WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity
6,534 Commits 80 Branches 17 Tags
develop
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
MHL cb98a085d7 refs #1296 sort volshell methods alphabetically in hh() output 2024-10-07 09:11:49 -05:00
iMHLv2 e5d4e599d3 refs #713 update API_CHANGES.md 2022-09-21 14:55:17 -05:00
iMHLv2 ee3895867f refs #713 bump VERSION_MINOR to 4 2022-09-21 13:40:28 -05:00
iMHLv2 9ca83763ba refs #713 add a vad.get_size() method and fix several off-by-one issues with calculating vad size 2022-08-24 11:10:38 -05:00
iMHLv2 3e70030d17 refs #668 by convention, use show-free instead of show_free 2022-04-20 13:22:18 -05:00
iMHLv2 fd81dba420 refs #668 bump the minor version and not the revision for an additive change 2022-04-20 13:21:43 -05:00
iMHLv2 02569f4e06 refs #668 handle freed windows big pools more accurately. add --show_free option to the bigpools plugin 2022-03-29 11:57:24 -05:00
iMHLv2andMike Auty ea335b03ae change return to yield after get_object() turned into a generator in 2da510d8 2021-10-06 20:42:51 +01:00
iMHLv2andMike Auty 2d2a457517 fix pool scanners on some windows versions 
This fixes the size of _POOL_HEADER on 32-bit versions of Windows (was 16, should be 8). Also, get_object() is not doing enough validation and its returning too early. I turned that into a generator so it yields both valid and invalid objects, since the caller does validation anyway. Another way of fixing this is to pass the type_map and cookie from the caller into get_object() so it can do the proper validation and only return valid objects.
 2021-10-06 20:42:48 +01:00
iMHLv2 f92d83f619 add the missing -r 2021-10-06 12:48:52 -05:00
iMHLv2 8ec52c7178 refs #566 refactor dependencies 2021-10-06 12:47:04 -05:00
iMHLv2 f1079e7e9b fix up required framework version for crashinfo 2021-07-10 08:32:40 -05:00
iMHLv2 7d9c66c407 run yapf on the newly added files 2021-06-01 14:27:20 -05:00
iMHLv2 7b73f8d545 fix the copyright date for extensions/crash.py 2021-06-01 14:21:11 -05:00
iMHLv2 d2db22c310 use typing for the layer variable passed to _generator 2021-06-01 14:20:59 -05:00
iMHLv2 d285519ecb don't assume primary.memory_layer is a crash layer...instead, cycle through the layers until finding the crash layer 2021-06-01 14:17:31 -05:00
iMHLv2 a0adbde994 eliminate confusing single letter variable 2021-06-01 13:55:37 -05:00
iMHLv2 b15e69e11d ensure the crashinfo plugin gets a crash layer 2021-06-01 13:55:21 -05:00
iMHLv2 7152ca0ffc refactor load_segments() to fix 32-bit bitmap crashdumps 2021-05-11 15:59:42 -05:00
iMHLv2 00db33e0fe print human readable dump type in crashinfo, along with bitmap header size, bitmap size, and page count 2021-03-31 09:52:12 -05:00
iMHLv2 fb54a2cade report segments in the crash layer with LOGLEVEL_VVVV 2021-03-30 21:23:46 -05:00
iMHLv2 3ebbddbd8d don't save objects in self 
they contain a reference to the context, so if we ever pickle that, then it'll cause a massive recursion loop and fail
 2021-03-30 21:12:32 -05:00
iMHLv2 f5e5fd0060 apply fixes and improvements for crash layer (see description) 
1) Remove empty newlines before the license

2) Remove unused imports

3) Add support for 32-bit Bitmap crash dumps

4) Move _SUMMARY_DUMP to crash_common.json and fix the swapped Pages and BitmapSize offsets

5) Fix other errors in crash64.json (swapped SystemTime vs SystemUpTime, PsActiveProcessHead should be unsigned long long, several incorrect offsets for other members

6) Switched to new volatility3 namespace

7) Reverted required_framework_version to (1, 0, 0)

8) Fixed crashinfo plugin from unpacking the wrong number of values from layer.mapping(). Actually, the plugin no longer displays runs - it shows metadata instead.

9) Address Ikelos' comments in PR #452
 2021-03-30 17:25:32 -05:00
iMHLv2 f4dee3c5f0 sync with fa1c03d of jxwegner/volatility3 2021-03-30 15:27:09 -05:00
iMHLv2 b61185c6b0 refs #409 VACB does not expose is_valid() - do the validity check inline 2021-01-13 21:23:12 -06:00
iMHLv2andMike Auty 2a180c135e refs #368 fix handles on 32-bit windows 8 and 10 - finding SAR is not necessary on these versions 2021-01-13 00:29:01 +00:00
iMHLv2 d7d176d040 add Is64Bit and IsPAE properties to the windows.info plugin 2021-01-06 11:36:56 -06:00
iMHLv2 53397117ef remove unnecessary and unused imports from the windows extensions init file 2021-01-06 10:30:01 -06:00
iMHLv2 2c3b6668d5 refs #368 fix handles on 32-bit windows 8 and 10 - finding SAR is not necessary on these versions 2021-01-06 10:10:51 -06:00
iMHLv2andikelos 0a9e663c41 remove the _VACB.is_valid() method - do all validity checks in the calling function 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 442f877e9a refs #197 initial commit of windows.dumpfiles 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 20f4fbf157 add --virtaddr and --physaddr options so users can supply virtual or physical addresses (or both) 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 0c09b98318 use native_layer_name in file_name_with_device() in case the FILE_OBJECT is instantiated from a memory (physical) layer 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 25b56b5ca4 remove the _VACB.is_valid() method - do all validity checks in the calling function 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 3ac89577cc refs #197 initial commit of windows.dumpfiles 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 0d4075355a refs #332 catch invalid address exceptions when reading DllBase 2020-10-07 23:16:14 +01:00
iMHLv2andikelos 8baf13d3e3 refs #333 catch InvalidAddressException instead of AttributeError when accessing DLL timestamps 2020-09-23 19:27:37 +01:00
Michael Lighandikelos 87ff6dd87c refs #200 raise ValueError if an object doesn't have a name 2020-07-01 20:51:22 +01:00
Michael Ligh d5bdf9633d refs #204 fix modscan, _LDR_DATA_TABLE_ENTRY is not an executive object and doesn't have an object_type 2020-04-07 09:22:52 -05:00
Michael Lighandikelos 4c7f2a3762 catch InvalidAddressException when traversing left and right child VADs (triggered on terminated processes) 2020-02-12 19:19:27 +00:00
Michael Lighandikelos 1d7da6402b svcscan cleanup: win10 before 15063 uses win8 types 2020-01-22 19:23:30 +00:00
Michael Lighandikelos d6c8ac87d7 try unverified retrieval if ssl.SSLCertVerificationError or ssl.SSLError with CERTIFICATE_VERIFY_FAILED 2020-01-22 19:19:48 +00:00
Michael Lighandikelos e80e9e09b6 the hand-written 32-bit windows 10 service record types were missing the Tag member 2020-01-05 01:53:52 +00:00
Michael Ligh b7b6c44eab remove unused variable in vaddump.py 2020-01-04 09:35:51 -06:00
Michael Ligh cd841616af refs #144 use a kernel layer to read vad protection constants 2019-12-08 07:46:02 -06:00
Michael Lighandikelos d0f9cf9a2f refs #139 use _EPROCESS.ControlFlowGuardEnabled to distinguish between windows 10 <= 15063 versus >= 16299 2019-12-04 21:19:19 +00:00
Michael Lighandikelos 4e3db7a3de add PluginRequirements for ssdt and svcscan. add missing _version to svcscan 2019-09-08 16:08:48 +01:00
Michael Lighandikelos 1d7f2a9582 use ntkrnlmp.object() instead of context.object(). remove config_path argument to list* functions 2019-09-08 16:08:48 +01:00
Michael Lighandikelos 50548bac73 reformat with yapf 2019-09-08 16:08:48 +01:00
Michael Ligh 2138152b10 fix a bug in psscan on xp images 
we need to get the kvo using the native_layer_name rather than the layer_name
 2019-03-19 11:14:10 -05:00
Michael Ligh d68b94965c catch TypeError in _FILE_OBJECT.file_name_with_device(). this avoids an exception trying to combine a str with renderers.UnreadableValue() 2019-02-24 17:14:28 -06:00
Michael Lighandikelos 12fe297c80 builtin_constraints() returns all constraints by default 2019-02-07 09:08:32 +00:00
Michael Lighandikelos f34cd01b09 small style change for readability 2019-02-07 09:08:32 +00:00
Michael Lighandikelos 33f3f4372c parameterize generate_pool_scan() - let plugins choose which contraints to use 
plugins can choose from a list of built-ins or they can create their own and pass them into generate_pool_scan()
 2019-02-07 09:08:32 +00:00
Michael Lighandikelos c1341e6278 refactor poolscanner to be leveraged by other plugins. add psscan 2019-02-07 09:08:32 +00:00
Michael Lighandikelos d23e6474ce reference windows metadata & PE values from ISF as the primary method of determining OS version 2019-02-06 21:11:20 +00:00
Michael Ligh f61fba8e00 the vad end should be the last byte in the last page (i.e. ending in 0xfff) 2019-02-05 21:05:17 -06:00
Michael Lighandikelos 90b7f2aa3b add backup methods of detecting windows versions, in case metadata in the json isn't available 2018-12-17 19:40:14 +00:00
Michael Lighandikelos 736a1c6e50 add is_valid() for _FILE_OBJECT and _EPROCESS 2018-12-13 01:16:05 +00:00
Michael Lighandikelos 650a188d51 updates for win8/win10 poolscanning 2018-12-13 01:16:05 +00:00
Michael Lighandikelos 4c68da8b06 move the functionality for getting an object's type into the _OBJECT_HEADER extension 2018-12-13 01:16:05 +00:00
Michael Lighandikelos 4b0e7e5309 remove the Path column from poolscanner. add File scanning 2018-12-13 01:16:05 +00:00
Michael Lighandikelos d653839359 switch Handles.find_cookie() to a classmethod so it can be called from the poolscanner. add typing 2018-12-13 01:16:05 +00:00
Michael Lighandikelos d667a68f97 switch Handles.list_objects() to a classmethod so it can be called from the poolscanner. pass the type_map into get_object() 2018-12-13 01:16:05 +00:00
Michael Lighandikelos a76d71a7dc move the functionality for getting an object's type into the _OBJECT_HEADER extension 2018-12-13 01:16:05 +00:00
Michael Ligh 97ae236fcc add the pool header json files to be used when kernels fail to define their own _POOL_HEADER 2018-10-03 17:07:07 -05:00
Michael Lighandikelos fffdd253ae use renderers.NotApplicableValue() for the poolscanner plugin's name field 2018-09-15 15:22:38 +01:00
Michael Lighandikelos ac60d36e04 pass in native_layer_name to _POOL_HEADER.get_object() and remove FIXME 2018-09-15 15:22:38 +01:00
Michael Lighandikelos 88f73365ee remove vol magic comment 2018-09-15 15:22:38 +01:00
Michael Lighandikelos 668f8ad037 add pydocs to windows extension classes 2018-09-15 15:22:38 +01:00
Michael Lighandikelos 9d6055d2ba add a lambda placeholder for is_windows_10 - replace it once we have PE file version checks 2018-09-15 15:22:38 +01:00
Michael Lighandikelos f02df7a92e reduce the extra tag_type_map lookup by yielding the constraint from the pool scanner 2018-09-15 15:22:38 +01:00
Michael Lighandikelos 5d20faa0a7 work on _POOL_HEADER.get_object() 2018-09-15 15:22:38 +01:00
Michael Lighandikelos be6a351a11 start adding the _POOL_HEADER extension. expand the pool constraints to include processes 2018-09-15 15:22:38 +01:00
Michael Lighandikelos 56a5012a46 fix alignment, should offset be optional to context.module()? refactor pool type checks 2018-09-15 15:22:38 +01:00
Michael Lighandikelos 6862573734 only ask for the requirements that we need 2018-08-29 15:10:46 +01:00
Michael Lighandikelos 617510f6d6 change how we iterate through the symbol_generator results 2018-08-29 15:10:46 +01:00
Michael Lighandikelos ea63c7e80e define a find_address() method for consistent behavior for 32 and 64-bit systems 2018-08-29 15:10:46 +01:00
Michael Lighandikelos 45ea3437f1 explicitly list the nt_symbols requirement 2018-08-29 15:10:46 +01:00
Michael Lighandikelos 13e5145e46 use from ... import ... statements 2018-08-29 15:10:46 +01:00
Michael Lighandikelos 34bb059cfe add the ssdt plugin for windows 2018-08-29 15:10:46 +01:00
Michael Lighandikelos 3d7c10dd32 add the cmdline plugin for windows 2018-07-19 21:26:32 +01:00
Michael Lighandikelos ab6a9fa43b add typing, catch more specific exceptions, raise pefile dependency issues, use classmethod 2018-06-19 09:59:28 +01:00
Michael Lighandikelos e4fbc82ab3 verinfo still needs the primary and nt_symbols requirements 2018-06-19 09:59:28 +01:00
Michael Lighandikelos c43c53a7d7 initial draft of verinfo 2018-06-19 09:59:28 +01:00
Michael Lighandikelos 7338cdbf8a BaseDllName should be an UnreadableValue() if it cannot be accessed 2018-06-13 15:10:58 +01:00
Michael Lighandikelos 3eeb48cc0e add the moddump plugin for windows 2018-06-13 15:10:58 +01:00
Michael Ligh 95214216ea BaseDllName and FullDllName should be UnreadableValue() if they cannot be accessed 2018-06-13 09:10:47 -05:00
Michael LighandMike Auty 76f5d35499 update _KDDEBUGGER_DATA64.get_build_lab() to not reference "nt_symbols" 2018-06-12 08:41:37 +01:00
Michael LighandMike Auty 7ae0d654c2 pass native_types to KdbgIntermedSymbols.create() instead of table_mapping 2018-06-12 08:41:37 +01:00
Michael LighandMike Auty ae9d7dbc86 use *args and **kwargs when inheriting from IntermediateSymbolTable 2018-06-12 08:41:37 +01:00
Michael LighandMike Auty 7797a6a385 add a class string to windows.info so that the plugin has a description 2018-06-12 08:40:21 +01:00
Michael LighandMike Auty fb57e2c5f2 wininfo, procdump, dlldump, and json for pe & kdbg 2018-06-12 08:40:21 +01:00
Michael Ligh 17924a0667 refs #27 use _KLDR_DATA_TABLE_ENTRY on windows if its available 2018-05-30 13:55:20 -05:00
Michael Ligh 21b2eb7ecc malfind is reading chunks, not technically pages, so change PAGE_SIZE to CHUNK_SIZE 2018-05-13 18:49:11 -05:00
Michael Lighandikelos deb81aa1c8 address a few of @ikelos comments in the PR 2018-05-13 23:30:03 +01:00
Michael Lighandikelos a01e4e41b0 commit malfind 2018-05-13 23:30:03 +01:00
Michael Ligh 39413323b1 HexBytes() should inherit from bytes not int 2018-05-06 09:24:36 -05:00
Michael Ligh aa774ffca6 Refs #21 fix vadinfo's get_private_memory() on 10.0.14393.x 2018-04-11 09:24:02 -05:00
Michael Lighandikelos 205af99a3e Rev2 after rev1 comments 2018-03-19 22:35:00 +00:00