WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 02:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
6,047 Commits 80 Branches 17 Tags
bugfix/missing_modules
Commit Graph
6047 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Andrew Case 291bc878ad Break in a cleaner flow 2024-09-14 16:31:33 -05:00
Andrew Case 21d21cf4b8 Break properly in all paths. Help callers to ensure always lower case module name matching. 2024-09-14 16:26:38 -05:00
Andrew Case ba0c975e73 Address all feedback 2024-09-13 18:50:47 -05:00
Abyss Watcher 67ee382c32 use default req value in config_value call 2024-09-13 18:53:33 +02:00
Gustavo Moreira cd2af74e6d Improve pointers address verification and return message chain 2024-09-13 17:58:21 +10:00
Gustavo Moreira 997abeda6d Linux lsof: Add namespace dentry name 2024-09-13 17:27:02 +10:00
Gustavo Moreira e084086ee5 Improve pointer verification in super_block->get_type() 2024-09-13 16:18:26 +10:00
Gustavo Moreira 32eaeeb7d2 Fix typing typo 2024-09-13 16:13:00 +10:00
Gustavo Moreira aecd31f095 Add missing pointer verification 2024-09-13 16:09:49 +10:00
Gustavo Moreira 867c8e3f1b Linux: Add support for threads in both lsof and sockstat plugins. 
- lsof plugin: source code refactored
- lsof plugin: Added the 'device' column to complete the inode information. An inode number is specific to the filesystem/device it belongs to.
- lsof/sockstat plugins: Add threads support. Threads may or may not share the file descriptor table with the thread group leader, depending on whether the CLONE_FILES flag is included in the clone() syscall. Also, once started, a thread can unshare the fd table with its parent. Refer to the unshare() libc syscall wrapper man page, unshare(2). Additionally, note that the Linux lsof command in user space includes thread listings by default as well. Now, there are two columns to identify the thread group ID  (PID) and the task/thread ID (TID).
- Added inode getters from both, the dentry and file structs. From kernels +3.9 the file struct cached the inode pointer. So, when possible, we get this value.
- Improve smear protection in these plugins and various APIs (https://github.com/volatilityfoundation/volatility3/pull/1243)
 2024-09-13 15:33:19 +10:00
Gustavo Moreira 48ae43d64e Bumping the major version since the output changed 2024-09-12 17:22:52 +10:00
Gustavo Moreira 7b2e259c6d fix wrong variable names 2024-09-12 17:06:29 +10:00
Gustavo Moreira ebb9f0c201 Fix typo in timeliner function 2024-09-12 17:05:45 +10:00
Gustavo Moreira a7dcd6d9e8 Minor: Add comment on TimeLinerInterface subclass filter 2024-09-12 16:19:13 +10:00
Gustavo Moreira be05ace29b Timeliner plugin: Add exception information 2024-09-12 16:06:40 +10:00
Gustavo Moreira 57de357ffd Timeliner plugin: Fix issue with filtering TimeLinerInterface plugins and using the filter argument 2024-09-12 16:05:40 +10:00
Gustavo Moreira 9e8471799a Improving code and adding the credential virtual addresses to the output. 2024-09-12 10:44:43 +10:00
Gustavo Moreira c77c662b70 Linux pidhashtable plugin pointer verification improvements 2024-09-11 21:09:08 +10:00
Gustavo Moreira 037eb1ce03 Linux Check_creds plugins pointer verification improvements 2024-09-11 16:30:41 +10:00
Gustavo Moreira c86d973329 Linux page cache plugins pointer verification improvements 2024-09-11 15:54:17 +10:00
ikelosandGitHub e76d51251b Merge pull request #1253 from volatilityfoundation/issues/issue1252 
CLI: Filter on rendered values
 2024-09-10 23:26:50 +01:00
ikelosandGitHub d238c59134 Merge pull request #1254 from volatilityfoundation/issues/plugin-requirement-recursion 
Core: Verify plugin requirements of plugins
 2024-09-10 23:26:27 +01:00
ikelosandGitHub 7d75c172f1 Merge pull request #1198 from volatilityfoundation/issues/issue1195 
Linux: Update vmayarascan to scan complete VMA blocks
 2024-09-10 22:02:14 +01:00
ikelosandGitHub f30cf39449 Merge branch 'develop' into issues/issue1195 2024-09-10 21:40:08 +01:00
Andrew Case b40c20dd7f Revert back to union to avoid failed tests 2024-09-10 14:55:00 -05:00
Andrew Case b7e604d63f Address feedback 2024-09-10 14:50:40 -05:00
Mike Auty fd2c97e1ba CLI: Use enumerate for renderers (thanks @gcmoreira) 2024-09-09 00:44:00 +01:00
Mike Auty 9152f33181 Core: Allow circular dependencies as long as they are all met 2024-09-08 21:58:09 +01:00
Mike Auty bf000ff0a0 Core: Add recursion protection to VersionRequirement check 2024-09-08 21:42:59 +01:00
Mike Auty ace590e8f0 Core: Fix up f-string containing a string 2024-09-08 16:08:48 +01:00
Mike Auty f3085b6c59 Core: Move the pluginrequirement check to generic versionrequirement 2024-09-08 16:06:23 +01:00
Mike Auty 4361c38573 Core: Verify plugin requirements of plugins 2024-09-08 14:55:04 +01:00
Mike Auty 8259ca9019 Core: Bump the framework number so we can differentiate CLI versions 2024-09-08 13:47:26 +01:00
Mike Auty 26cd73115b CLI: Filter on rendered values 2024-09-08 13:31:09 +01:00
Andrew Case 802fc024b5 switch api place 2024-09-06 13:27:04 -05:00
Andrew Case 61cf58d977 black fixes 2024-09-06 12:49:01 -05:00
Andrew Case fd87772877 Move VAD enumeration into pe_symbols 2024-09-06 12:47:42 -05:00
Andrew Case bcd93616c0 more black help 2024-09-06 12:36:35 -05:00
Andrew Case 7b48ee4be4 more black help 2024-09-06 12:36:13 -05:00
Andrew Case c223ac6e76 more black help 2024-09-06 12:31:55 -05:00
Andrew Case 30cb5bd3ab Formatting that my local black doesn't understand 2024-09-06 12:14:06 -05:00
Andrew Case 3bb9264a57 formatting 2024-09-06 12:11:16 -05:00
Andrew Case 69e6e59daf Add new pe_symbols API, debug registers plugin, unhooked system calls plugin 2024-09-06 12:01:21 -05:00
ikelosandGitHub d56cd83510 Merge pull request #1225 from volatilityfoundation/orphan_threads_v2 
Orphan threads v2
 2024-09-03 20:50:06 +01:00
ikelosandGitHub 6803bf375b Merge pull request #1249 from volatilityfoundation/mft_size_smear_fix 
Mft size smear fix
 2024-09-03 20:48:04 +01:00
Andrew Case 9c058936a8 Address feedback 2024-09-03 10:30:05 -05:00
ikelosandGitHub a40ac64572 Merge pull request #1247 from Abyss-W4tcher/archs_spec_unification 
[core, constants] : add OS and framework supported architectures
 2024-09-02 22:11:30 +01:00
ikelosandGitHub 3f5fce31e7 Merge pull request #1208 from dadokkio/develop 
yara-x support for yarascan
 2024-09-02 21:51:50 +01:00
Andrew Case 660e8a7b89 Add smear checks in MFT parsing code 2024-09-02 15:09:20 -05:00
Andrew Case 483cb7e4ee Add smear checks in MFT parsing code 2024-09-02 15:08:29 -05:00