This project follows strict TDD. For every change:
- RED — write a failing test that defines the expected behavior, commit it, confirm it fails.
- GREEN — write the minimal implementation to make the test pass, commit it separately, confirm it passes.
- REFACTOR — clean up while keeping tests green.
Pull requests that arrive as a single "add feature + tests" commit will be asked to split. The failing-test commit is the verifiable proof that tests were written first.
git clone https://github.com/SecurityRonin/memory-forensic
cd memory-forensic
cargo test --workspace-
cargo test --workspacepasses -
cargo clippy --workspace -- -D warningsclean -
cargo fmt --checkpasses - RED commit (failing tests) precedes GREEN commit (implementation)
- Add the walker function to the appropriate crate (
memf-linuxormemf-windows) - Register it in
lib.rs - Add ISF struct/field definitions to the test builder if needed
- Follow the RED → GREEN commit pattern
Walkers use ISF JSON (compatible with Volatility 3 symbol packs). For testing, the IsfBuilder in memf-core::test_builders constructs synthetic ISF in memory — no real symbol files required in tests.