88 import pyarrow as pa
99 import pyarrow .parquet as pq
1010 import pyarrow .compute as pc
11+
1112 HAS_PYARROW = True
1213except ImportError :
13- # The user doesn't have pyarrow installed, but HAS_PYARROW will be false so just continue
14+ # The user doesn't have pyarrow installed, but HAS_PYARROW will be false so just continue
1415 pass
1516
1617
@@ -41,10 +42,33 @@ def test_windows_generic_pslist(self, volatility, python, image):
4142 table = self ._get_table_from_output (out )
4243 assert table .num_rows > 10
4344
44- assert table .filter (pc .match_substring (pc .utf8_lower (table .column ('ImageFileName' )), "system" )).num_rows > 0
45- assert table .filter (pc .match_substring (pc .utf8_lower (table .column ('ImageFileName' )), "csrss.exe" )).num_rows > 0
46- assert table .filter (pc .match_substring (pc .utf8_lower (table .column ('ImageFileName' )), "svchost.exe" )).num_rows > 0
47- assert table .filter (pc .greater (table .column ('PID' ), 0 )).num_rows == table .num_rows
45+ assert (
46+ table .filter (
47+ pc .match_substring (
48+ pc .utf8_lower (table .column ("ImageFileName" )), "system"
49+ )
50+ ).num_rows
51+ > 0
52+ )
53+ assert (
54+ table .filter (
55+ pc .match_substring (
56+ pc .utf8_lower (table .column ("ImageFileName" )), "csrss.exe"
57+ )
58+ ).num_rows
59+ > 0
60+ )
61+ assert (
62+ table .filter (
63+ pc .match_substring (
64+ pc .utf8_lower (table .column ("ImageFileName" )), "svchost.exe"
65+ )
66+ ).num_rows
67+ > 0
68+ )
69+ assert (
70+ table .filter (pc .greater (table .column ("PID" ), 0 )).num_rows == table .num_rows
71+ )
4872
4973 def test_linux_generic_pslist (self , volatility , python , image ):
5074 rc , out , _err = test_volatility .runvol_plugin (
@@ -59,12 +83,23 @@ def test_linux_generic_pslist(self, volatility, python, image):
5983 table = self ._get_table_from_output (out )
6084 assert table .num_rows > 10
6185
62- init_rows = table .filter (pc .match_substring (pc .utf8_lower (table .column ('COMM' )), "init" ))
63- systemd_rows = table .filter (pc .match_substring (pc .utf8_lower (table .column ('COMM' )), "systemd" ))
86+ init_rows = table .filter (
87+ pc .match_substring (pc .utf8_lower (table .column ("COMM" )), "init" )
88+ )
89+ systemd_rows = table .filter (
90+ pc .match_substring (pc .utf8_lower (table .column ("COMM" )), "systemd" )
91+ )
6492 assert (init_rows .num_rows > 0 ) or (systemd_rows .num_rows > 0 )
6593
66- assert table .filter (pc .match_substring (pc .utf8_lower (table .column ('COMM' )), "watchdog" )).num_rows > 0
67- assert table .filter (pc .greater (table .column ('PID' ), 0 )).num_rows == table .num_rows
94+ assert (
95+ table .filter (
96+ pc .match_substring (pc .utf8_lower (table .column ("COMM" )), "watchdog" )
97+ ).num_rows
98+ > 0
99+ )
100+ assert (
101+ table .filter (pc .greater (table .column ("PID" ), 0 )).num_rows == table .num_rows
102+ )
68103
69104 def test_windows_generic_handles (self , volatility , python , image ):
70105 rc , out , _err = test_volatility .runvol_plugin (
@@ -79,7 +114,14 @@ def test_windows_generic_handles(self, volatility, python, image):
79114
80115 table = self ._get_table_from_output (out )
81116 assert table .num_rows > 500
82- assert table .filter (pc .match_substring (pc .utf8_lower (table .column ('Name' )), "machine\\ system" )).num_rows > 0
117+ assert (
118+ table .filter (
119+ pc .match_substring (
120+ pc .utf8_lower (table .column ("Name" )), "machine\\ system"
121+ )
122+ ).num_rows
123+ > 0
124+ )
83125
84126 def test_linux_generic_lsof (self , volatility , python , image ):
85127 rc , out , _err = test_volatility .runvol_plugin (
@@ -94,6 +136,7 @@ def test_linux_generic_lsof(self, volatility, python, image):
94136 table = self ._get_table_from_output (out )
95137 assert table .num_rows > 35
96138
139+
97140class TestParquetRenderer (TestArrowRendererBase ):
98141 renderer_format = "parquet"
99142
@@ -106,4 +149,3 @@ class TestArrowRenderer(TestArrowRendererBase):
106149
107150 def _get_table_from_output (self , output_bytes ):
108151 return pa .ipc .open_stream (io .BytesIO (output_bytes )).read_all ()
109-
0 commit comments