WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 18:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
6,047 Commits 80 Branches 17 Tags
bugfix/missing_modules
Commit Graph
6047 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
ikelosandGitHub 7626f60bb4 Merge pull request #526 from volatilityfoundation/feature/linux-mac-repo 
Feature/linux mac repo
 2021-08-30 12:42:59 +01:00
Mike Auty e6547a2d5e Revert "CLI: Verify improvement for buildbot" 
This fix for buildbot didn't seem to have any effect

This reverts commit 57e1243932.
 2021-08-28 00:34:11 +01:00
Mike Auty 57e1243932 CLI: Verify improvement for buildbot 2021-08-27 22:23:33 +01:00
ikelosandGitHub 35713bb6d8 Merge pull request #554 from volatilityfoundation/feature/linux-mac-windows-unify-config 
Feature/linux mac windows unify config
 2021-08-27 22:20:43 +01:00
Mike Auty f082c1c8cc Objects: Fix up pointer caching to default to native layer 2021-08-26 17:25:03 +01:00
Mike Auty b1156fa0a1 Automagic: Remove the superfluous num_entries fields 2021-08-26 16:18:27 +01:00
Mike Auty 1e1b3fda36 Windows: Fix up typo in num_entries parameter 2021-08-26 14:05:53 +01:00
Mike Auty 2371c1158d Windows: Ensure DTBs don't have all valid entries 
We were finding that PAE results were being masked by certain pages with
64bit results.  The DTBs could be distinguished from good DTBs because
every entry was valid (which for a 64-bit or even 32-bit DTB is
extremely unlikely except on systems with *vast* quanties of memory.

As such, this now tests for all entries being allocated and doesn't return the
DTB if this is the case.
 2021-08-26 11:50:04 +01:00
Mike Auty aa1c24e60a Core: Make pointer caching more accurate 2021-08-26 11:43:32 +01:00
ikelosandGitHub 2dda3b4946 Merge pull request #549 from volatilityfoundation/feature/intel-coalesce-by-default 
Layers: Coalesce intel mapping responses
 2021-08-25 16:46:43 +01:00
Mike Auty ece34139db Mac: Standadize on kernel config name 2021-08-25 16:10:55 +01:00
Mike Auty ad3560e1bc Linux: Shift linux plugins to using kernel as their default module 2021-08-25 15:48:53 +01:00
Mike Auty b90fd6bbb2 Automagic: Only traverse down intel layers 2021-08-24 21:59:18 +01:00
Mike Auty 27c5dfdffd Plugins: Add in architectures for ModuleRequirement 
Fixes #553
 2021-08-24 21:47:47 +01:00
ikelosandGitHub 7bf3ac4a41 Merge pull request #551 from volatilityfoundation/feature/windows-kernel-module 
Windows: Update to kernel ModuleRequirement for ease of config
 2021-08-22 12:28:47 +01:00
Mike Auty 97da37d968 Windows: Update to kernel module for ease of config 2021-08-20 00:53:03 +01:00
Mike Auty ab075ac667 Windows: Fix pstree physical/virtual offsets 2021-08-20 00:52:43 +01:00
Mike Auty 0aa59111df Generic: YaraScanner fail on no rules 2021-08-19 23:06:55 +01:00
Mike Auty 260f879334 Core: Fix caching of pointer objects 2021-08-19 15:32:48 +01:00
Mike Auty 98db5e46d4 Windows: Remove hardcoded parameter in poolscanner 2021-08-19 11:12:05 +01:00
Mike Auty db2ec8cfb2 Core: Ensure module configuration is recordable 2021-08-16 16:59:11 +01:00
x ef27d07183 Add missing patch that fixes KERB_ECRYPT structure size 2021-08-13 15:06:48 +00:00
x 70750d2b92 Remove unused variable from plugin 2021-08-12 22:52:08 +00:00
ikelosandGitHub 5f276df35c Merge pull request #484 from volatilityfoundation/skeleton_key_check_plugin 
Skeleton key check plugin
 2021-08-12 23:39:39 +01:00
x d86b9b34e4 Fix return types, change confusing use of continue, switch to get_absolute_symbol_address 2021-08-12 15:47:16 +00:00
Mike Auty 19b2a06964 Layers: Coalesce intel mapping responses 2021-08-11 22:02:08 +01:00
Mike Auty 3ad20d566c Automagic: Minor fixes for jar files and layers 2021-08-11 21:51:41 +01:00
Mike Auty e7623baf45 Linux: Support None to turn off remote banner locations 2021-08-11 21:24:39 +01:00
Mike Auty bb40a8a207 Automagic: Catch remote download exceptions 2021-08-11 21:22:03 +01:00
Mike Auty 3b2aae40d2 Automagic: Support remote banner versioning and chaining 2021-08-11 21:22:03 +01:00
Mike Auty 79b3be4cf6 Automagic: Add in remote banner cache first attempt 2021-08-11 21:22:03 +01:00
Mike Auty 4016b096c2 Core: Add in offline constant 2021-08-11 21:22:00 +01:00
ikelosandGitHub 595f377f19 Merge pull request #538 from volatilityfoundation/feature/better-modules-support2 
Feature/better modules support
 2021-08-11 21:09:24 +01:00
Mike Auty 86771d15d5 Core: Don't get to hasty with the API version 2021-08-11 21:08:33 +01:00
Mike Auty 2cfb65380a Core: Include API changes file 2021-08-11 21:06:43 +01:00
Mike Auty 8745931dea Windows: Add coalesce support to memmap 2021-08-05 17:28:36 +01:00
Mike Auty 1611a72eb9 Windows: Fix memmap not to create empty files 2021-08-05 16:21:48 +01:00
Mike Auty 058de2d9a8 Windows: Mute crypto warnings from lgtm 2021-08-04 22:25:13 +01:00
ikelosandGitHub ee70c1c6ab Merge pull request #540 from volatilityfoundation/feature/pdbconv-vs19 
Feature/pdbconv vs19
 2021-08-02 11:02:12 +01:00
Mike Auty 0343c8f81e Windows: Pdbsan typing and doc fixes 2021-07-30 21:20:33 +01:00
Mike Auty 30eec0cb76 Windows: Ensure the kernel contains an actual kvo 2021-07-30 00:17:26 +01:00
Mike Auty e793956e02 Windows: Update netscan offsets for win10-17763-x64 (#478) 2021-07-29 00:17:22 +01:00
Mike Auty fda1512273 Windows: Fix pdbconv handling of unknown types 2021-07-29 00:05:36 +01:00
Frank Gomulka 7311f24149 Comment and Pydoc changes 2021-07-28 08:38:53 -04:00
Frank Gomulka 6f4ff5f2df Add patch for driverscan for windows 7 and earlier 
This patches an issue for some versions of windows that require the
bottom-up approach for finding the size of "object body" by
recognizing additional structures occupying the "object body"
position. The sizes of these additional structures are added to
the size of `_DRIVER_OBJECT` to more accurately compute the actual
size of "object body".
 2021-07-28 08:38:53 -04:00
Andrew Case f6c1e0eafc Fix several code paths that could infinite loop and were triggered based on @fgomulka testing 2021-07-27 21:31:07 +00:00
ikelosandGitHub d1173b07ee Merge pull request #545 from volatilityfoundation/skip_invalid_socket_references 
Skip invalid sockets in netstat enumeration, based on @fgomulka testing
 2021-07-27 22:23:47 +01:00
ikelosandGitHub 0c925a49a8 Merge pull request #544 from volatilityfoundation/improve_mac_vnode_handling 
Cleanup vnode processing and smear protection based on @fgomulka testing
 2021-07-27 22:23:07 +01:00
Andrew Case c9232ab7b5 Skip invalid sockets in netstat enumeration, based on @fgomulka testing 2021-07-27 20:04:24 +00:00
Andrew Case c1bf63db83 Adding missing change for pointer_to_string exception catching 2021-07-27 19:59:28 +00:00