v3.0.0 — Working analysis runs, Volatility 3 2.26+ plugins, kernel symbol options

Every analysis run since 2.0.0 aborted when the first plugin launched; this release fixes that and was validated end to end on real dumps (MemLabs Lab 0 CTF image, Volatility 3 test-data Windows 10 and Debian 7 samples).

Breaking

• Volatility 3 2.26.2+ is required (current plugin names). Output files hashdump.txt / lsadump.txt are now registry_hashdump.txt / registry_lsadump.txt.
• An existing output directory that is group/world-writable or not owned by you (including -o /tmp) is refused.
• Exit status is 1 when no plugin succeeds.
• Text report status column: OK / WARN → SUCCESS / WARNING / FAILED / MISSING.
• --dump-registry writes its index to registry_dump_index.txt; registry_hivelist.txt is the plugin output again.

Added

• Windows: windows.cmdscan and windows.consoles (console command history and output) — 32 Windows plugins.
• --symbols DIR and --isf-url URL pass kernel symbols to every vol call (-s / -u), OS auto-detection included, so Linux/macOS dumps work without copying ISF files into Volatility's directories. --isf-url takes https:// or file:// only (a local --symbols directory is the tamper-proof option: Volatility retries a failed TLS verification unverified). Both are recorded in the text and JSON reports.
• make update-tlds refreshes the IANA TLD list used for domain IOCs; make install installs it to $(BINDIR)/../share/volatility-toolkit/.

Fixed

• Plugins started in parallel on a cold Volatility cache (first Windows run with --os, which downloads the kernel PDB, or --isf-url without auto-detection) could read each other's half-written cache files and fail with JSONDecodeError (seen on linux.lsmod). The first plugin now runs alone and fills the cache.
• --dump-registry overwrote the windows.registry.hivelist plugin output (registry_hivelist.txt) with its own index. When hive extraction stops early (paged-out hive on a Windows 10 dump), the hive list and its report line count were lost. The dump index now goes to registry_dump_index.txt.
• strings/ipv4.txt kept invalid addresses and pieces of OIDs and version strings (931.331.331.353, 1.3.6.1 from 1.3.6.1.4.1.311): 510 of 779 entries on a Windows 7 CTF image. Only whole dotted quads (trailing dots allowed) with octets up to 255 and no leading zeros are kept; address.port forms such as 10.0.0.5.443 are not matched.
• strings/domains.txt was mostly file names and .NET type names on real dumps. A name must now end in a lower-case IANA TLD (share/volatility-toolkit/tlds.txt, internationalised xn-- TLDs included). For TLDs that double as file extensions (.sh, .py, .zip…), file-like names (run.sh, libfoo-2.0.so) are dropped and hosts (c2.evil.sh) kept: 18,778 → 810 entries on a Windows 7 CTF image, 370,609 → 81,370 on Windows 10, 47,674 → 9,327 on Debian 7. Upper-case host names are no longer matched.
• Analysis aborted when the first plugin launched: (( i++ )) evaluates to 0, which set -e treats as failure. The same pattern in human_size() aborted runs on macOS without numfmt. Use pre-increment.
• -j 08 (zero-padded) made the scheduler spin forever without launching a plugin (octal parse error inside (( ))). Values are now parsed as base 10.
• Ctrl-C / SIGTERM no longer resumes the scheduler loop or leaves orphaned vol processes: INT/TERM exit, and vol runs as a direct child so cleanup can kill it. OS auto-detection, strings, --dump-files and --dump-registry also stop at once (they used to run to completion, up to 3×60s for detection).
• Every plugin was reported as WARN/"warning": vol's progress bar went to .err. vol now runs with -q, and status comes from its exit code.
• Freed worker slots could idle until a slow plugin finished (wait -n ignores jobs that already exited). Replaced with a 1s poll.
• Colors printed as literal \033[...] text in --help and status lines on a TTY.
• chmod 700 was applied to pre-existing output directories (-o /tmp as root stripped the sticky bit). Replaced by umask 077: new directories are 700 and every output file is 600, including inside an existing directory (hashdump/lsadump output is no longer group-readable under umask 002).
• An existing output directory that is not owned by the user, or is group/world-writable, is refused: another user could pre-create output files or symlinks and receive the hashdump/lsadump results.
• The system-directory blocklist never matched top-level paths: -o /etc, -o /, -o /usr, -o /tmp/../etc were accepted (the path was built as //etc).
• A backslash in the dump's file name corrupted the recorded MD5/SHA256 (GNU tools prefix the hash with \) and made the JSON invalid. Hashes are computed from stdin and validated as hex.
• .com domains were dropped from strings/domains.txt (com was in the file-extension blocklist).
• Interactive prompts aborted the run on EOF instead of treating it as "no".
• zsh completion file filter used brace syntax, which never matches in a glob; bash completion offered no dump files without extglob, and inserted names with spaces unescaped.

Changed

• Plugin names updated for Volatility 3 2.26.2+; the old aliases are past their removal dates: windows.malware.malfind, windows.registry.hashdump, windows.registry.lsadump, linux.malware.* (malfind, check_syscall, check_idt, check_modules, check_creds, check_afinfo, tty_check, keyboard_notifiers). Output files: hashdump.txt → registry_hashdump.txt, lsadump.txt → registry_lsadump.txt; malware plugins keep their old names.
• Linux/macOS docs: prebuilt ISFs from Abyss-W4tcher/volatility3-symbols (banner lookup or --remote-isf-url), and ~/.cache/volatility3/symbols/ instead of the install directory.
• Docs updated for current plugin names and options (YARA, hashdump extras, removed mac.timecounter, no Volatility 2 imageinfo).
• Report statuses: SUCCESS / WARNING (exit 0 with stderr) / FAILED / MISSING. JSON adds per-plugin exit_code and duration_seconds.
• Checksums fall back to md5 / shasum -a 256 (stock macOS), with a warning if a hash cannot be computed.
• Exit status is 1 when no plugin succeeds (wrong --os, missing kernel symbols); reports are still written.
• VOL_DETECT_TIMEOUT is validated; a warning is shown when no timeout/gtimeout exists to enforce it.
• Windows --extract-strings also extracts UTF-16LE strings (GNU strings -e l).
• Output-dir blocklist no longer rejects /var/* and /run/* subtrees (/var/tmp, macOS $TMPDIR, /run/media/$USER evidence drives).
• VOL3_CMD accepts vol.py; dropped python/python3, which could never work without a script argument.
• NO_COLOR follows no-color.org: only a non-empty value disables color.
• Explicit bash 4.0+ check with a clear error (macOS /bin/bash is 3.2).
• make install supports DESTDIR and installs bash completion to $(PREFIX)/share/bash-completion/completions (replaces the legacy /etc/bash_completion.d) and zsh completion to $(PREFIX)/share/zsh/site-functions. make uninstall removes only the files it installed (no more rm -rf $(DOCDIR)).
• VOL_DETECT_TIMEOUT documented in --help and the README.

CI

• actions/checkout bumped to v7.0.1 (pinned SHA); CI steps call make lint / make check / make test; permissions: contents: read and job timeouts.
• make lint now covers the tests, the bash completion and scripts/ci-local.sh.
• macOS job installs Homebrew bash (the script needs bash 4+).
• New make ci (scripts/ci-local.sh) mirrors CI locally.
• Tests: the grep-for-chmod stub was replaced by end-to-end runs against a fake vol (scheduler, exit codes, reports, JSON validity, file modes, top-level -o rejection, IOC extraction, auto-detection, SIGTERM during plugins and detection).