WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 02:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
6,047 Commits 80 Branches 17 Tags
bugfix/missing_modules
Commit Graph
6047 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Gustavo Moreira bbd2f9bc37 linux: intel VMCoreInfo: Fix bug introduced in last commit reverting the layer metadata dict 2024-11-22 22:40:53 +11:00
ikelosandGitHub fb101de6fc Merge pull request #1362 from c0rydoras/fix/cache-dir 
Follow XDG Base Directory Specification for cache directory
 2024-11-22 11:32:57 +00:00
Arthur Deierlein a2b96c0dc0 fix: dont use / for compat 2024-11-22 11:46:59 +01:00
Arthur Deierlein b93d5b7c13 update docs 2024-11-22 11:23:56 +01:00
Arthur Deierlein 1abb4cc881 comply with xdg base directory spec by using XDG_CACHE_HOME if its set 2024-11-22 11:13:21 +01:00
Gustavo Moreira 41d2e924d1 linux: intel VMCoreInfo: Revert changes associated with adding vmcoreinfo dict to the layer metadata 2024-11-20 11:47:37 +11:00
Gustavo Moreira 9f6d194980 linux: intel VMCoreInfo: The _direct_metadata class attribute needs to be modified; otherwise, it will only exist within the instance namespace. 2024-11-19 12:47:56 +11:00
Gustavo Moreira 96f5fdae2f linux: intel VMCoreInfo: Add the vmcoreinfo to the layer metadata 2024-11-19 11:25:52 +11:00
ikelosandGitHub ac482e3e13 Merge pull request #1359 from eve-mem/windows_svcscan_remove_yara_dep 
Windows: Remove dep on vadyarascan from svcscan plugin
 2024-11-18 22:29:15 +00:00
eve 1ba5b04b7d Windows: Remove dep on vadyarascan from svcscan plugin 2024-11-18 21:20:04 +00:00
eve e374ca9647 Windows.vadregexscan: update imports, revert vadyarascan changes 2024-11-18 21:15:06 +00:00
eve 07701fc4cf windows.vadregexscan: remove dependency on vadyarascan 2024-11-18 18:32:51 +00:00
Gustavo Moreira 13729ac25f linux: VMCoreInfo API: AARCH64 uses NUMBER() with hex values. Fortunately, includes the 0x prefix, allowing the parser to still handle these cases correctly 2024-11-18 18:18:14 +11:00
Gustavo Moreira d80ef55325 linux: intel VMCoreInfo: Select the fastest scanner for each scenario 2024-11-18 17:49:30 +11:00
eve 6d366f16ee Windows.vadregexscan: update imports 2024-11-18 06:38:06 +00:00
Gustavo Moreira f2a2f8aa67 linux: intel VMCoreInfo: immediately abort processing the current VMCOREINFO if DTB is not found 2024-11-18 17:00:00 +11:00
Gustavo Moreira 4a88a7450b linux: VMCoreInfo API: Integrate support for value parsing within the VMCoreInfo API 2024-11-18 16:47:45 +11:00
Gustavo Moreira 4c0ddca796 linux: intel VMCoreInfo: BugFix. Return layer if both values are present 2024-11-18 15:20:38 +11:00
Abyss Watcher f192437a94 typo 2024-11-15 17:11:11 +01:00
Abyss Watcher a7620cd6f6 linux fbdev subsystem api plugin 2024-11-15 17:09:21 +01:00
Abyss Watcher 36a18f405b fourcc code converter helper 2024-11-15 17:05:23 +01:00
Abyss Watcher 9f145ddcf0 pillow dependency 2024-11-15 17:04:33 +01:00
eve aa93b57f0d Fix windows.vadregexscan sections 2024-11-15 13:15:40 +00:00
eve c2058e744b Fix missing type imports for regex plugins 2024-11-15 13:12:03 +00:00
eve b802b16c62 Add first version of regex scanning plugins 2024-11-15 13:03:36 +00:00
ikelosandGitHub 8790814d54 Merge pull request #1323 from gcmoreira/linux_netfilter_fix_hooked 
Linux: netfilter plugin: Fix hooked field to match Volatility2 output
 2024-11-15 09:11:23 +00:00
Gustavo Moreira c909fdd4e7 linux: netfilter plugin: Bump minor version 2024-11-15 11:53:05 +11:00
Gustavo Moreira bee3f001b6 linux: netfilter plugin: Enhance docstring to provide a clearer explanation of 'hooked' 2024-11-15 11:31:30 +11:00
ikelosandGitHub 8e355c0eaf Merge pull request #1350 from eve-mem/volshell_display_default_constant 
Volshell: Make the default number of bytes returned by db, dw, dd, dq, rx, and dis use a constant
 2024-11-14 17:51:55 +00:00
eve 357d8a914b Volshell: Make the default number of bytes returned by db, dw, dd, dq, rx, and dis use the constant DEFAULT_NUM_DISPLAY_BYTES 2024-11-14 10:55:41 +00:00
Gustavo Moreira 41a93473e9 linux: intel VMCoreInfo: Improve layer config code 2024-11-14 19:35:47 +11:00
Gustavo Moreira 00b528aafe linux: intel VMCoreInfo: Fix docstring typo 2024-11-14 18:57:26 +11:00
Gustavo Moreira 5ab97564ac linux: intel VMCoreInfo: Move to its own stacker... 
Maximize use of VMCOREINFO data without reliance on ISF symbols:
- Obtain the DTB
- Utilize OSRELEASE (the same as UTS_RELEASE used in the Linux banner and init_uts_ns/new_utsname) to prefilter the list of Linux banners, reducing search time for linux_banner in memory.
- Find the correct layer using the VMCOREINFO data (including 32bit PAE).
 2024-11-14 16:37:05 +11:00
ikelosandGitHub fe91feac5e Merge pull request #1347 from eve-mem/regex_scan 
Volshell: add regex_scan
 2024-11-13 23:49:30 +00:00
eve af7a420cdc Volshell: rename regex_scan short hand to rx so that it does not clash with the built in python re module 2024-11-13 08:56:58 +00:00
Gustavo Moreira 173e35105a LinuxMixin: Make new methods internal 2024-11-13 12:30:11 +11:00
Gustavo Moreira 36c19aa6d9 core: Bump framework minor version 2024-11-13 12:21:03 +11:00
Gustavo Moreira 05e8f8ff10 intel layer: Move constants to the Intel class 2024-11-13 12:20:03 +11:00
ikelosandGitHub d2ae43c6d8 Merge pull request #1346 from gcmoreira/linux_misc_fixes 
Linux - miscellaneous fixes
 2024-11-12 23:09:21 +00:00
ikelosandGitHub 340bd6d7c0 Merge pull request #1348 from gcmoreira/linux_kthreads_plugin 
Linux: Add kthreads plugin to enumerate kernel threads start address
 2024-11-12 23:03:41 +00:00
Gustavo Moreira 787e15ac2b Linux: kthreads plugin: Add missing requirements 2024-11-13 09:50:08 +11:00
Gustavo Moreira 8efe429719 Linux: kthreads plugin: Adjust required framework version 2024-11-12 18:32:26 +11:00
eve 780f9ab6f5 Volshell: add regex_scan 2024-11-12 07:22:45 +00:00
Gustavo Moreira d90019657c Linux: Add kthreads plugin to enumerate kernel thread functions 2024-11-12 18:14:36 +11:00
Gustavo Moreira 3a734fdeb1 Linux: Object extensions: Remove redundant log message header; the logger handles this formatting. If needed, we can adjust the logger's format instead 2024-11-12 16:23:33 +11:00
Gustavo Moreira a2e99b2633 Linux: Object extensions: Fix type annotations for improved clarity and accuracy. 2024-11-12 16:13:50 +11:00
Gustavo Moreira 3216700d8b Linux: module object extension: Fix recursion call issue 2024-11-12 16:05:59 +11:00
Gustavo Moreira 106b3b3dd0 Linux: PageCache: Fix inode offset when logging an error 2024-11-12 16:01:04 +11:00
Abyss Watcher dd3542b127 explicit loop iterator 2024-11-08 17:51:48 +01:00
Abyss Watcher 485ef894e1 remove taints_value overload attr 2024-11-08 17:49:08 +01:00