Andrew Case
f85c3a2d97
Fix versioning again
2025-03-08 00:31:57 +00:00
Andrew Case
9e7ac650de
Fix versioning again
2025-03-08 00:30:53 +00:00
Andrew Case
bcf038bfd5
Fix versioning again
2025-03-08 00:30:06 +00:00
7342f1e27e
Apply suggestions from code review
...
convert from static back to classmethod
Co-authored-by: ikelos <ikelos@users.noreply.github.com >
2025-03-07 18:25:35 -06:00
Andrew Case
9fe4092e9f
Update the list_threads API to current standards and update current callers to new form
2025-03-08 00:34:40 +00:00
ikelos and GitHub
237ff925e2
Merge pull request #1684 from volatilityfoundation/fix_truecrypt_backtraces
...
Prevent truecrypt from throwing a backtrace when the module isn't fou…
2025-03-08 00:23:10 +00:00
Andrew Case
24a53b4f68
Prevent truecrypt from throwing a backtrace when the module isn't found and print a warning
2025-03-08 00:22:07 +00:00
Andrew Case
74df8dc1ee
Fix version changes
2025-03-07 23:36:45 +00:00
Andrew Case
4f94615644
Bring hash dumping plugins up to current coding standards and error checking patterns. Fix bugs and typing
2025-03-07 22:42:58 +00:00
ikelos and GitHub
0b6203cf7a
Merge pull request #1678 from volatilityfoundation/fix_unloaded_modules
...
Fix unloaded modules bugs. Change API to fit current formats
2025-03-07 21:50:18 +00:00
ikelos and GitHub
0e236fda10
Merge pull request #1680 from volatilityfoundation/fix_timers_kpcr
...
Fix timers and kpcrs bugs, missing smear checks, and API. Closes #1642
2025-03-07 21:47:40 +00:00
ikelos and GitHub
21bcdf9f50
Merge pull request #1652 from volatilityfoundation/fix_pstree_infinite_loop
...
Add complete smear protection to linux.pstree
2025-03-07 21:32:32 +00:00
ikelos and GitHub
0a4e1827da
Merge pull request #1661 from Abyss-W4tcher/bulk_out_windows_testing
...
Testing: enhance general design
2025-03-07 21:31:18 +00:00
ikelos and GitHub
551f09c30e
Merge pull request #1677 from volatilityfoundation/add_tmpfs_only_extraction
...
Add --tmpfs-only flag to RecoverFs to replace tmpfs plugin of Volatil…
2025-03-07 21:22:42 +00:00
ikelos and GitHub
8db9d7e925
Merge pull request #1676 from volatilityfoundation/fix_getsids
...
Fix how the task name is reported in getsids error path
2025-03-07 21:21:12 +00:00
Andrew Case
9e01666319
Fix timers and kpcrs bugs, missing smear checks, and API. Closes #1642
2025-03-07 18:24:53 +00:00
Andrew Case
1daf62ab4e
Add debug statement when a process is skipped
2025-03-07 17:18:45 +00:00
Andrew Case
e8db2f03bb
Add complete smear protection to linux.pstree
2025-03-07 17:14:28 +00:00
Abyss Watcher
f0235279a9
Bump: 1.0.0->1.0.1
2025-03-07 16:44:07 +01:00
Abyss Watcher
460f1307ac
improve secret readability
2025-03-07 16:43:44 +01:00
Andrew Case
45fe8f69dd
Fix unloaded modules bugs. Change API to fit current formats
2025-03-07 05:05:23 +00:00
Andrew Case
f6aa6d87e8
Add --tmpfs-only flag to RecoverFs to replace tmpfs plugin of Volatility 2
2025-03-07 04:19:28 +00:00
Andrew Case
bb3b0ada5c
Fix how the task name is reported in getsids error path
2025-03-07 03:42:32 +00:00
Andrew Case
aac0566c90
Change the type information reported for missing attributes
2025-03-07 03:17:52 +00:00
ikelos and GitHub
043c64cf53
Merge pull request #1672 from volatilityfoundation/refactor/symbol_server_url_constant
...
Pdbconv: Make symbol server URL constant
2025-03-07 00:58:16 +00:00
David McDonald
134a3bc686
Pdbconv: Make symbol server URL constant
...
This removes the hard-coded symbol server URL from
`PdbRetreiver.retrieve_pdb` and defines it as a constant within the
`constants` module.
2025-03-06 15:20:38 -06:00
ikelos and GitHub
9b0ca1977b
Merge pull request #1671 from volatilityfoundation/fix_tracing_plugins
...
Fix several bugs found in the tracing plugins during mass testing
2025-03-06 18:11:17 +00:00
Andrew Case
14778cdf5c
Address feedback
2025-03-06 18:10:38 +00:00
Andrew Case
557b200f07
Fix several bugs found in the tracing plugins during mass testing
2025-03-06 17:36:24 +00:00
ikelos and GitHub
e935254e8b
Merge pull request #1640 from volatilityfoundation/plugin/windows_gui
...
Add APIs and initial plugins for GUI support and fit Windows major APIs to current design flow
2025-03-06 00:46:02 +00:00
David McDonald
7e00f2c4c4
Windows Versions: Fix broken OSDistinguisher
...
Something happened when picking _EPROCESS members before that caused
this to not function properly. This one relies on a more stable type
removal instead of _EPROCESS members.
2025-03-05 17:59:49 -06:00
David McDonald
dc53afb217
Code Review: Don't use to-be-deprecated static natives
...
This was originally done to solve a problem where `f32` wasn't available
in the native types from every kernel version. However, it ended up not
being necessary - we can just omit `native_types` from the method call,
and it will construct the types as-needed using the definition for
`float` in `base_types` from the JSON files.
2025-03-05 17:59:49 -06:00
David McDonald
e8ec7b1bf7
Code Review: Remove unneeded kernel module reconstruction
2025-03-05 17:59:49 -06:00
David McDonald
77d6bf25b0
Code Review: Remove redundant kernel module reconstruction
2025-03-05 17:59:49 -06:00
David McDonald
76cceb93cb
Code Review: Get rid of 'kvo' in favor of kernel.offset
2025-03-05 17:59:49 -06:00
David McDonald
a192546eb0
Framework: Minor version bump
...
There are a lot of things going into this so we're doing a minor
framework version bump.
2025-03-05 17:59:49 -06:00
David McDonald
456d7b7db5
CodeQL Fix: Unused variable
...
Also underscores an unused unpacked tuple value
2025-03-05 17:59:49 -06:00
David McDonald
7964ca07e4
Code Review: PluginRequirement -> VersionRequirement
...
Code Review: PluginRequirement -> Version Requirement
2025-03-05 17:59:49 -06:00
David McDonald
5c6107bf33
Code Review (style): Use keyword args for clarity
...
This updates a whole host of method calls to pass keyword arguments
instead of positional arguments.
2025-03-05 17:59:49 -06:00
David McDonald
2b9f61abea
Code Review: Parameter renaming
...
Makes it explicit that these are symbol table names, not actual symbol
tables.
2025-03-05 17:59:38 -06:00
David McDonald
c2c93ad90e
Code Review: Simplify dictionary construction
...
Also adds some keywords in method call args, and fixes an incorrect
type-hint.
2025-03-05 17:59:38 -06:00
David McDonald
f139dde121
Code Review: Fix pslist param
...
Change to self.current_kernel_name so people can change this value.
2025-03-05 17:59:38 -06:00
David McDonald
cad15d0c92
Windows DeskScan: Add version to class
...
code review fix
2025-03-05 17:59:38 -06:00
David McDonald
06a2ebd9ff
Windows GUI Symbols: JSON Lint
2025-03-05 17:59:38 -06:00
David McDonald
3750b88ba4
Windows WindowStations: Fix issue with native types
2025-03-05 17:59:38 -06:00
Andrew Case and David McDonald
dad5a75aaa
Windows GUI Plugins: Adds three plugins
...
This adds the windowstations, desktops, and deskscan plugins, and
removes the gui.py plugin file that was stubbed out in the introductory
work for the effort.
It also adds a new method to the poolscanner class, but does not bump
the poolscanner version number since there is already a major version
number bump going into this PR.
Co-authored-by: Andrew Case <andrew@dfir.org >
2025-03-05 17:59:38 -06:00
Andrew Case and David McDonald
885bf187e2
Windows DeskScan: Update pool extension
...
This updates the Windows pool extension with a new get_name() method,
and changes the method signature for another. We'll need to figure out
if there is a good way to version extension classes.
Deskscan requires this in order to use get_name with an alternate
(non-kernel) symbol table.
2025-03-05 17:59:38 -06:00
David McDonald
ced9056754
Windows Versions: Add version check for win10 17735 or later
2025-03-05 17:59:38 -06:00
David McDonald
76e459b62e
Windows Versions: Sort version checks for readability
2025-03-05 17:59:38 -06:00
Andrew Case and David McDonald
844a24f02d
Windows Scheduled Tasks: Prevent backtraces
...
This fixes an `AttributeError` that can crop up when the actionset's
context is `None`.
2025-03-05 17:59:38 -06:00
Andrew Case