WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 02:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
6,047 Commits 80 Branches 17 Tags
bugfix/missing_modules
Commit Graph
6047 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
ikelosandGitHub 793039b6a3 Merge pull request #1402 from TheMythologist/develop 
Refactor: move version `None` check to top
 2024-12-16 23:45:07 +00:00
ikelosandGitHub b037a486b5 Merge pull request #1405 from gcmoreira/fix_dentry_prior_kernels_3.19 
Linux - Fix dentry type support for kernels pre 3.19
 2024-12-16 23:42:25 +00:00
ikelosandGitHub dc4eedb3f9 Merge pull request #1403 from j-t-1/text_renderer 
Tiny change text_renderer.py
 2024-12-16 23:30:33 +00:00
ikelosandGitHub 71de86d19d Merge pull request #1398 from j-t-1/manual 
Update the CLI manual documentation
 2024-12-16 23:25:24 +00:00
Gustavo Moreira 267c5a60c3 Linux: PageCache: Remove unused variable 2024-12-17 10:05:38 +11:00
ikelosandGitHub d2725b6a00 Merge pull request #1394 from j-t-1/linux 
Tweak the getting started linux tutorial
 2024-12-16 22:46:44 +00:00
ikelosandGitHub 2fd9dd8a52 Merge pull request #1395 from j-t-1/mac 
Tweak the getting started mac tutorial
 2024-12-16 22:45:40 +00:00
ikelosandGitHub 88537066fa Merge pull request #1396 from j-t-1/windows 
Tweak the getting started windows tutorial
 2024-12-16 22:44:32 +00:00
eve 4e2227e264 Windows: Update get_commit_charge extension to handle Core.CommitCharge case 2024-12-16 17:54:01 +00:00
j-t-1andGitHub b37923c183 Remove use of int function after math.ceil 
Return type of math.ceil is already an int.
 2024-12-16 17:08:37 +00:00
j-t-1andGitHub 02b11b44a2 Remove use of int function after math.ceil 
Return type of math.ceil is already an int.
 2024-12-16 16:59:58 +00:00
Gustavo Moreira 3b0f0915c7 linux: page_cache: add testcase for page_cache.files plugin 2024-12-16 19:36:54 +11:00
Gustavo Moreira bb1ff69e42 linux: dentry: Fix dentry type support for kernels pre-3.19 2024-12-16 19:25:24 +11:00
j-t-1andGitHub c8c39837ab Tiny change text_renderer.py 2024-12-15 19:26:22 +00:00
TheMythologist 5086be30b2 Refactor: move version None check to top 2024-12-15 14:04:15 +08:00
j-t-1andGitHub 31492f4ab8 Rectify maximum repetition of verbose flag 
From four to six (-vvvvvv).
 2024-12-14 15:50:50 +00:00
David McDonald e8b3185528 Windows: Handles - New pointer calculation method 
After researching this structure (`_HANDLE_TABLE_ENTRY`), it appears to
be stable as far back as Windows 8. It's also a union, with an
`ObjectPointerBits` member at the same offset as `LowValue` but within a
specific bit range (bit length 44, bit position 20). Taking this value
and shifting it left by four produces the correct pointer. This four-bit
shift is due to 16-byte alignment of object header structures, and is
what we would expect to see with 44-bit pointers in Windows. See
https://www.alex-ionescu.com/behind-windows-x64s-44-bit-memory-addressing-limit/
 2024-12-13 10:47:12 -06:00
David McDonald 04517ca797 Windows: Handle missing _MM_SESSION_SPACE 
As of Windows 11 24H2, the `_MM_SESSION_SPACE` type no longer appears in
the kernel PDB. Instead, the `_EPROCESS.Session` member refers to a new
type, `_PSP_SESSION_SPACE`, which does not have a type definition.
However, experimentation has shown that this new structure is
functionally identical to the old structure - the `ProcessList`
and `SessionId` members still appear to be at their old offsets.
In order to account for this when analyzing these newer Windows
versions, this catches the `SymbolError` and instantiates an `unsigned
long` at the offset (8) where the `SessionId` member would normally be
defined within an `_MM_SESSION_SPACE` structure.
 2024-12-12 23:24:40 -06:00
j-t-1andGitHub b235ed05b7 Update the CLI manual documentation 2024-12-12 18:50:23 +00:00
j-t-1andGitHub c740a6c770 Modify using as a library documentation 
Tiny changes.
 2024-12-12 18:14:35 +00:00
j-t-1andGitHub d77d696e2b Tweak the getting started windows tutorial 2024-12-12 17:49:25 +00:00
j-t-1andGitHub e31e13f471 Tweak the getting started mac tutorial 2024-12-12 17:44:01 +00:00
j-t-1andGitHub 6ffef285f4 Tweak the getting started linux tutorial 2024-12-12 17:36:51 +00:00
j-t-1andGitHub 58a9c3d6da Slightly modify documentation 
Include regex_scan, new functionality of volshell. Add Intermediate Symbol File (ISF) to glossary.
 2024-12-12 07:20:30 +00:00
Gustavo Moreira 9d0cd4b4c9 Linux: PageCache: Update inode plugin to conform to framework dumping convention 2024-12-12 11:17:15 +11:00
j-t-1andGitHub 3d260f3829 Slightly modify documentation 
Include regex_scan, new functionality of volshell.
 2024-12-11 12:42:20 +00:00
Mike Auty b6717d80d9 Windows: Fix up minor typo and CodeQL warning 2024-12-10 23:55:44 +00:00
ikelosandGitHub f00b596954 Merge pull request #1262 from volatilityfoundation/direct_indirect_system_calls 
Add detection of direct and indirect system calls
 2024-12-10 23:54:02 +00:00
j-t-1andGitHub fc33fd9127 Slightly modify documentation 
Include regex_scan, new functionality of volshell.
 2024-12-10 17:14:59 +00:00
j-t-1andGitHub 39cb75acca Slightly modify documentation 
Include regex_scan, new functionality of volshell.
 2024-12-10 17:02:48 +00:00
j-t-1andGitHub 0b2f4fdeb7 Remove redundant part of if statement 
Also reorder imports.
 2024-12-10 12:26:39 +00:00
j-t-1andGitHub faa6cab797 Remove redundant part of if statement 
Also reorder imports.
 2024-12-10 12:16:42 +00:00
j-t-1andGitHub 4bccf11629 Remove redundant part of if statement 
Also reorder imports.
 2024-12-10 11:31:16 +00:00
j-t-1andGitHub fdd49d0921 Slightly modify documentation 2024-12-10 10:11:26 +00:00
j-t-1andGitHub 1cde9ae06e Slightly modify volshell.rst 2024-12-10 09:46:28 +00:00
David McDonald a07ee5a0d5 fix(Windows: Handles): Unreliable SAR value on 24H2 
Handles are not being decoded in 24H2+ samples. This is because the
`Handles._decode_pointer` method grabs the SAR shift value from the
disassemble function, but in these samples this value (`0x11`) is
incorrect. Adding a fallback to the default SAR value of `0x10` if the
obtained pointer is not valid in the kernel address space  resolves the
issue.
 2024-12-09 18:11:27 -06:00
ikelosandGitHub b8298a345f Merge pull request #1169 from volatilityfoundation/mftscan_updates_resident_data_plugin 
Add new resident data displaying plugin. Scan in correct layer. Condense code and remove duplication. Fix bugs
 2024-12-09 20:24:27 +00:00
Andrew Case 13eae6c3df Add capstone to test system requirements. Allow lazy type checks 2024-12-09 13:19:06 -06:00
Andrew Case af65d7e32d Address feedback 2024-12-09 13:10:34 -06:00
Andrew Case e7fca5a83f Update year 2024-12-09 13:10:34 -06:00
Andrew Case 262c7f1aa7 Make VAD API public as intended 2024-12-09 13:10:34 -06:00
Andrew Case fce2125a8e Make VAD API public as intended 2024-12-09 13:10:34 -06:00
Andrew Case 9f8e39efa0 Fix formatting problem between black versions 2024-12-09 13:10:34 -06:00
Andrew Case e66a3e929b Add detection of direct and indirect system calls 2024-12-09 13:10:34 -06:00
ikelosandGitHub ec550232ac Merge pull request #1388 from eve-mem/issue_1387 
Interfaces: change allow list for filenames to ensure they work safely on windows. Fixes issue #1387
 2024-12-09 18:58:40 +00:00
Andrew Case 582feccf93 Address feedback 2024-12-09 12:56:07 -06:00
eve b86e839718 Interfaces: change allow list for filenames to ensure they work safely on windows. Fixes issue #1387 2024-12-09 18:30:19 +00:00
ikelosandGitHub 2ae723513a Merge pull request #1386 from j-t-1/doc 
Cosmetic changes to documentation
 2024-12-07 17:19:38 +00:00
j-t-1andGitHub 45f9064623 Cosmetic changes to documentation 2024-12-07 17:11:49 +00:00
j-t-1andGitHub e165c78ba7 Cosmetic changes to documentation 2024-12-07 16:37:39 +00:00