WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 10:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
6,047 Commits 80 Branches 17 Tags
bugfix/missing_modules
Commit Graph
6047 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mike Auty aac4c73528 Actions: Bump black checkout to Node16/wqv3 2023-02-03 09:22:30 +00:00
Mike Auty 43a17384c3 Core: Update to black 23.1.0 which removes many blank lines and parentheses 2023-02-03 00:35:49 +00:00
ikelosandGitHub 2a459266ba Merge pull request #905 from volatilityfoundation/feature/canonical-helper 
Add in the canonical helper functions for translating between volatility address ranges and intel canonical addresses
 2023-02-03 00:29:07 +00:00
Eve 3b1e4ce0e2 Update linux.vmayarascan to pull requirements from the generic yarascan plugin 2023-02-01 11:27:44 +00:00
Eve b375c6f71d Update linux.iomem 2023-02-01 09:43:02 +00:00
Mike Auty 3297ba02e7 Core: Rather than scheduling it daily, only do it on commits 2023-01-29 12:46:06 +00:00
Mike Auty c2a1afb0ba Core: Update codeql action to only run once a week 2023-01-29 12:42:17 +00:00
Eve 1d4aa72c85 update linux.iomem with basic smear protection 2023-01-27 11:07:05 +00:00
Paul Kermann 728e8b608a black reformat 2023-01-17 16:11:08 +02:00
Paul Kermann e16887414e add escapechar 2023-01-17 10:15:03 +02:00
ikelosandGitHub 91ec909b3c Merge pull request #903 from paulkermann/fix/missing-import 
Fix missing import
 2023-01-16 11:08:05 +00:00
Paul Kermann f036acdeb8 missing import 2023-01-16 13:02:20 +02:00
Mike Auty 4cafc982f4 Windows: Fix up callbacks typos and typing info 2023-01-16 10:47:09 +00:00
ikelosandGitHub 9f607d6903 Merge pull request #902 from paulkermann/bugfix/cmregisterscallbacks_smearing 
Handle smearing in volatility callbacks plugin
 2023-01-16 10:42:40 +00:00
Paul Kermann 5e33a98481 change default value to None 2023-01-16 12:39:08 +02:00
ikelosandGitHub 648fa78c95 Merge pull request #900 from paulkermann/improv/extra_logging_symbol_table_from_offset 
Add debug message for symbol_table_from_offset
 2023-01-16 10:18:19 +00:00
Paul Kermann 5aca49388e fix smearing 2023-01-16 12:01:45 +02:00
Paul Kermann bd291c43d5 added debug message 2023-01-16 10:15:36 +02:00
cstation 558b31cbdc Dump ELFs to file 2023-01-13 12:27:31 +01:00
Mike Auty 1641a6e4c4 Windows: Fix up black issue with vadinfo 2023-01-12 19:58:51 +00:00
ikelosandGitHub 3cf47b9260 Merge pull request #835 from paulkermann/improv/vadinfo_containing_address 
Added new containing address flag to vadinfo plugin
 2023-01-12 19:05:20 +00:00
ikelosandGitHub adbc33ceed Merge branch 'develop' into improv/vadinfo_containing_address 2023-01-12 19:05:11 +00:00
Mike Auty d963aa3afb Layers: Fix trying to be too clever with Xen 2023-01-10 16:39:43 +00:00
Mike Auty a60b91b6e1 Layers: Add in Xen CoreDump format support 2023-01-09 21:33:07 +00:00
Mike Auty a1eeecf6de Layers: Fix uncaught exception in Elf layer 2023-01-09 21:32:19 +00:00
Eve 560569e03e update linux.proc --dump so that vma object is not passed to dump func 2023-01-06 22:12:20 +00:00
Mike Auty cd89e39ee0 Layers: Fix QEMU layer cutting off the last byte of the config 2023-01-06 22:10:50 +00:00
Mike Auty af3b70320e linux: Apply black linting to outstanding files 2023-01-06 10:18:17 +00:00
ikelosandGitHub a9928d66f1 Merge pull request #597 from gcmoreira/linux_sockstats_plugin 
Linux sockstats plugin

Merging without black linting, but will add that as soon as it's landed.  This was waiting on review but the decision to move forward was made on Wednesday.
 2023-01-06 10:16:14 +00:00
ikelosandGitHub a19c2b8d14 Merge branch 'develop' into linux_sockstats_plugin 2023-01-06 09:35:37 +00:00
Eve 0163f0b9e6 add linux.iomem plugin based on vol2 plugin by atcuno 2023-01-05 13:43:47 +00:00
Mike Auty c1e425217b Initial canonical helper addition 
The intel 64-bit 4-page paging mechanism allows for 48-bit virtual
addresses.  They introduced a convention that the higher bits must
be set a particular way to avoid operating system developers abusing
those bits and creating problems that would be difficult to resolve in
the future.

Volatility requires that addresses for mapping or translation fit within
the available bounds of the virtual address space.  This unfortunately
means that addresses that have the protections against abuse in place
can may live outside this range.

This provides two function (canonicalize and decanonicalize) which will
either set the appropriate sign extension or remove it.  The
decanonicalize function will return an adress outside of the address
range if the original value was not canonical.
 2023-01-05 10:55:30 +00:00
Eve 4c0a0b923b Update linux.proc --dump changes based on comments from ikelos 2023-01-04 16:05:00 +00:00
Eve 6f82e3d8cf remove unused variable in linux.vmayarascan 2023-01-04 09:36:20 +00:00
Eve f82a3f520f liniting for linux.vmayarascan 2023-01-04 09:32:39 +00:00
EveandGitHub eb061175d1 Merge branch 'volatilityfoundation:develop' into linux_proc_dump 2022-12-21 07:03:22 +00:00
Eve a553a69efd fix linting issues 2022-12-21 06:42:02 +00:00
ikelosandGitHub a6fb0f2ebc Merge pull request #888 from volatilityfoundation/stable 
Stable
 2022-12-14 20:40:36 +00:00
ikelosandGitHub d67ad9f8da Merge branch 'develop' into stable 2022-12-14 20:18:45 +00:00
ikelosandGitHub 2b46e97e52 Merge pull request #887 from volatilityfoundation/release/v2.4.0 
Prepare for the 2.4.0 release, the major version has jumped a few numbers for compatibility, but this is the next release including the following:

    New plugins
        linux.mountinfo
        linux.psaux
        windows.devicetree
        windows.joblinks
        windows.ldrmodules
        windows.mbrscan
        windows.mftscan
        windows.sessions
    Introduced the concept of modules and module requirements
    Unified symbol handling and ISF file caching between OS versions
    Better QEVM support (fixed the QEMU PCI hole)
    Exposed an API for automatic PDB symbol table use
    Improved contributed documentation
    Various bug fixes and changes across the codebase
v2.4.0 		2022-12-14 19:39:11 +00:00
Mike Auty 92ece08c5f Core: Fix up file close issue 2022-12-14 18:51:09 +00:00
Eve a68d56e191 add linux.vmayarascan based on windows.vadtarascan 2022-12-13 16:09:57 +00:00
Eve 53b24d33e0 First attempt at adding a --dump option to linux.proc, aim to be similar to windows.vadinfo --dump 2022-12-13 09:59:09 +00:00
Eve 92c7b3e550 add linux envars 2022-12-09 15:37:20 +00:00
ikelosandGitHub 057d314aa0 Merge pull request #879 from digitalisx/fix/runs-on-version 
Fix: workflow `runs-on` version to `ubuntu-20.04`.
 2022-12-08 16:20:07 +00:00
Donghyun Kim 632fe0b671 Fix: ubuntu version to 20.04 2022-12-09 01:00:16 +09:00
Donghyun Kim 5f4e2716db Fix: ubuntu-latest version 2022-12-08 16:26:54 +09:00
Donghyun KimandGitHub 06d70eb9b2 Merge branch 'volatilityfoundation:develop' into develop 2022-12-08 13:44:23 +09:00
Mike Auty e67bac4080 Testing: Fix unclosed file open 2022-12-07 21:25:22 +00:00
Mike Auty 4cf0a185e3 Core: Bump minimum python 3 version for pypi build 2022-12-07 21:12:49 +00:00