Run a volatility command with retry and caching. Args: *args: Arguments to pass to volatility use_cache: Whet

Run YARA scan on memory dump. Returns: List of suspicious processes found

Check if line contains excluded words. Args: line: The line to check excluded_words: List of words to filter out

Sanitize a merged YARA file by removing unsupported imports/rules. This is designed for very large merged rule files where dropping the whole

Validate a YARA file by compiling it and pruning failing rule blocks. Args: source: Input YARA file path destination: Output vali

Identify the memory dump OS and version. The method consults the output of the `windows.info` plugin and applies several heuristics:

Filter out YARA files with incompatible imports. Args: files: List of YARA file paths Returns: Filtered list of

Scan for suspicious network connections. Returns: List of suspicious processes found

Run YARA scan on memory dump. Args: rule_file: Path to YARA rule file Returns: Scan outp

Drop the YARA rule block around a 1-based line number. Returns True if a block (or at least a line) was removed.

Find Volatility3 executable in PATH. Tries multiple common names: - vol (most common) - volatility3 - vol.py

Check whether a given Windows profile works against the dump. Runs a lightweight command (`pslist`) with `--profile` and returns True

Return malhunt ASCII banner.

Remove duplicate rule definitions from merged YARA content. Args: content: Merged YARA rules content Returns: Cl

Get image identification information using windows.info plugin. Returns: Dictionary with OS information and detected prop

Backward-compatible helper to prepare only YARA rules. Returns: True if YARA rules are available, False otherwise

Extract symbol-server download URLs from Volatility output text.

Clear the result cache.

Enrich diagnostics with local availability and recovery helper path.

Build a human-friendly diagnostics report for symbol failures. Args: error: VolatilityError raised by a plugin invocation

Check if ClamAV is available. Returns: True if clamscan is available

Return True if error indicates missing YARA backend for Volatility.

Scan network connections. Returns: Network scan output

Print usage information. Args: prog: Program name

Scan for injected code. Returns: List of suspicious processes found

Build alternate symbol URL variant (.pdb <-> .pd_) if possible.

Find clamscan executable. Returns: Path to clamscan, or None if not found

Find bounds of a rule/orphan block around a 0-based line index.

Find the most likely malformed block around an error line. First tries to remove a full `rule ... { ... }` block. If no rule header i

Validate symbol availability before running scanning plugins. Returns: True when Volatility can resolve kernel symbol table requi

Best-effort recovery of missing Windows symbol files. Attempts to download referenced symbol files from URLs present in Volatility ou

Clean up old cache files. Args: malhunt_home: Path to malhunt home directory

Collect artifacts for all suspicious processes.

Collect process handles information. Args: process: Process to collect handles for Returns:

Dump suspicious process memory. Args: process: Suspicious process to dump Returns: Path

Get cache statistics. Returns: Dictionary with cache info

Get malhunt home directory, creating it if necessary.

Get process handles. Args: pid: Process ID Returns: Handles output

Return True if error indicates missing/unsatisfied Volatility symbols.

Main entry point. Args: args: Command-line arguments (defaults to sys.argv[1:]) Returns: Exit code (0 for succes

Scan for suspicious injected code. Returns: Malfind output

Prepare YARA rules and Volatility symbol tables, downloading if necessary. Returns: True if both rules and symbols are available,

Dump process memory. Args: pid: Process ID to dump output_dir: Directory to save dump Re

Run the complete malhunt analysis workflow.

Run all configured scans. Returns: List of suspicious processes found

Configure logging. Args: verbose: Enable debug logging

Write a shell helper script to attempt manual symbol recovery.

Initialize Malhunt. Args: dump_path: Path to memory dump file rules_file: Optional path to custom YARA rules

Initialize YARA scanner. Args: vol: Volatility wrapper instance rule_file: Path to YARA rules file

Initialize Malfind scanner. Args: vol: Volatility wrapper instance

Initialize Network scanner. Args: vol: Volatility wrapper instance ip_checker: Optional callable to check if

Initialize Volatility wrapper. Args: dump_path: Path to the memory dump file config: Optional VolatilityConfi

Initialize artifact collector. Args: vol: Volatility wrapper instance output_dir: Directory to save artifacts

Initialize ClamAV scanner.

Check if IP is malicious using external service. Args: ip: IP address to check Returns:

Scan for connection objects (legacy, older Windows versions). Returns: Connection scan output

List processes in memory dump. Returns: Process list output

Scan file with ClamAV. Args: file_path: Path to file to scan Returns: Scan result (OK, I

Test banner contains expected text.

Test banner is not empty.

Test cache statistics.

Test that filtering is case-sensitive.

Test clearing cache.

Test creating a SuspiciousProcess.

Test custom configuration.

Test that duplicate PIDs are deduplicated.

Test that duplicate PIDs are deduplicated.

Test default configuration.

Test filtering excluded words.

Test exclusion of rules.

Test filtering by IP checker.

Test filtering rules with cuckoo import.

Test filtering rules with hash import.

Test filtering rules with imphash.

Test filtering rules with math import.

Test when volatility is not installed.

Test finding 'vol' command.

Test handling multiple duplicate sections.

Test parsing imageinfo output.