Commit Graph
6047 Commits
Author SHA1 Message Date
Andrew Case 63b4c60d3b Cleanup vnode processing and smear protection based on @fgomulka testing 2021-07-27 19:51:55 +00:00
ikelosandGitHub 01a63ff331 Merge pull request #499 from gcmoreira/kmsg-plugin
Linux kernel ring buffer reader plugin
2021-07-26 21:48:18 +01:00
Mike Auty deaa86f625 Windows: Ensure we emit LF_STRUCTURE_VS19 types 2021-07-24 23:01:11 +01:00
Mike Auty 9358700553 Windows: Refactor PDB code and support VS19 new types 2021-07-24 22:39:02 +01:00
Mike Auty 6fdf6e9e9f Windows: Convert pslist as an example 2021-07-22 22:46:39 +01:00
Mike Auty cd2f40bc34 Mac: Update all plugins to ModuleRequirement 2021-07-22 22:42:06 +01:00
Mike Auty 1480aca453 Linux: Update all plugins to ModuleRequirement 2021-07-22 22:40:09 +01:00
Mike Auty abbd516f99 Layers: Add minimum framework requirements 2021-07-22 22:37:58 +01:00
Mike Auty 31dc6f34c9 Automagic: Make symbol_shift automagic change 2021-07-22 22:37:58 +01:00
Mike Auty 213eeda268 Core: Add module collection support 2021-07-22 22:37:58 +01:00
Mike Auty d2420899c5 Layers: Fix minor pointless typo 2021-07-22 22:37:45 +01:00
Mike Auty c993c35152 Core: Further python 3.6 fixes 2021-07-22 22:23:32 +01:00
Mike Auty 66c96644ac Core: Minor flynt and typing fixes 2021-07-22 21:36:37 +01:00
Mike Auty 787f61d5a7 Documentation: Update minimum python version. 2021-07-22 21:30:08 +01:00
Mike Auty 767eea614b Windows: Add extra checks to pdbscan 2021-07-19 12:31:13 +01:00
Mike Auty 59ab92e99d Development: Update development scripts with f-strings 2021-07-18 23:20:27 +01:00
Mike Auty 0d48261201 Core: Change all 3.5 type hints to variable annotations 2021-07-18 16:49:37 +01:00
Mike Auty 9f52a15734 Core: Convert to format strings across the whole base 2021-07-18 15:53:58 +01:00
ikelosandGitHub 99e959a15a Merge pull request #535 from gohar94/patch-2
Windows: Fix up pdb.json for LF_UDT_MOD_SRC_LINE
2021-07-14 16:54:17 +01:00
ikelosandGitHub d4c20648e0 Merge pull request #534 from volatilityfoundation/issues/issue_528_regvaluetypes
issue #528 - change how registry enum members are accessed
2021-07-14 16:52:07 +01:00
ikelosandGitHub df48d3a8d3 Merge pull request #533 from volatilityfoundation/issues/issue_457_registry_mapping_sids
Issues/issue 457 registry mapping sids
2021-07-14 16:51:12 +01:00
ikelosandGitHub f65199845d Merge pull request #523 from gcmoreira/issue-522-private-attr-name-mangled
Fix issue #522: private attribute names mangle
2021-07-14 16:25:01 +01:00
Mike Auty 3ca5461f95 Windows: Ensure suitable progress callback 2021-07-14 15:47:28 +01:00
Gustavo Moreira a795a7e2d5 Using double underscore in the find() will also include edge cases like when the calling class contains an underscore i.e. THE_CLASS 2021-07-14 20:45:43 +10:00
Gohar Irfan ChaudhryandGitHub e0f08cdead Windows: Fix up pdb.json for LF_UDT_MOD_SRC_LINE
The module field in `LF_UDT_MOD_SRC_LINE` should be `unsigned short` instead of `string` as per:
```
typedef struct lfUdtModSrcLine {
    unsigned short leaf;        // LF_UDT_MOD_SRC_LINE
    CV_typ_t       type;        // UDT's type index
    CV_ItemId      src;         // index into string table where source file name is saved
    unsigned long  line;        // line number
    unsigned short imod;        // module that contributes this UDT definition 
} lfUdtModSrcLine;
```
([source](https://github.com/microsoft/microsoft-pdb/blob/082c5290e5aff028ae84e43affa8be717aa7af73/include/cvinfo.h#L1707))

This also changes the size of the struct from 16 to 14.
2021-07-13 10:00:32 -07:00
superponible d613b384d2 #457 - raise log level and use f-strings 2021-07-12 21:55:30 -05:00
superponible 446510ab5f issue 528 - change how registry enum members are accessed 2021-07-12 11:40:30 -05:00
superponible a7cc978ac6 #457 - filter hives for getsids and getservicesids 2021-07-12 11:24:14 -05:00
superponible 8c7b6b29d1 #457 - include hive name in debug message 2021-07-12 11:24:14 -05:00
superponible 88a8cde9ac #457 - add debugging for registry mapping 2021-07-12 11:24:14 -05:00
Mike Auty 7f6378fd5d Automagic: Changing stacking order for linux/mac
The linux/mac stackers are more accurate (based on banners) than the
windows stacker (based on offsets).  As such in cases where both would
match, we should go for the more accurate match first (linux/mac) over
windows.  In most cases this will make no difference because of the
exclusion lists, so only one stacker will run, but in cases such as
volshell where all stackers are run, this may help with certain edge
cases.
2021-07-12 12:27:53 +01:00
Mike Auty e28910f670 Windows: Ensure we set the kernel_virtual_offset before other reqs
It appears in issue #524 that the step to fulfil symbol requirements
can throw an exception (which then prevents the kernel_virtual_offset
(which is optional) from being set appropriately.

This sets the kvo first and adds a check to where it's set.  It doesn't
get to the root of why an exception is thrown, but should ensure it's
easier to spot if it goes wrong.

Fixes #524.
2021-07-12 12:09:07 +01:00
Mike Auty c2b290dc42 Windows: Fix up pdb.json for LF_UDT_SRC_LINE
It looks like some copypasta snuck in the manual pdb.json.
The offsets for the LF_UDT_SRC_LINE as was the total structure size for
LF_UDT_MOD_SRC_LINE.

Fixes #527
2021-07-12 10:48:43 +01:00
Mike Auty 42ef21fd29 Documentation: Clarify linux ISF generation 2021-07-11 22:37:41 +01:00
ikelosandGitHub 4d9b2517c6 Merge pull request #498 from volatilityfoundation/windows_crashdump_fixes_jxwenger
complete windows crash dump support
2021-07-11 00:07:27 +01:00
iMHLv2 f1079e7e9b fix up required framework version for crashinfo 2021-07-10 08:32:40 -05:00
Gustavo Moreira e441742a83 Moving the if down after the concrete members are checked. 2021-07-01 08:21:18 +10:00
Gustavo Moreira ec04dc9caa Fix issue #522: private attribute names mangle
As per https://docs.python.org/3/tutorial/classes.html#private-variables
Python will mangle private attribute names from `__attrname` to `_classname__attrname` to avoid name clashes of names with names defined by subclasses.
This will happen even if subclasses are not involved i.e.: calling `type_member.__foo` from a plugin classmethod.
Note that `__foo` is not meant to be a Python private attribute, but the actual name of the type member.
Like sock.__sk_common here: https://github.com/torvalds/linux/blob/62fb9874f5da54fdb243003b386128037319b219/include/net/sock.h#L354

We need to strip the '_classname' prefix from the attribute's name before continuing with the member attribute lookup.
2021-06-30 13:25:07 +10:00
Gustavo Moreira 3d5df75377 Replacing 'while True' for 'while (condition)' 2021-06-29 16:03:45 +10:00
Gustavo Moreira 4ab0528a27 symtab_checks needs to be abstract. Added a doc string. 2021-06-29 15:19:37 +10:00
ikelosandGitHub af090bf29e Merge pull request #519 from fgomulka/tty-check-pointer-issue
Create a list_head to fix tty_check bug
2021-06-23 20:22:27 +01:00
Frank Gomulka dbae5d353d Create a list_head to fix tty_check bug
This commit casts `tty_driver` to a `list_head` to fix an
AttributeError in the linux tty_check plugin
2021-06-22 10:43:31 -04:00
Mike Auty b6165b439f Mac: Fix minor typo in previous fix 2021-06-07 01:44:21 +01:00
Mike Auty 772083ac75 Mac: Fix unguarded read in automagic #515 2021-06-06 11:50:23 +01:00
Mike Auty ed1320491c Poolscan: Further python 3.6 efficiencies 2021-06-04 22:19:12 +01:00
ikelosandGitHub 7aff6f6d8b Merge pull request #513 from bonafont/develop
Fixed CM_KEY_VALUE get_decode method
2021-06-04 22:16:16 +01:00
Anthony Fey a11c94a82b Fixed CM_KEY_VALUE get_decode method 2021-06-04 18:52:00 +02:00
ikelosandGitHub c3107986fc Merge pull request #401 from volatilityfoundation/issues/issue400
Objects: Avoid reconstructing pointed objects
2021-06-02 20:30:42 +01:00
iMHLv2 7d9c66c407 run yapf on the newly added files 2021-06-01 14:27:20 -05:00
iMHLv2 7b73f8d545 fix the copyright date for extensions/crash.py 2021-06-01 14:21:11 -05:00