WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 02:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
6,047 Commits 80 Branches 17 Tags
bugfix/missing_modules
Commit Graph
6047 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Gustavo Moreira 88b32b0803 linux: task_struct object extension: Add helper to obtain the task state 2025-02-01 17:54:47 +11:00
Gustavo Moreira dba90ac217 linux: Add support for module symbol types 2025-02-01 17:54:41 +11:00
Gustavo Moreira 18a69b9417 linux: add latched RB-trees implementation 2025-02-01 17:54:27 +11:00
Andrew Case 60dc0c04f4 Address feedback. Add doc strings 2025-01-31 22:37:21 -06:00
ikelosandGitHub 5a046ea0e4 Merge pull request #1590 from volatilityfoundation/mnt_parent_missing 
Add mnt_parent check to kernel version validation
 2025-02-01 01:46:46 +00:00
ikelosandGitHub 75b55c3b30 Merge pull request #1593 from volatilityfoundation/mountinfo_superblock_check 
Add missing pointer validation check in mountinfo
 2025-02-01 01:43:13 +00:00
ikelosandGitHub 346a5d98da Merge pull request #1592 from volatilityfoundation/kthread_name_smear 
Prevent backtraces when kthread full name is smeared
 2025-02-01 00:56:10 +00:00
ikelosandGitHub 4df047beac Merge pull request #1591 from volatilityfoundation/check_sock_access 
Fix broken socket retrieval that causes backtrace
 2025-02-01 00:55:08 +00:00
David McDonald 1d1af696ff Windows: Handles - catch exception in handle iteration 
An `InvalidAddressException` can occur inside of `__iter__` when
iterating over the handle table (the exact exception occurs when
creating the subtype in `objects.Array.__getitem__`. This changes the
handle code to do a manual iteration over the sequence using the array
length and indexes, catch the exception, log the index, and continue.

In the test sample that prompted this change, the exception occurred on
the access of the very last item in the array.

closes #1573
 2025-01-31 17:35:08 -06:00
Andrew Case b81d2a2781 Fix get_name API, fix malfind 2025-01-31 23:03:43 +00:00
Andrew Case 941e40c368 Fix get_name API, fix malfind 2025-01-31 22:59:32 +00:00
Andrew Case 3b3331a58d Add smear checks and missing absolute flag to walk_internal_list 2025-01-31 22:32:35 +00:00
Andrew Case efbc410c4d Add missing pointer validation check in mountinfo 2025-01-31 21:43:32 +00:00
Andrew Case 644b967c62 Prevent backtraces when kthread full name is smeared 2025-01-31 21:31:07 +00:00
Andrew Case 4d43ac9a6d Catch invalid address exception for invalid sock values 2025-01-31 20:46:16 +00:00
Andrew Case cb3542f76a Catch invalid address exception for invalid sock values 2025-01-31 20:40:51 +00:00
Andrew Case 1132bd9830 Add mnt_parent check to kernel version validation 2025-01-31 18:11:22 +00:00
Andrew Case 55b27a68d5 Add mnt_parent check to kernel version validation 2025-01-31 18:10:12 +00:00
ikelosandGitHub 1f983aca73 Merge pull request #1585 from volatilityfoundation/issues/issue1577 
Expose and use `get_pefile_obj` rather than having local copies
 2025-01-31 17:30:22 +00:00
ikelosandGitHub b51acfd3fb Merge pull request #1407 from eve-mem/WindowsCommitCharge_issue1400 
Windows: Update get_commit_charge extension to handle Core.CommitCharge case
 2025-01-31 16:44:24 +00:00
eve e9d1831a7c Windows: update get_commit_charge with CommitCharge fix by BeanBagKing 2025-01-31 14:45:28 +00:00
Mike Auty 68c8b2389a Make error messages a little more descriptive 2025-01-31 10:00:16 +00:00
ikelosandGitHub b81105f508 Merge pull request #1587 from gcmoreira/intel_translation_performance_improvement 
intel: address translation: performance improvements caching by page address
 2025-01-31 09:55:06 +00:00
ikelosandGitHub 702257fb4e Merge pull request #1586 from gcmoreira/framework_improve_conversion_to_strings 
Framework improve conversion to strings
 2025-01-31 09:04:33 +00:00
Gustavo Moreira 815b2fe918 Fix bug in address_to_string() helper 2025-01-31 19:49:04 +11:00
Gustavo Moreira c82ef0cfd2 intel: address translation: performance improvements caching by page address 2025-01-31 19:29:33 +11:00
Gustavo Moreira b91724c3ef Replace *_to_string() for a block reader implementation for better performance. Add new address_to_string() helper 2025-01-31 18:48:52 +11:00
Gustavo Moreira 9218e0e07f fix double null-termination search 2025-01-31 18:47:11 +11:00
ikelosandGitHub f83386f19b Update volatility3/framework/symbols/linux/extensions/__init__.py 
My bad, little typo when trying to fix it last time
 2025-01-30 11:13:25 +00:00
ikelosandGitHub f6106c8f19 Apply suggestions from code review 
Try to patch up ruff failures through suggestions.
 2025-01-30 11:10:36 +00:00
ikelosandGitHub d3e55db41d Apply suggestions from code review 
Hopefully I can fix up my breakage...
 2025-01-30 11:04:58 +00:00
ikelosandGitHub e66d6745ef Merge branch 'develop' into linux_ifconfig_plugin 2025-01-30 11:01:06 +00:00
ikelosandGitHub ad0000e36a Merge pull request #1509 from gcmoreira/linux_module_symbols_improvements 
linux: module symbols: Fixes and code improvements
 2025-01-30 10:48:28 +00:00
ikelosandGitHub 9b532ad307 Merge branch 'develop' into linux_module_symbols_improvements 2025-01-30 10:37:46 +00:00
ikelosandGitHub 8a4f344c26 Merge pull request #1332 from gcmoreira/linux_vmcoreinfo_aslr_and_plugin 
Linux: Address limitations in determining KASLR shifts by introducing VMCoreInfo support
 2025-01-30 10:25:25 +00:00
Gustavo Moreira 981e097567 linux: module object extension: Revert the changes to get the ELF symbol index 2025-01-30 21:03:33 +11:00
Gustavo Moreira 67a83871ad linux: module object extension: Add a function to return the extended ELF symbol information (symbol object and its index) so that doesn't change the get_symbols() interface 2025-01-30 20:54:38 +11:00
Gustavo Moreira f3095513a1 linux: elf_sym: use a class attribute for the symbol max length 2025-01-30 20:26:51 +11:00
Gustavo Moreira 5d2819a98d linux: elf: fix imports 2025-01-30 20:25:22 +11:00
Gustavo Moreira e8934e94ce Merge branch 'develop' into linux_module_symbols_improvements 2025-01-30 19:53:50 +11:00
Gustavo Moreira 8b6c00e64f linux: vmcoreinfo plugin: simplify hex conversion 2025-01-30 18:48:42 +11:00
Gustavo Moreira f6a22eed05 linux: vmcoreinfo API: significantly improve the performance when validating each character, from O(n) to O(1).. where n is 100 chars long 2025-01-30 18:44:18 +11:00
Gustavo Moreira c2f2fc6b42 linux: vmcoreinfo API: fix single letter variable 2025-01-30 18:25:58 +11:00
Gustavo Moreira cdfa85570a Merge branch 'develop' into linux_vmcoreinfo_aslr_and_plugin 2025-01-30 18:12:19 +11:00
ikelosandGitHub 825fd8eb6a Merge pull request #1557 from gcmoreira/linux_parity_release_harden_pointer_validation 
Linux - Parity release - Harden pointer validation in several plugins and APIs
 2025-01-30 01:00:36 +00:00
Gustavo Moreira 4466d9accd linux: kmsg plugin: log warning instead of error 2025-01-30 11:47:17 +11:00
ikelosandGitHub 2d0856f58b Merge branch 'develop' into issues/issue1577 2025-01-30 00:34:41 +00:00
Gustavo Moreira 3bd1c70a9b linux: kmsg plugin: improve return types 2025-01-30 11:33:28 +11:00
ikelosandGitHub 1b554b40e4 Merge pull request #1578 from volatilityfoundation/issues/issue1575 
Shift exposed staticmethods to classmethods
 2025-01-30 00:32:14 +00:00
ikelosandGitHub 8125b0d6fa Merge pull request #1545 from gcmoreira/linux_parity_release_harden_mountinfo_api_and_related_fixes 
Linux - Harden mountinfo API and several related fixes
 2025-01-30 00:31:56 +00:00