Add bounded Windows clipboard format enumeration

[AmirGhiassian]

Summary

Adds bounded Windows clipboard-format enumeration and USER-handle reporting.

This branch builds on #2001 and incorporates the review feedback from that PR. It intentionally scopes the plugin to metadata enumeration because the bundled GUI symbol tables do not expose the session gSharedInfo symbol needed to resolve USER handles to tagCLIPDATA objects reliably.

Changes

• Preserve the existing pClipBase pointer-to-tagCLIP[104] symbol definitions.
• Dereference and iterate the bounded symbol array rather than manually walking memory.
• Handle null and invalid clipboard-array pointers safely.
• Use the existing fmtEnum names instead of maintaining an incomplete duplicate mapping.
• Identify registered and unknown clipboard formats with descriptive numeric fallbacks.
• Advertise the x64-only architecture support enforced by the Window Stations dependency.
• Remove unreachable tagCLIPDATA helpers, padded forensic reads, incorrect CF_HDROP decoding, and the always-empty Data column.
• Add focused tests for format lookup, registered/unknown formats, bounded iteration, null pointers, and architecture requirements.

Impact

The plugin now accurately reports what it can recover—clipboard formats and their USER handles—without changing shared symbol semantics or presenting unavailable clipboard contents as an extraction feature.

Validation

• pytest -q test/plugins/windows/test_clipboard.py --volatility=vol.py — 4 passed
• Ruff lint and formatting
• Plugin discovery through vol.py -h
• GUI JSON parsing
• Volatility configurable-class analysis
• git diff --check

[AmirGhiassian]

Hi @ikelos - when you have a chance, could you please approve the pending GitHub Actions workflows for this PR? All five workflows are currently blocked with action_required and no jobs have started. Thank you!

[AmirGhiassian]

Thanks for approving the earlier runs, @ikelos. I traced the Python 3.8 failure to the newly released leechcorepyc 2.23.1 package, whose initializer raises SyntaxError. The PR now excludes only that broken release and is rebased onto current develop; the previously failing Windows VolShell test passes locally with Python 3.8 and leechcorepyc 2.22.13. Could you please approve the refreshed workflow runs?

[Copilot]

Pull request overview

Adds a Windows clipboard plugin that enumerates clipboard format metadata (format name + USER handle) per Window Station, using the bounded pClipBase symbol array and improved format-name resolution in GUI extensions.

Changes:

• Introduces plugins/windows/clipboard.py to enumerate clipboard formats/handles per Window Station with bounded iteration and safe pointer handling.
• Adds tagCLIP.get_format_name() to GUI extensions to prefer enum names and provide clear registered/unknown numeric fallbacks.
• Adds focused unit tests for bounded iteration, null pointers, architecture requirement enforcement, and format-name edge cases; updates optional dependency constraints to exclude a known-bad leechcorepyc version.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
volatility3/plugins/windows/clipboard.py	New plugin to enumerate clipboard formats and USER handles per Window Station using bounded symbol array dereference.
volatility3/framework/symbols/windows/extensions/gui.py	Adds tagCLIP extension with robust format-name lookup and fallbacks; registers type in class_types.
test/plugins/windows/test_clipboard.py	Adds unit tests covering format naming, bounded iteration, null pointers, and x64-only requirement.
pyproject.toml	Excludes leechcorepyc==2.23.1 due to a known SyntaxError in its package initializer.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[AmirGhiassian]

Meow 😼

[AmirGhiassian]

Reviewed