Mike Auty
239e164ce6
Windows: Fix strings plugin missing kernel pages
...
@eve-mem spotted that we were only recording the first kernel page in
any contiguous set of kernel pages, thus missing some results. This
should now be fixed.
2023-07-09 23:50:13 +01:00
Gustavo Moreira
241cf832f9
Plugin parameters removed. Instead, it now shows each capability set in their textual representation. The dictionary was replaced by a dataclass.
...
Last but not leas, CAP_FULL moved to constants.
2023-07-10 00:07:40 +02:00
RuBublik
abf1c2e03d
fixed typos
2023-07-07 20:25:02 +03:00
RuBublik
524ff59107
bumped MINOR_VERSION to 2.5.2 after changes, and updated dependent thrdscan plugin's required version to this
2023-07-07 20:22:58 +03:00
Mike Auty
6c0ce1d130
Volshell: Typo Fixes #958
2023-07-01 20:58:36 +01:00
Mike Auty
66598f5b63
Core: Second fix is the charm...
2023-07-01 19:05:22 +01:00
Mike Auty
c8e53ff16a
Core: Fix small typing issue in previous patch
2023-07-01 19:02:51 +01:00
Mike Auty
50b5d2232b
Core: Add type parameter to object_from_symbol
2023-07-01 19:00:03 +01:00
Mike Auty
1ff2d80b44
Documentation: Update basics - memory layer information
2023-07-01 17:02:10 +01:00
Mike Auty
a9698e4e73
Documentation: minor fixes/updates
2023-07-01 17:01:33 +01:00
ikelos and GitHub
5aa0a64cfa
Merge pull request #884 from eve-mem/linux_proc_dump
...
First attempt at adding a --dump option to linux.proc
2023-06-18 15:07:19 +01:00
Eve and GitHub
fa5af08c81
Merge branch 'develop' into linux_proc_dump
2023-06-18 07:34:45 +01:00
ikelos and GitHub
e17cb1532b
Merge pull request #970 from volatilityfoundation/issues/issue969
...
Windows: Fix VAD offset canonicalization
2023-06-16 19:01:21 +01:00
Mike Auty
aa04b8ca3d
Windows: Fix VAD offset canonicalization #969
2023-06-16 18:03:07 +01:00
ikelos and GitHub
2e577790d2
Merge pull request #962 from gcmoreira/fix_dentry_mem_smear_issue_961
...
Fix issue #961 : Prevent potential dentry pointer memory smear
2023-05-30 17:51:05 +01:00
RuBublik
5d32ca542c
fix black formatting
2023-05-28 20:52:26 +03:00
Mike Auty
b9e5cfb393
Core: Protect from clearing a non-existant cache
...
Issue kindly raised by @garanews, thanks! 5:D
2023-05-22 15:05:43 +01:00
RuBublik
5072728e89
formated with black
2023-05-22 15:50:22 +03:00
RuBublik
9bdd249aad
added _version to ThrdScan
2023-05-22 15:39:12 +03:00
RuBublik
c6c501ecb5
implemented generate_timeline method in ThrdScan
2023-05-22 15:31:25 +03:00
RuBublik
bef5149ba6
changed TreeGrid yielded types to specific simpletypes instead of str
2023-05-22 11:39:38 +03:00
RuBublik
950a76d1e0
fixed typo
2023-05-22 11:17:23 +03:00
Gustavo Moreira
0f42f0eaf1
fix typo
2023-05-22 01:39:14 +01:00
Gustavo Moreira
bea981180d
Prevent potential dentry pointer memory smear
2023-05-22 01:32:00 +01:00
RuBublik
5749b3ef52
added test for thrdscan plugin
2023-05-21 19:22:22 +03:00
RuBublik
fab818b48d
added thrdscan plugin to utilize added support for ethread pool tag scanning
2023-05-21 18:24:01 +03:00
RuBublik
046c8e4d1e
fix of is_valid - removed reliace on owning _eprocess and added exclusion for system process (does not have creation time)
2023-05-21 18:18:02 +03:00
RuBublik
601870829e
twicked thread constraint for edge cases
2023-05-21 18:12:46 +03:00
RuBublik
0fd475e10b
added permanent implementation for 'ETHREAD.is_valid'
2023-05-20 15:49:09 +03:00
RuBublik
550d1096eb
temporary fix to ETHREAD class, add 'is_valid' method
2023-05-20 14:20:15 +03:00
Gustavo Moreira
f0bd978716
Fix typo
2023-05-20 12:17:09 +02:00
RuBublik
7469872c8b
added 'PoolConstraint' of Thread objects to 'PoolScanner.default_constraints' as part of adding support for thread pool tag scanning
2023-05-17 21:41:37 +03:00
Gustavo Moreira
4f5ca6116c
Add black recommendations
2023-05-17 16:07:56 +01:00
Gustavo Moreira
d5d318d3cf
Fix wrong constants module
2023-05-17 15:26:24 +01:00
Gustavo Moreira
3d9efc3b34
Added linux capabilities plugin
2023-05-17 14:14:33 +01:00
Eve
cd03c52fd3
Linux: Update linux.vmayarascan to use task.mm.get_vma_iter() which means it will work on linux kernels 6.1 and above
2023-05-12 13:37:15 +01:00
Eve
09b0c8e406
Linux: Update linux.vmayarascan and yarascan so that command line options are taken from the base yarascan plugin
2023-05-12 13:30:32 +01:00
Eve
860c947e17
Merge branch 'vmayarascan' of github.com:eve-mem/volatility3 into vmayarascan
2023-05-12 11:10:02 +01:00
Eve and GitHub
d0d30dc87f
Merge branch 'volatilityfoundation:develop' into vmayarascan
2023-05-12 11:09:51 +01:00
Eve
8624e01644
Merge branch 'vmayarascan' of github.com:eve-mem/volatility3 into vmayarascan
2023-05-12 11:08:41 +01:00
Eve
b54bbfb88f
Update linux.vmayarascan to pull requirements from the generic yarascan plugin
2023-05-12 11:08:32 +01:00
Eve
57e8234e6c
remove unused variable in linux.vmayarascan
2023-05-12 11:08:32 +01:00
Eve
2279a83e3b
liniting for linux.vmayarascan
2023-05-12 11:08:32 +01:00
Eve
1a7ec07c28
add linux.vmayarascan based on windows.vadtarascan
2023-05-12 11:08:32 +01:00
Mike Auty
8e56cb39d1
Docs: Fix the documentation dependencies
2023-05-10 22:07:38 +01:00
Mike Auty
3f1797f7e5
Core: Change readthedocs build platform
...
Fixes #953
2023-05-10 21:57:59 +01:00
Mike Auty
e28b42731e
Core: Change readthedocs python version
...
Attempting to fix #953
2023-05-10 21:55:23 +01:00
ikelos and GitHub
2149231bb7
Merge pull request #949 from cpuu/mac-tutorial
...
Add tutorial for macOS Analysis
2023-05-10 11:11:21 +01:00
ikelos and GitHub
534f9be127
Merge pull request #928 from eve-mem/linux_maple_tree
...
Add basic support for Linux maple tree struct
2023-05-10 11:06:44 +01:00
ikelos and GitHub
e4db77d20a
Merge pull request #942 from gcmoreira/mountinfo_fixes
...
Mountinfo fixes
2023-05-10 11:03:32 +01:00
Mike Auty