WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 02:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
6,047 Commits 80 Branches 17 Tags
bugfix/missing_modules
Commit Graph
6047 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Eve 437a91375d Linux: add TODO for mm_struct for methods that should be removed when moving to version 3.0.0 2024-02-20 06:39:42 +00:00
Alejandro Diego cd08cb95fd Windows: Add filtering by offset to psscan 
Add capability to the psscan plugin to filter by specific offset.
The filter would be used by other plugins to find specific offset using the psscan capabilities, like find
hidden processes as a result of some dkom for example.
The `--offset`  flag argument should represent a physical address space.

The flag is included in the following plugins:
  - dlllist
  - handles
 2024-02-19 13:35:31 -05:00
ikelosandGitHub 3703e119ce Merge pull request #1084 from volatilityfoundation/feature/table-check 
Symbols: Add support for metadata verification of symbol tables
 2024-02-18 22:19:14 +00:00
Gustavo Moreira cf81ceda82 Fix CodeQL suggestion 2024-02-13 20:20:25 +11:00
Gustavo Moreira 6e7b5b5941 Linux: Add linux_library_list test case 2024-02-13 19:41:30 +11:00
Gustavo Moreira cc35fecf91 Linux: Add library_list plugin and other ELF related code enhacements. 
- Add library_list plugin
- Add ELF dynamic table enum types in elf.json
- Update missing program header enum types in elf.json
- Add PAGE constants
- Add ELF ident and class enums
- Replace ELF hardcoded type numbers for enum description matching
- Fix unmanaged ValueError exception issue in Elf64Layer::_load_segments()
 2024-02-13 19:40:37 +11:00
Eve 53d4ec66eb Linux: Remove unnecessary import from linux extension. 2024-02-12 09:36:33 +00:00
Eve 0e75140ec5 Linux: update module extension with mod_mem_type property and add try/except for get methods 2024-02-12 09:35:06 +00:00
Eve 683319bd7f Linux: add deprecation warning for get_maple_tree_iter and get_mmap_iter mm_struct extensions. 2024-02-12 08:47:02 +00:00
Mike Auty 865f004f5c CLI: Ensure no filters still returns results 2024-02-09 00:00:21 +00:00
Mike Auty d8d3e157af CLI: Don't forget the core text filter class 2024-02-08 23:46:30 +00:00
Mike Auty 63a325c515 CLI: Add support for filtering lines from output 2024-02-08 23:44:12 +00:00
ikelosandGitHub 6d34e43667 Merge pull request #754 from volatilityfoundation/feature/cli-config-hierarchy 
CLI: Add support for a configuration options file
 2024-02-08 12:05:24 +00:00
Mike Auty 7b42ef0a9f Documentation: Add in more information about overriding configuration values 2024-02-08 11:59:50 +00:00
Mike Auty a66a446190 CLI: Reblack after updating PR - take 2 2024-02-08 11:16:41 +00:00
Mike Auty 9127509db9 CLI: Reblack after updating PR 2024-02-08 11:13:14 +00:00
ikelosandGitHub da06d2e55a Merge branch 'develop' into feature/cli-config-hierarchy 2024-02-08 11:10:28 +00:00
Eve 18220498ae Linux: update linux.pslist plugin to use task.mm.get_vma_iter() so that it works correctly on newer kernels 2024-02-07 09:08:25 +00:00
Eve 6a384c197c Linux: update mm_struct extension so that _get_maple_tree_iter and _get_mmap_iter are more clearly identified, showing that get_vma_iter should be used instead 2024-02-07 09:04:55 +00:00
ikelosandGitHub 795477e24b Merge pull request #1094 from iyassou/feature/windows-truecrypt 
Windows: add TrueCrypt plugin
 2024-02-04 09:28:55 +00:00
Iyassou Shimels d44c0fef36 run Black formatter 2024-02-04 11:21:14 +03:00
ikelosandGitHub bee98efd96 Merge pull request #1063 from forensicxlab/feature/IAT 
Feature: Import Address Table
 2024-02-03 23:50:11 +00:00
k1nd0ne cf9029fd85 Fixing the year in the Copyright 2024-02-04 00:43:33 +01:00
Iyassou Shimels 41cbfbfa34 add license 2024-02-03 11:58:25 +03:00
Iyassou Shimels ab8ed049a4 Windows: add TrueCrypt plugin 2024-02-03 11:32:00 +03:00
k1nd0ne 130621a2e7 Changing comment when Type error is occuring 2024-02-02 20:04:36 +01:00
EveandGitHub 4a2a9dabd6 Merge branch 'volatilityfoundation:develop' into linux_issue_1089_module_memory 2024-02-02 14:12:29 +00:00
Eve 261d7ffbf2 Linux: include all mod mem types in size calculations 2024-02-02 14:03:55 +00:00
Eve ecf20d99b4 Linux: fix typo in error message in module.get_module_init extension 2024-02-02 13:28:57 +00:00
Eve d1c7f14a75 Linux: attempt to fix issue 1089 2024-02-02 13:28:04 +00:00
Gustavo Moreira 828b688232 Fix issue with net namespace id and improve code 2024-02-02 21:29:10 +11:00
Gustavo Moreira 5219e8aaae Remove lowercase matching from linux.ip.Addr test 2024-02-02 21:03:03 +11:00
Gustavo Moreira 8b6bd0f74e Add linux.ip.Link test using linux-sample-1.bin image 2024-02-02 21:02:05 +11:00
Gustavo Moreira 7b1c75cc87 Linux: Add the linux.ip.Link plugin by @eve-mem 
- On top of the @eve-mem, I've added the queue length field to mimic the ip link command.
- Furthermore, I've included some functions to export the network device flags exactly as they are presented to userland
 2024-02-02 20:57:26 +11:00
Gustavo Moreira 260fbd8d24 Python os.path module precisely does that by checking the current platform and, based on it, utilizes either the posixpath or ntpath modules 2024-02-02 17:03:14 +11:00
Gustavo Moreira 6f1e7c2145 Add test for linux.ip.Addr and linux-sample-1.bin 2024-02-02 16:43:58 +11:00
ikelosandGitHub 18dd23a6b1 Merge pull request #1076 from ckusek15/windows-pstree 
Windows: Add additional command line argument info to windows pstree
 2024-02-01 11:16:24 +00:00
ikelosandGitHub 9b281c478b Merge pull request #1071 from hsarkey/hsarkey/windows-malfind 
Windows: Added '--refined' option to windows malfind plugin
 2024-02-01 09:18:41 +00:00
ikelosandGitHub e436328e88 Merge pull request #1092 from volatilityfoundation/stable 
Stable
 2024-01-31 21:43:57 +00:00
Mike Auty f95be04305 Documentation: Bump the copyright here to 2024 2024-01-31 21:36:21 +00:00
ikelosandGitHub d2f7b416de Merge pull request #1091 from volatilityfoundation/release/v2.5.2 
Documentation: Update copyright in README.md for 2024
v2.5.2 		2024-01-31 21:21:20 +00:00
Mike Auty ba488c78cd Documentation: Bump the copyright here to 2024 2024-01-31 21:13:00 +00:00
Mike Auty 86b0fd431a Core: Apply black 24.1.0 across the whole codebase 2024-01-31 21:09:48 +00:00
Mike Auty 7de7dfdabf Documentation: Update copyright in README.md for 2024 2024-01-31 21:05:00 +00:00
Mike Auty 6d093a4e43 Documentation: Update copyright in README.md for 2024 2024-01-31 21:04:16 +00:00
hsarkey 470c750d82 Updated to use dictionary for refined criteria and BaseAbsentValue for when criteria is not met 2024-01-31 16:00:29 -05:00
ikelosandGitHub 2b15f3fd87 Merge pull request #1069 from dgmcdona/dgmcdona/windows_svcscan 
Windows: SvcScan Binary Info
 2024-01-30 16:49:18 +00:00
Gustavo Moreira 1b153cc567 Manage net_device flag default value & error 2024-01-30 13:13:19 -03:00
Gustavo Moreira c72fa7544d Convert IF_OPER_STATES to enum 2024-01-30 12:55:16 -03:00
Gustavo Moreira 5a8a0def35 Fix docstring typos 2024-01-30 12:53:09 -03:00