WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 02:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
6,047 Commits 80 Branches 17 Tags
bugfix/missing_modules
Commit Graph
6047 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
David McDonald 43e8e01daf Removes unnecessary pass and deindents return stmt 2024-01-30 09:26:17 -06:00
David McDonald 4192e8a711 Fix condition in OsDistinguisher 2024-01-29 00:38:06 -06:00
David McDonald 42c2a86a37 Add logging for when a Services key cannot be retrieved 2024-01-29 00:38:06 -06:00
David McDonald c517a44cde Add type hints/casts to _get_service_key method 2024-01-29 00:38:06 -06:00
David McDonald f5c1bf0f1f Remove argument that matches default 2024-01-29 00:38:06 -06:00
David McDonald 5541378afe Create unique config path 2024-01-29 00:38:06 -06:00
David McDonald 4b400b6df6 Refactor out code duplication in OS version checks 2024-01-29 00:38:06 -06:00
David McDonald 86d6b4f724 Bump plugin version 2024-01-29 00:38:06 -06:00
David McDonald 77b0110635 Windows: Fixes svc symbols and OS version detection 
There were some changes made to the service structures between certain
versions of Windows that caused the PID/binary path to fail to parse
across quite a few samples. This adds the appropriate version detection
logic and updated symbol files to ensure that services are parsed
correctly across Windows versions.
 2024-01-29 00:38:06 -06:00
David McDonald 837d3b7b9f Windows: Add parsing of service binary/dll 
Parses the binary or dll associated with each service from the Windows
SYSTEM hive and includes it in the output for each service.
 2024-01-29 00:38:06 -06:00
Mike Auty 497d291ef4 Windows: Fix black on dumpfiles 2024-01-29 00:07:40 +00:00
ikelosandGitHub b211dc17b0 Merge pull request #1083 from brandon-barnacle/bbarnacle/windows-dumpfiles 
Windows: Add regex filtering to dumpfiles
 2024-01-28 23:58:16 +00:00
Mike Auty 4dc6f637b0 Core: Apply black 24.1.0 to the whole codebase 2024-01-28 23:50:45 +00:00
gcmoreiraandGitHub cd867bf5d2 Merge branch 'volatilityfoundation:develop' into linux_ifconfig_plugin 2024-01-27 20:32:33 -03:00
Gustavo Moreira 620b9b4183 Fix: Explicit returns mixed with implicit (fall through) returns 2024-01-27 17:52:26 -03:00
Gustavo Moreira 97007e8b86 Minor fixes 2024-01-27 17:48:09 -03:00
Gustavo Moreira 6e0ffc9d62 Plugin renamed. Added net iface status and other improvements from @eve #1029 
* IP address conversion via renderers.coversion.*
* Use MAC address internal size instead of hardcoded.
* Read NET_DEVICE_FLAGS from enumeration
 2024-01-27 17:39:34 -03:00
Brandon Barnacle ae5375a622 PR comment changes 
Change the --regex flag to --filter. Add a check so that --filter
cannot be used with --physaddr or --virtaddr. Change
self.config["filter"] check to check if file_re has been set.
 2024-01-26 11:21:16 -05:00
Calvin Kusek a50ebb6014 Windows: Display additional process info for windows.pstree 2024-01-18 22:25:54 -05:00
hsarkey ef36cb5a6c Updated windows.malfind to have a "Notes" column to indicate if a process meets 
"refined" criteria, which includes common headers like MZ,PE or function
prologues. Fixed black formatting issue.
 2024-01-17 17:51:27 -05:00
hsarkey e6e138f12d Updated windows.malfind to have a "Notes" column which will indicate if a process 
meets a "refined criteria", meaning it has a common header type (MZ, PE, or a
function prologue).
 2024-01-17 17:24:26 -05:00
hsarkey 4e89040dad Updated changes to the windows.malfind plugin. Eliminated --refined as a command line option and instead 
added an additional column called "Notes" to provide info on common headers.
 2024-01-17 16:52:16 -05:00
Mike Auty 4b86b9ea89 Plugins: Remove unnecessary variable from windows.mftscan 2024-01-17 20:40:27 +00:00
Mike Auty 01ffcd9634 Core: Fixing None equality test in MapleTree implementation 2024-01-17 20:37:26 +00:00
Mike Auty 614d4d6f2b Layers: Fix cloudstorage unnecessary import 2024-01-17 20:35:54 +00:00
Mike Auty 269058021d Plugins: Fix up kmsg code issues 2024-01-17 20:34:39 +00:00
Mike Auty 7c8f4ca4ac Schemas: As of 6.3.0 we require a producer metadata, not just format 2024-01-14 23:05:12 +00:00
Mike Auty 62366d4f6f Symbols: Add support for metadata verification of symbol tables 2024-01-14 23:05:10 +00:00
bbarnacle 52dcfb45f4 Windows: Add regex filtering to dumpfiles 
In volatility2, the windows.dumpfiles plugin allows you to filter the dumped files
using a regular expression. This PR adds the same functionality to volatility3.

The regular expression is passed in using --regex=REGEX and all files matching
REGEX will be dumped. The --ignore-case flag can be passed to make the search
case-insensitive. The search is case-sensitive by default. The matching
volatility2 functionality can be found here:
https://github.com/volatilityfoundation/volatility/blob/a438e768194a9e05eb4d9ee
9338b881c0fa25937/volatility/plugins/dumpfiles.py#L844

Manual testing was performed on windows memory images across different windows
versions to verify the expected output.
 2024-01-11 13:24:05 -05:00
Gustavo Moreira da6c2d863d Fix netdev egress hooks 2024-01-10 16:43:36 -03:00
Gustavo Moreira 5b5012d08a Fix. Use the global lists. DEC hooks were wrong 2024-01-10 16:42:34 -03:00
Gustavo Moreira 5ad7dd3bbc Update netdev class names as it now supports both netdev hooks; ingress and egress 2024-01-10 16:06:55 -03:00
Gustavo Moreira abc448009e Linux: Add netfilter hooks enumeration plugin. 2024-01-10 15:56:00 -03:00
RuBublik b395815eb0 Merge branch 'poolscanner-thread-support' of https://github.com/RuBublik/volatility3 into poolscanner-thread-support 2024-01-09 21:32:46 +02:00
RuBublik b0d84e55ab fix indentation (typo) 2024-01-09 21:32:29 +02:00
Gustavo Moreira 6b3bbad537 Fix exception. Although it will be auto-instantiated it's better to explicitily use the exception instance 2024-01-09 16:13:33 -03:00
Gustavo Moreira 82668af609 Linux - Added linux.ifconfig.Ifconfig plugin 2024-01-09 16:12:56 -03:00
RuBublikandGitHub de409d7249 Merge branch 'develop' into poolscanner-thread-support 2024-01-09 00:37:13 +02:00
RuBublik 7c37012118 bumped version constants to mark change of interface (add of support for ETHREAD) 2024-01-09 00:16:18 +02:00
RuBublik 550112b848 added another sanity check to ETHREAD.is_valid 2024-01-08 23:37:38 +02:00
RuBublik 25637a41e0 added account for XP timestamps - bit shifted 2024-01-08 23:35:21 +02:00
ikelosandGitHub 66a4fc92bb Merge pull request #1075 from gcmoreira/linux_kmsg_older_kernels_support 
Linux: Add support for kernels earlier than version 3.11 in `linux.kmsg.Kmsg` plugin
 2024-01-02 19:08:03 +00:00
Gustavo Moreira 66b408d6e8 Fix minor docstring typos 2024-01-02 11:37:10 -03:00
Gustavo Moreira 8e58815c11 Bump plugin's patch version 2024-01-02 11:25:35 -03:00
Gustavo Moreira 02a389a61b Improve docstrings 2024-01-02 11:17:18 -03:00
Gustavo Moreira e4c44698f8 Reduce imports 2024-01-02 11:14:43 -03:00
Gustavo Moreira 0d934d4991 Fix error and comment 2023-12-26 16:13:47 -03:00
Gustavo Moreira 3848fc69a6 Add support for kernels earlier than version 3.11. 
* Add support for older ring buffer kernel implementation:
  - 3.5 < kernels
  - 3.5 <= kernels < 3.11
 * Enabled support for wrapped-around ring buffers in all four kernel implementations.
 * Bugfix: wrapped around buffer issue with 3.11 <= kernel < 5.10.
 2023-12-25 21:32:14 -03:00
hsarkey 409ce95980 Windows: Added '--refined' option to windows malfind plugin 
Also updated malfind to include "\x55\x48" and "\x55\x89" as part of the refined_criteria list.
 2023-12-21 15:49:00 -06:00
Valentin Obst 84401847ff add sanity check in Linux find_aslr to skip unrelocated init_task 2023-12-20 21:50:22 +01:00