 ikelosandGitHub
|
ca420d9a5d
|
Merge pull request #1607 from volatilityfoundation/issue_1475_ldrmodules
Make a generic DLL enumeration function that ensures the base address…
|
2025-02-08 19:40:56 +00:00 |
|
|
Abyss Watcher
|
0abe258765
|
initial linux.tracing.tracepoints.CheckTracepoints
|
2025-02-08 15:41:02 +01:00 |
|
|
ikelosandGitHub
|
7719d29881
|
Merge pull request #1609 from volatilityfoundation/unloaded_modules_valid_modules_only
Prevent yielding smeared/broken modules from the unloaded module list
|
2025-02-08 00:17:07 +00:00 |
|
|
Andrew Case
|
df55b7890d
|
Prevent yielding smeared/broken modules from the unloaded module list
|
2025-02-07 18:05:16 -06:00 |
|
|
Andrew Case
|
b78b7a5d9b
|
Switch virtual and physical addresses to lists to support dumping multiple files at once #1319
|
2025-02-07 16:33:16 -06:00 |
|
|
Andrew Case
|
67c001ab50
|
Update for black
|
2025-02-07 15:12:06 -06:00 |
|
|
Andrew Case
|
8c617d6b3f
|
Make a generic DLL enumeration function that ensures the base address is set and we return as many entries as possible #1475
|
2025-02-07 15:06:32 -06:00 |
|
|
ikelosandGitHub
|
789081e971
|
Merge pull request #1606 from volatilityfoundation/issue_1594_dname
Catch symbolerror for when a kernel does not have ns_common #1594
|
2025-02-07 19:44:04 +00:00 |
|
|
ikelosandGitHub
|
44ae4f137e
|
Merge pull request #1596 from volatilityfoundation/vma_get_name_fixes
Fix get_name API, fix malfind
|
2025-02-07 19:35:18 +00:00 |
|
|
ikelosandGitHub
|
e5e4d30a46
|
Merge pull request #1514 from volatilityfoundation/file_descriptors_exception_handling
Add proper exception handling in file descriptor enumeration
|
2025-02-07 19:35:07 +00:00 |
|
|
Andrew Case
|
13278121e3
|
Catch symbolerror for when a kernel does not have ns_common #1594
|
2025-02-07 13:33:33 -06:00 |
|
|
Andrew Case
|
ac8eeec52e
|
Fixes for black
|
2025-02-07 13:17:10 -06:00 |
|
|
Andrew Case
|
4c2d21d086
|
bump patch number
|
2025-02-07 13:15:31 -06:00 |
|
|
Andrew Case
|
9c5b016932
|
Move all initial access into try/except block
|
2025-02-07 13:14:11 -06:00 |
|
|
Andrew Case
|
968241aedd
|
Address feedback
|
2025-02-07 13:14:11 -06:00 |
|
|
Andrew Case
|
d372f04eff
|
Add proper exception handling in file descriptor enumeration
|
2025-02-07 13:14:11 -06:00 |
|
|
Andrew Case
|
6100d7756f
|
Add function typing
|
2025-02-07 13:05:41 -06:00 |
|
|
ikelosandGitHub
|
bf03ecda2c
|
Merge pull request #1564 from Abyss-W4tcher/linux_tracing_ftrace
New Linux plugin: linux.tracing.ftrace
|
2025-02-05 21:49:15 +00:00 |
|
|
Abyss Watcher
|
f5e8ed2457
|
use a list comprehension for flags parsing
|
2025-02-05 21:42:13 +01:00 |
|
|
ikelosandGitHub
|
eadd6d229e
|
Merge pull request #1572 from hsarkey/hsarkey/wow64-dlllist
Windows: Allow windows.dlllist to report back DLLs from wow64 processes
|
2025-02-05 20:23:50 +00:00 |
|
|
hsarkey
|
29567a777b
|
Updates to address the dlllist wow64 upgrades
|
2025-02-05 15:10:36 -05:00 |
|
|
Abyss Watcher
|
637ff68035
|
make ftrace flags parsing more readable
|
2025-02-05 19:19:26 +01:00 |
|
|
Abyss Watcher
|
c01f3c5556
|
non inclusive upper bound address check
|
2025-02-05 19:17:25 +01:00 |
|
|
ikelosandGitHub
|
a4987b39d9
|
Merge pull request #1598 from volatilityfoundation/issue_1573_handle_iteration_traceback
Windows: Handles - catch exception in handle iteration
|
2025-02-03 22:42:27 +00:00 |
|
|
ikelosandGitHub
|
b3760ce7e5
|
Merge pull request #1599 from gcmoreira/linux_kallsyms
Linux - Introduce the Linux kallsyms API and related plugins
|
2025-02-02 23:32:01 +00:00 |
|
|
Gustavo Moreira
|
cef87e014c
|
linux: kernel_symbol object extension: move properties to getters
|
2025-02-03 07:59:57 +11:00 |
|
|
Gustavo Moreira
|
348720c89a
|
linux: module extension object: add docstring to get_symbol_type()
|
2025-02-03 07:55:11 +11:00 |
|
|
Gustavo Moreira
|
e222b069ef
|
linux: module extension object: add typing info to _get_sect_count()
|
2025-02-03 07:50:21 +11:00 |
|
|
Gustavo Moreira
|
13b8526206
|
linux: kallsyms API: reuse module_name variable
|
2025-02-03 07:40:17 +11:00 |
|
|
Gustavo Moreira
|
19fed19647
|
linux: kallsyms plugin: fix variable name typo
|
2025-02-03 07:38:43 +11:00 |
|
|
Gustavo Moreira
|
54ce358e8e
|
framework: minor version bump
|
2025-02-03 07:37:38 +11:00 |
|
|
Mike Auty
|
fbb9627d36
|
Keep the advanced configuration requirements out of the interfaces
|
2025-02-02 16:18:42 +00:00 |
|
|
Mike Auty
|
144a7cc3f5
|
Add error checking when accessing the KVO
Also bumps hivescan to take a module name rather than a
layer_name/symbol_table combo.
|
2025-02-02 16:07:32 +00:00 |
|
|
Gustavo Moreira
|
bf0271cd57
|
linux: kallsyms plugin: simplify argument by removing the "only-" prefix, which was also causing confusion.
|
2025-02-02 12:29:01 +11:00 |
|
|
Gustavo Moreira
|
5347926ab6
|
linux: Add pscallstack plugin testcase
|
2025-02-02 11:34:31 +11:00 |
|
|
Gustavo Moreira
|
80f6d0dad6
|
linux: Add kallsyms plugin testcase
|
2025-02-02 11:33:34 +11:00 |
|
|
ikelosandGitHub
|
9a01f8307f
|
Merge pull request #1595 from volatilityfoundation/walk_internal_list_bug
Add smear checks and missing absolute flag to walk_internal_list
|
2025-02-01 12:31:48 +00:00 |
|
|
Mike Auty
|
df310c0d92
|
Manually revert 74a834b
This should resolve the issue experienced #1590 was trying to resolve.
|
2025-02-01 12:27:49 +00:00 |
|
|
Gustavo Moreira
|
1da15d1352
|
linux: pscallstack plugin: Fix canonical addresses
|
2025-02-01 20:55:54 +11:00 |
|
|
Gustavo Moreira
|
0ba331f34c
|
linux: kallsyms api: Added support for older kernels lacking mod_tree. Enhanced module address search performance by using the new module memory boundaries function
|
2025-02-01 20:55:40 +11:00 |
|
|
Gustavo Moreira
|
2af8b95ea4
|
linux: module object extension: add method to know the module memory boundaries based on its symbols addresses and sizes
|
2025-02-01 20:55:35 +11:00 |
|
|
Gustavo Moreira
|
9175c1b1e9
|
linux: kallsyms api: ensure all the addresses are in the same range
|
2025-02-01 20:55:29 +11:00 |
|
|
Gustavo Moreira
|
4469ab49c8
|
linux: kallsyms api: move the unsupport implementation message to the info log level
|
2025-02-01 18:12:51 +11:00 |
|
|
Gustavo Moreira
|
fbba4c7675
|
linux: new pscallstack plugin: add a poor man's process stack call enumeration plugin to showcase the power of the kallsyms API
|
2025-02-01 17:55:50 +11:00 |
|
|
Gustavo Moreira
|
d665fcc2b5
|
linux: kallsyms plugin: Enable filtering of symbols by subsystem
|
2025-02-01 17:55:42 +11:00 |
|
|
Gustavo Moreira
|
97135a992a
|
linux: add Kallsyms plugin
|
2025-02-01 17:55:33 +11:00 |
|
|
Gustavo Moreira
|
6174687204
|
linux: Introduce Kallsyms API
|
2025-02-01 17:55:21 +11:00 |
|
|
Gustavo Moreira
|
7e4b548e17
|
linux: task_struct object extension: Add method to get the task address space layer, even if its a kernel thread
|
2025-02-01 17:55:13 +11:00 |
|
|
Gustavo Moreira
|
e2431eebdf
|
linux: bpf_prog: Add methods to get the program address and its memory regions
|
2025-02-01 17:55:05 +11:00 |
|
|
Gustavo Moreira
|
0e0daffc45
|
linux: Add kernel_symbol object extension
|
2025-02-01 17:54:55 +11:00 |
|