j-t-1 and GitHub
a180ae4072
Merge branch 'volatilityfoundation:develop' into doc
2024-12-19 06:08:42 +00:00
Gustavo Moreira
7ed8b99e98
linux: vmcoreinfo layer: Use the version class accessor instead of the internal class member
2024-12-19 15:50:17 +11:00
TheMythologist
35f72a088a
Merge branch 'develop' into minor-improv
2024-12-19 12:17:29 +08:00
TheMythologist
c82d432b10
Typing fix
2024-12-19 12:16:55 +08:00
Gustavo Moreira
7858af3d6d
linux: vmcoreinfo layer: remove unused import
2024-12-19 14:51:33 +11:00
Gustavo Moreira
d56f3a5537
linux: vmcoreinfo layer: Add review suggestions
2024-12-19 14:49:23 +11:00
Gustavo Moreira
d14c777b4f
linux: vmcoreinfo layer: Update to use the new cache-manager
2024-12-19 14:40:51 +11:00
Gustavo Moreira
03aba8df8f
Merge branch 'develop' into linux_vmcoreinfo_aslr_and_plugin
2024-12-19 14:31:53 +11:00
Gustavo Moreira
3c26955e34
xen_layer: fix potential uninitialized variable issue #1434
2024-12-19 12:02:16 +11:00
ikelos and GitHub
62940c311c
Merge pull request #1433 from j-t-1/colon
...
Change semi-colon to colon
2024-12-19 00:28:29 +00:00
ikelos and GitHub
a52b21b336
Merge pull request #1429 from gcmoreira/linux_pslist_user_group_cred_ids
...
Linux pslist plugin - Add tasks real and effective user and group identifiers
2024-12-19 00:15:53 +00:00
ikelos and GitHub
11f51396e8
Merge pull request #1431 from j-t-1/floor
...
Use floor division
2024-12-19 00:15:37 +00:00
ikelos and GitHub
58858a8a87
Merge pull request #1430 from j-t-1/readability
...
Use generator expressions
2024-12-19 00:13:49 +00:00
ikelos and GitHub
d9e157234a
Merge branch 'develop' into linux_pslist_user_group_cred_ids
2024-12-19 00:04:33 +00:00
ikelos and GitHub
7410411e7a
Merge pull request #1427 from gcmoreira/linux_envars_plugin_improvements
...
Linux - Envars plugin: Add function to retrieve environment variables for a specific task
2024-12-18 23:58:47 +00:00
j-t-1 and GitHub
a9417edd28
Slightly modify documentation
2024-12-18 17:49:56 +00:00
David McDonald
7eca407b6d
Windows PEDump: Revert overwritten changes
...
When #1364 was merged, it may not have been rebased onto the changes
introduced in #1422 , and they ended up overwritten to the old version.
This reverts those changes.
2024-12-18 11:44:56 -06:00
j-t-1 and GitHub
2010dbd713
Merge branch 'volatilityfoundation:develop' into doc
2024-12-18 17:42:01 +00:00
j-t-1 and GitHub
1e2900d587
Slightly modify documentation
2024-12-18 17:39:03 +00:00
j-t-1 and GitHub
c865f4892c
Slightly modify documentation
2024-12-18 17:36:05 +00:00
David McDonald
7464a3b883
Windows Extensions: Fix potential AttributeErrors
...
If `self.get_owner()` returns `None`, and the chained call to
`is_valid()` is executed, an `AttributeError` will occur. This fixes two
instances of this bug by intializing a local variable with the result of
the `get_owner()` call, checking for `None`, and returning if that's the
case.
Also adds type-hints for these methods.
2024-12-18 11:00:24 -06:00
ikelos and GitHub
2383ea2b26
Merge pull request #1428 from gcmoreira/linux_fix_parent_tgid
...
Linux: task.get_parent_pid() fix to mimic getppid() syscall
2024-12-18 08:42:17 +00:00
j-t-1 and GitHub
cf7aabead4
Change semi-colon to colon
2024-12-18 08:12:49 +00:00
TheMythologist
d7f678879d
Minor improvements for mypy
2024-12-18 15:18:33 +08:00
j-t-1 and GitHub
860a8146fb
Use floor division
2024-12-18 06:44:23 +00:00
j-t-1 and GitHub
3da14b3873
Use generator expressions
...
PEP 289 – Generator Expressions.
2024-12-18 06:40:19 +00:00
Gustavo Moreira
ddb4db5eab
linux: pslist: Handle cases where credential IDs are unavailable due to an invalid credential pointer
2024-12-18 16:22:27 +11:00
Gustavo Moreira
e92b55ac86
linux: Update version requirements in all plugins dependent on pslist
2024-12-18 16:09:42 +11:00
Gustavo Moreira
f3cf182206
linux: pstree: Update to use TaskFields from pslist.get_task_fields()
2024-12-18 16:09:36 +11:00
Gustavo Moreira
40bdbf62da
linux: pidhashtable: Update to use TaskFields from pslist.get_task_fields(). Fix some type annotations
2024-12-18 16:09:28 +11:00
Gustavo Moreira
8e12cf02e3
linux: psscan: reimplemented to make use of pslist.get_task_fields()
2024-12-18 16:09:22 +11:00
Gustavo Moreira
448ba24eac
linux: pslist: add user/group , real/effective identifiers to the output: uid,gid, euid and egid.
...
We reimplemented get_task_fields() using a dataclass, reducing the size of the function's interface and preventing unbounded growth. This change simplifies future modifications and enhances maintainability.
2024-12-18 16:09:17 +11:00
Gustavo Moreira
2de553e1c1
linux: cred: add user identifiers to the cred object extension
2024-12-18 16:09:11 +11:00
Gustavo Moreira
d934d4421b
linux: get_parent_pid: Fix parent ID to correctly mimic getppid() syscall behavior by using TGID instead of PID
2024-12-18 12:02:14 +11:00
Gustavo Moreira
e231d826a9
linux: envars plugin: Complete get_task_env_variables() docstring
2024-12-18 11:38:51 +11:00
Gustavo Moreira
e8a73dfb2d
linux: envars plugin: Add function to retrieve environment variables for a specific task. Code improvements.
2024-12-18 11:29:28 +11:00
ikelos and GitHub
197d24567a
Merge pull request #1426 from gcmoreira/linux_testcases_full_plugins_coverage
...
Linux testcases full plugins coverage
2024-12-17 23:53:12 +00:00
Gustavo Moreira
9c0dcad7b1
linux: page cache inodepages testcase: explicitly close the file to improve clarity for AI processing
2024-12-18 10:42:54 +11:00
Gustavo Moreira
69d291c644
linux: testcases: add 10 final test cases to achieve full plugin coverage
2024-12-18 10:16:59 +11:00
ikelos and GitHub
0ec33a4d69
Merge pull request #1399 from dgmcdona/dgmcdona/missing_session_space_def
...
Windows: Handle missing _MM_SESSION_SPACE
2024-12-17 23:14:44 +00:00
Gustavo Moreira
9c587b0378
linux: testcases: improve existent testcases code and checks
2024-12-18 10:12:32 +11:00
ikelos and GitHub
7d2f8b2ccf
Merge pull request #1412 from gcmoreira/linux_task_parent_pid_fix
...
Linux: Fix task parent pid in several plugins
2024-12-17 23:06:04 +00:00
Gustavo Moreira
e035faa323
bump framework minor version
2024-12-18 09:55:13 +11:00
ikelos and GitHub
992ba3e9ef
Merge pull request #1424 from j-t-1/readability
...
Use generator expressions
2024-12-17 22:29:39 +00:00
ikelos and GitHub
16de3fadd8
Merge pull request #1425 from volatilityfoundation/1324-pedump-help-message-doesnt-match-flag
...
#1324 - update pedump error messages
2024-12-17 22:29:22 +00:00
ikelos and GitHub
32383a3418
Merge pull request #1364 from c0rydoras/linting
...
use ruff for linting
2024-12-17 22:09:55 +00:00
Dave Lassalle
0d7c2906ee
#1324 - update pedump error messages
2024-12-17 16:01:51 -06:00
Arthur Deierlein
44e8ac645f
chore: make ruff happy
...
the import is not needed, was previously used for type annotations
2024-12-17 22:59:04 +01:00
Arthur Deierlein
c6c3b35f52
run ruff check . --unsafe-fixes --fix
2024-12-17 22:55:39 +01:00
Arthur Deierlein
d9c370c6ae
format with black
2024-12-17 22:55:39 +01:00
