good black version
k1nd0ne Jul 15, 2024
9fd1567
Deported the decompression algorithm in a dedicated python3 package
k1nd0ne Jul 23, 2024
9b855f1
Deported the decompression algorithm in a dedicated python3 package
k1nd0ne Jul 23, 2024
2ffa3a9
conflict
k1nd0ne Jul 23, 2024
9379e16
Merging to resolve conflict
k1nd0ne Jul 23, 2024
b17eab6
requirements
k1nd0ne Jul 23, 2024
3f428f7
Fixing requirements
k1nd0ne Jul 23, 2024
ad31052
Fixing unused import
k1nd0ne Jul 23, 2024
9d478f3
Merge branch 'volatilityfoundation:develop' into feature/hibernation-…
forensicxlab Jul 28, 2024
d779c0e
Upgrading pipeline and python3 version minimum requirement
k1nd0ne Jul 28, 2024
c947999
Upgrading pipeline and python3 version minimum requirement
k1nd0ne Jul 28, 2024
0d6c1ea
Using symbol Tables (1/2)
k1nd0ne Aug 5, 2024
f378a1a
Merge branch 'volatilityfoundation:develop' into feature/hibernation-…
forensicxlab Aug 5, 2024
3b1f2ae
Sync
Dec 1, 2024
3778c97
Merge branch 'develop' into feature/hibernation-layer
k1nd0ne Dec 1, 2024
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 21 additions & 22 deletions .github/workflows/build-pypi.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,39 +5,38 @@ on:
branches:
- stable
- develop
- 'release/**'
- "release/**"

pull_request:
branches:
- stable
- 'release/**'
- "release/**"

jobs:

build:
runs-on: ubuntu-20.04
strategy:
matrix:
python-version: ["3.7"]
python-version: ["3.8"]
steps:
- uses: actions/checkout@v4
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python-version }}
- uses: actions/checkout@v4
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python-version }}

- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install build
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install build

- name: Build PyPi packages
run: |
python -m build
- name: Build PyPi packages
run: |
python -m build

- name: Archive dist
uses: actions/upload-artifact@v4
with:
name: volatility3-pypi
path: |
dist/
- name: Archive dist
uses: actions/upload-artifact@v4
with:
name: volatility3-pypi
path: |
dist/
33 changes: 16 additions & 17 deletions .github/workflows/install.yml
Original file line number Diff line number Diff line change
@@ -1,31 +1,30 @@
name: Install Volatility3 test
on: [push, pull_request]
jobs:

install_test:
runs-on: ${{ matrix.host }}
strategy:
fail-fast: false
matrix:
host: [ ubuntu-latest, windows-latest ]
python-version: [ "3.7", "3.8", "3.9", "3.10", "3.11" ]
host: [ubuntu-latest, windows-latest]
python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v4

- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v4
with:
python-version: ${{ matrix.python-version }}
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v4
with:
python-version: ${{ matrix.python-version }}

- name: Setup python-pip
run: python -m pip install --upgrade pip
- name: Setup python-pip
run: python -m pip install --upgrade pip

- name: Install dependencies
run: |
pip install -r requirements.txt
- name: Install dependencies
run: |
pip install -r requirements.txt

- name: Install volatility3
run: pip install .
- name: Install volatility3
run: pip install .

- name: Run volatility3
run: vol --help
- name: Run volatility3
run: vol --help
79 changes: 39 additions & 40 deletions .github/workflows/test.yaml
Original file line number Diff line number Diff line change
@@ -1,54 +1,53 @@
name: Test Volatility3
on: [push, pull_request]
jobs:

build:
runs-on: ubuntu-20.04
strategy:
matrix:
python-version: ["3.7"]
python-version: ["3.8"]
steps:
- uses: actions/checkout@v4
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python-version }}
- uses: actions/checkout@v4
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python-version }}

- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install Cmake
pip install build
pip install -r ./test/requirements-testing.txt
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install Cmake
pip install build
pip install -r ./test/requirements-testing.txt

- name: Build PyPi packages
run: |
python -m build
- name: Build PyPi packages
run: |
python -m build

- name: Download images
run: |
curl -sLO "https://downloads.volatilityfoundation.org/volatility3/images/linux-sample-1.bin.gz"
gunzip linux-sample-1.bin.gz
curl -sLO "https://downloads.volatilityfoundation.org/volatility3/images/win-xp-laptop-2005-06-25.img.gz"
gunzip win-xp-laptop-2005-06-25.img.gz
- name: Download images
run: |
curl -sLO "https://downloads.volatilityfoundation.org/volatility3/images/linux-sample-1.bin.gz"
gunzip linux-sample-1.bin.gz
curl -sLO "https://downloads.volatilityfoundation.org/volatility3/images/win-xp-laptop-2005-06-25.img.gz"
gunzip win-xp-laptop-2005-06-25.img.gz

- name: Download and Extract symbols
run: |
cd ./volatility3/symbols
curl -sLO https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip
unzip linux.zip
cd -
- name: Download and Extract symbols
run: |
cd ./volatility3/symbols
curl -sLO https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip
unzip linux.zip
cd -

- name: Testing...
run: |
py.test ./test/test_volatility.py --volatility=vol.py --image win-xp-laptop-2005-06-25.img -k test_windows -v
py.test ./test/test_volatility.py --volatility=vol.py --image linux-sample-1.bin -k test_linux -v
- name: Testing...
run: |
py.test ./test/test_volatility.py --volatility=vol.py --image win-xp-laptop-2005-06-25.img -k test_windows -v
py.test ./test/test_volatility.py --volatility=vol.py --image linux-sample-1.bin -k test_linux -v

- name: Clean up post-test
run: |
rm -rf *.lime
rm -rf *.img
cd volatility3/symbols
rm -rf linux
rm -rf linux.zip
cd -
- name: Clean up post-test
run: |
rm -rf *.lime
rm -rf *.img
cd volatility3/symbols
rm -rf linux
rm -rf linux.zip
cd -
5 changes: 4 additions & 1 deletion requirements.txt
Original file line number Diff line number Diff line change
Expand Up @@ -19,4 +19,7 @@ leechcorepyc>=2.4.0; sys_platform != 'darwin'

# This is required for memory analysis on a Amazon/MinIO S3 and Google Cloud object storage
gcsfs>=2023.1.0
s3fs>=2023.1.0
s3fs>=2023.1.0

# This is required for memory to work with the hibernation layer
xpress-lz77>=1.0.0
2 changes: 1 addition & 1 deletion volatility3/framework/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
import sys
import zipfile

required_python_version = (3, 7, 3)
required_python_version = (3, 8, 0)
if (
sys.version_info.major != required_python_version[0]
or sys.version_info.minor < required_python_version[1]
Expand Down
9 changes: 3 additions & 6 deletions volatility3/framework/layers/codecs/__init__.py
Original file line number Diff line number Diff line change
@@ -1,8 +1,5 @@
# This file is Copyright 2022 Volatility Foundation and licensed under the Volatility Software License 1.0
# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
import codecs

"""Codecs used for encoding or decoding data should live here


"""
# Register codecs here.
Loading
Loading