 Andrew Case
|
caedfc564f
|
Fix black error
|
2025-04-01 13:34:24 +00:00 |
|
|
Andrew Case
|
524d89ad6c
|
Fix several bugs in check_afinfo. Update through latest kernels. Match current Volatility coding standards
|
2025-03-31 23:08:49 +00:00 |
|
|
Andrew Case
|
a3069a3192
|
Fix hidden_modules to actually list hidden modules...
|
2025-03-27 20:06:09 -05:00 |
|
|
Andrew Case
|
61575ca2b1
|
Require parity framework version
|
2025-03-27 19:30:58 -05:00 |
|
|
Andrew Case
|
aab95ea18e
|
Add required interface version to plugin
|
2025-03-27 18:39:29 -05:00 |
|
|
Andrew Case
|
5cfd55eba8
|
ordering fix
|
2025-03-27 17:17:08 -05:00 |
|
|
Andrew Case
|
ed7e013aac
|
Bug fix
|
2025-03-27 17:06:14 -05:00 |
|
|
Andrew Case
|
82d4de90df
|
Address feedback update
|
2025-03-27 17:02:23 -05:00 |
|
|
Andrew Case
|
7f55ec6dd5
|
Address feedback
|
2025-03-27 16:46:51 -05:00 |
|
|
Andrew Case
|
25eaaff06c
|
Bring hidden module to expose dump option. Fix CodeQL found bug
|
2025-03-26 01:30:26 +00:00 |
|
|
Andrew Case
|
e93df37649
|
Add module extraction API. Add plugin to directly extract modules. Hook module dumping into existing module listing plugins.
|
2025-03-26 01:16:53 +00:00 |
|
|
Andrew Case
|
444305afc2
|
Handle kernel processes properly this time
|
2025-03-26 00:55:48 +00:00 |
|
|
Andrew Case
|
43ab95f4c5
|
Change thrdscan from looking for kernel processes
|
2025-03-26 00:50:34 +00:00 |
|
|
Andrew Case
|
e52aea886e
|
Fix checks in thrdscan that broke tests
|
2025-03-26 00:41:26 +00:00 |
|
|
Andrew Case
|
3a4e622854
|
Change pending checking and OS version
|
2025-03-24 20:19:59 -05:00 |
|
|
Andrew Case
|
1a2427b54b
|
Change column order
|
2025-03-24 20:18:54 -05:00 |
|
|
Andrew Case
|
0f098fc160
|
Address feedback
|
2025-03-24 20:13:10 -05:00 |
|
|
Andrew CaseandGitHub
|
19520799bb
|
Merge branch 'develop' into threads_useful_columns
|
2025-03-24 20:03:07 -05:00 |
|
|
Andrew Case
|
166d0e0c14
|
Fix issue when pe_symbols limited to searching one process. Remove need to track symbol indexes. Provide much more useful debugging information. Fixes #1732
|
2025-03-24 19:37:59 +00:00 |
|
|
Andrew Case
|
003c139597
|
Add a --script-only flag that exits after the given volshell script is completed
|
2025-03-24 15:10:37 +00:00 |
|
|
Andrew Case
|
36b66f00fe
|
Add delete on close detection to process ghosting. Update plugin to current coding flow
|
2025-03-24 05:05:08 +00:00 |
|
|
Andrew Case
|
e3d35aa425
|
update from feedback
|
2025-03-24 02:49:31 +00:00 |
|
|
Andrew Case
|
57c07631b0
|
Add win32 start address listing. Add paths for both thread starting address types
|
2025-03-23 21:23:42 -05:00 |
|
|
Andrew Case
|
6763031df8
|
Add performance event plugin to detect eBPF malware
|
2025-03-21 20:28:23 +00:00 |
|
|
Andrew Case
|
548657c309
|
Change None check to remove False booleans
|
2025-03-20 15:02:22 +00:00 |
|
|
Andrew Case
|
508cbd3a17
|
Fix function name
|
2025-03-19 23:51:29 +00:00 |
|
|
Andrew Case
|
741a4ea809
|
Hopefully final round of kallsym fixes
|
2025-03-19 23:49:45 +00:00 |
|
|
Andrew Case
|
bfe50889b0
|
Add the recovery and reporting of LKM load parameters
|
2025-03-19 17:32:09 -05:00 |
|
|
Andrew Case
|
06a4c56395
|
Update for new accessing method
|
2025-03-17 20:15:18 -05:00 |
|
|
Andrew Case
|
0667a40836
|
Removed unused import
|
2025-03-17 19:06:02 -05:00 |
|
|
Andrew Case
|
93be148534
|
Change how the inheritance is performed
|
2025-03-17 19:04:02 -05:00 |
|
|
Andrew Case
|
00c4a13567
|
remove errant space
|
2025-03-17 18:58:55 -05:00 |
|
|
Andrew Case
|
f906bde338
|
change lmsod call
|
2025-03-17 18:56:54 -05:00 |
|
|
Andrew Case
|
971f06996b
|
bump version on kallsyms
|
2025-03-17 18:56:49 -05:00 |
|
|
Andrew Case
|
7146b45fa7
|
Create versioned parent class for all plugins that enumerate Linux kernel modules. Convert plugins to new method.
|
2025-03-17 18:56:05 -05:00 |
|
|
Andrew Case
|
07b74fd8e3
|
Add typing to functions in modules class
|
2025-03-17 18:28:13 -05:00 |
|
|
Andrew Case
|
e48d2972a6
|
Add needed checks to prevent backtraces in ELF parsing
|
2025-03-17 17:46:25 -05:00 |
|
|
Andrew Case
|
1eacddc79c
|
Add needed checks to prevent backtraces in ELF parsing
|
2025-03-17 17:45:13 -05:00 |
|
|
Andrew Case
|
b8a427c130
|
Fix bugs in kallsyms and the related pscallstack found in testing and switch calls to deprecated functions
|
2025-03-17 17:08:27 -05:00 |
|
|
Andrew Case
|
ee35fa1ef9
|
Prevent backtrace on smeared iomem entry
|
2025-03-17 19:10:23 +00:00 |
|
|
Andrew Case
|
f697287784
|
Prevent backtrace on corrupt system call table entry
|
2025-03-17 19:09:05 +00:00 |
|
|
Andrew Case
|
4b403d50ef
|
Fix first set of ELF parsing unhandled smear protection
|
2025-03-17 15:29:28 +00:00 |
|
|
Andrew Case
|
18abe9c508
|
Fix first set of ELF parsing unhandled smear protection
|
2025-03-17 15:25:43 +00:00 |
|
|
Andrew Case
|
04cd65ef2b
|
Update netfilter to current rookit detection API and update displayed columns to current standards
|
2025-03-17 15:23:44 +00:00 |
|
|
Andrew Case
|
dae430ff58
|
Address feedback
|
2025-03-16 22:19:41 +00:00 |
|
|
Andrew Case
|
4e1ddadb40
|
Fix version requirements
|
2025-03-16 17:53:55 +00:00 |
|
|
Andrew Case
|
7e5a34ae49
|
Black and Ruff fixes
|
2025-03-16 17:17:46 +00:00 |
|
|
Andrew Case
|
c8869d87cd
|
Version the GUI extensions. Correctly check windows procedure
|
2025-03-16 17:15:43 +00:00 |
|
|
Andrew Case
|
d22d513716
|
Re-type the correct function
|
2025-03-16 16:40:53 +00:00 |
|
|
Andrew Case
|
bad34a112a
|
Add the windows plugin and associated extensions updates
|
2025-03-15 22:58:07 +00:00 |
|
|
Andrew Case
|
2d2228b06e
|
Fix signature
|
2025-03-15 21:25:39 +00:00 |
|
|
Andrew Case
|
fbb4003a32
|
Fix broken truncation from Vol3 bytes to string conversion
|
2025-03-15 20:59:14 +00:00 |
|
|
Andrew Case
|
458e8eb692
|
retrigger checks
|
2025-03-15 20:41:09 +00:00 |
|
|
Andrew Case
|
f73717a39d
|
retrigger checks
|
2025-03-15 20:36:34 +00:00 |
|
|
Andrew Case
|
9da147df1b
|
simplify check
|
2025-03-15 19:10:00 +00:00 |
|
|
Andrew Case
|
e79f03691a
|
Add name to interface and validate it in processing loop
|
2025-03-15 19:01:52 +00:00 |
|
|
|
0f5dd10aa9
|
Apply suggestions from code review
Co-authored-by: ikelos <ikelos@users.noreply.github.com>
|
2025-03-15 13:23:01 -05:00 |
|
|
Andrew Case
|
674cc045d2
|
Update to using str dictionary key. Add requirements for each gatherer in modxview. Validate names are unique while sanity checking.
|
2025-03-15 17:22:31 +00:00 |
|
|
Andrew Case
|
53e32e36f6
|
Add versioning on gatherers, make check non-specific to kernel gatherer, add requirements to ModuleGatherers
|
2025-03-14 22:34:06 +00:00 |
|
|
Andrew Case
|
b2ec21fcf2
|
Simplify last_address handling
|
2025-03-14 21:15:03 +00:00 |
|
|
Andrew Case
|
a0f3cba6f6
|
Fix stale comments
|
2025-03-14 21:08:15 +00:00 |
|
|
Andrew Case
|
bb0a17004f
|
Add return_truncated for plugin-specified handling of truncated strings
|
2025-03-14 20:59:15 +00:00 |
|
|
Andrew Case
|
f38ddaf715
|
Fix string scanning code
|
2025-03-14 20:53:02 +00:00 |
|
|
Andrew Case
|
f5ae7928a3
|
Black fix
|
2025-03-14 20:45:14 +00:00 |
|
|
Andrew Case
|
2e93b8ed09
|
Prevent CodeQL from losing its mind. Properly checking for instances of the interface
|
2025-03-14 20:43:12 +00:00 |
|
|
Andrew Case
|
cf8bb3dfbc
|
Adjust run_modules_scanners to avoid special handling of hidden modules, adjust modxview to new API, add classes and version requirements on module gathering interface
|
2025-03-14 20:27:25 +00:00 |
|
|
Andrew Case
|
4225adce56
|
Convert to .mapping and let Python had all encodings
|
2025-03-14 16:32:54 +00:00 |
|
|
Andrew Case
|
36b3c28859
|
Update encodings
|
2025-03-14 03:12:06 +00:00 |
|
|
Andrew Case
|
7ab62365fb
|
Vastly improve string reading while keeping intended behaviour
|
2025-03-14 03:05:11 +00:00 |
|
|
Andrew Case
|
4606495ded
|
Bump dep versions
|
2025-03-14 02:09:08 +00:00 |
|
|
Andrew Case
|
c318e7c326
|
Make configurable to sources
|
2025-03-14 01:52:16 +00:00 |
|
|
Andrew Case
|
39d39292f0
|
Update symbol splitting to handle symbols without attached module name
|
2025-03-13 22:55:47 +00:00 |
|
|
Andrew Case
|
d76288f994
|
Update nearly all callers of now deprecated Linux kernel APIs
|
2025-03-13 22:53:51 +00:00 |
|
|
Andrew Case
|
48a5736a57
|
Properly reconstruct strings from memory buffers and allow for plugin-specified encodings
|
2025-03-13 21:09:38 +00:00 |
|
|
Andrew Case
|
740ce520d6
|
retrigger checks
|
2025-03-10 22:13:09 +00:00 |
|
|
Andrew Case
|
c1b4866ba7
|
retrigger checks
|
2025-03-10 21:36:54 +00:00 |
|
|
Andrew Case
|
f17907200d
|
No longer allocate session modules in support of the GUI objects at offset 0. Instantiate objects at the absolute address explicility.
|
2025-03-10 21:26:58 +00:00 |
|
|
Andrew Case
|
7d5d379144
|
Allow desktops and window stations to come from the paged or non-paged pool
|
2025-03-10 21:24:55 +00:00 |
|
|
Andrew Case
|
6c96ffacdd
|
Update fbdev plugin to gracefully handle old/broken symbol tables
|
2025-03-10 16:38:30 +00:00 |
|
|
Andrew Case
|
2d4e0f66d8
|
Update fbdev plugin to gracefully handle old/broken symbol tables
|
2025-03-10 16:38:30 +00:00 |
|
|
Andrew Case
|
f7f8cf24cd
|
Address feedback
|
2025-03-10 16:36:53 +00:00 |
|
|
Andrew Case
|
dad88965e9
|
Fix broken code and APIs in Linux networking paths
|
2025-03-10 16:30:16 +00:00 |
|
|
Andrew Case
|
897069c6d0
|
Throw more specific exception
|
2025-03-10 16:27:49 +00:00 |
|
|
Andrew Case
|
2a99a53784
|
Make exception throwing consistent in the PDB gathering API. Avoid returning an empty symbol_table name when the PDB cannot be downloaded.
|
2025-03-10 16:23:00 +00:00 |
|
|
Andrew Case
|
a4bbdfdded
|
Make exception throwing consistent in the PDB gathering API. Avoid returning an empty symbol_table name when the PDB cannot be downloaded.
|
2025-03-10 16:23:00 +00:00 |
|
|
Andrew Case
|
9e4fdbf8ef
|
Address feedback
|
2025-03-10 16:21:56 +00:00 |
|
|
Andrew Case
|
b8c0b1eaa8
|
Add missing files
|
2025-03-10 03:39:57 +00:00 |
|
|
Andrew Case
|
7289f7dc70
|
Ensure that new symbol tables are only created when needed. Avoid name collisions leading to inconsistent behaviour. Make API for symbol table acquisition sane.
|
2025-03-10 03:27:56 +00:00 |
|
|
Andrew CaseandDavid McDonald
|
3eae04c1e8
|
Add removal_date to deprecation API
|
2025-03-09 22:23:33 -05:00 |
|
|
Andrew CaseandDavid McDonald
|
6cabb0586b
|
Add removal_date to deprecation API
|
2025-03-09 22:23:33 -05:00 |
|
|
Andrew CaseandDavid McDonald
|
4a87bf506a
|
Add new deprecation module
|
2025-03-09 22:23:33 -05:00 |
|
|
Andrew CaseandDavid McDonald
|
b68b4f3e72
|
Bring back change after merge conflict
|
2025-03-09 22:23:33 -05:00 |
|
|
Andrew CaseandDavid McDonald
|
6a32aa4b6a
|
Deprecation API updates
|
2025-03-09 22:23:33 -05:00 |
|
|
|
636bb10f9f
|
Update volatility3/framework/plugins/linux/hidden_modules.py
Co-authored-by: ikelos <ikelos@users.noreply.github.com>
|
2025-03-09 22:23:33 -05:00 |
|
|
Andrew CaseandDavid McDonald
|
2ead4d3dc6
|
update for black
|
2025-03-09 22:23:33 -05:00 |
|
|
Andrew CaseandDavid McDonald
|
bdc3443c13
|
Merge two Linux APIs for mapping kernel modules to pointers. Fix bugs in new API. Add deprecation warnings throughout old API.
|
2025-03-09 22:23:33 -05:00 |
|
|
Andrew Case
|
9919c1e614
|
Fix handles API and callers. Bump version number and requirements
|
2025-03-08 22:49:16 +00:00 |
|
|
|
5f8e7e58a4
|
Update volatility3/framework/plugins/windows/pe_symbols.py
Co-authored-by: ikelos <ikelos@users.noreply.github.com>
|
2025-03-08 14:12:11 -06:00 |
|
|
Andrew Case
|
2225548079
|
Remove deepcopy call in pe_symbols. Validate wanted symbol information passed through resolving functions
|
2025-03-08 19:59:57 +00:00 |
|
|
Andrew Case
|
539a94117a
|
Add missing change
|
2025-03-08 17:27:50 +00:00 |
|