Andrew Case
0f098fc160
Address feedback
2025-03-24 20:13:10 -05:00
Andrew Case and GitHub
19520799bb
Merge branch 'develop' into threads_useful_columns
2025-03-24 20:03:07 -05:00
ikelos and GitHub
083dae71b4
Merge pull request #1733 from volatilityfoundation/add-script-only-volshell-feature
...
Add a --script-only flag that exits after the given volshell script i…
2025-03-25 00:51:50 +00:00
ikelos and GitHub
e527f76a2d
Merge pull request #1734 from volatilityfoundation/plugin_requirement_deprecation
...
Framework: Replace PluginRequirements
2025-03-25 00:48:31 +00:00
ikelos and GitHub
46561dd664
Merge pull request #1728 from volatilityfoundation/add_perf_events
...
Add performance event plugin to detect eBPF malware
2025-03-25 00:17:55 +00:00
ikelos and GitHub
6dc0157841
Merge pull request #1729 from the-rectifier/volshell_byteorder
...
Volshell: Add byteorder argument for display_* functions
2025-03-25 00:10:19 +00:00
Mike Auty
de11e87f28
Fix ruff error (again)
2025-03-25 00:08:07 +00:00
Mike Auty
a013170a2d
Slotting has little effect, so don't change so much
2025-03-24 23:58:45 +00:00
Mike Auty
acfedd6d9c
Sets slots to none has no effect on memory as long as __dict__ isn't instanciated
2025-03-24 23:23:22 +00:00
Mike Auty
200746cbe6
Fix silly usage of update
2025-03-24 22:46:36 +00:00
Mike Auty
292ed6aeb4
Try to avoid variables changing types
2025-03-24 22:41:52 +00:00
Mike Auty
62d1d818b3
Restore use of ChainMap as well
2025-03-24 22:40:14 +00:00
Mike Auty
0ea5d795fd
Fix ruff issue
2025-03-24 22:36:12 +00:00
Mike Auty
8610c681ab
Restore the chainmap, since we need it for cloning
2025-03-24 22:33:25 +00:00
Abyss Watcher
6a28d1432f
adjust curl cmds
2025-03-24 20:39:44 +01:00
Andrew Case
166d0e0c14
Fix issue when pe_symbols limited to searching one process. Remove need to track symbol indexes. Provide much more useful debugging information. Fixes #1732
2025-03-24 19:37:59 +00:00
Abyss Watcher
f80b207aab
download symbols_win-10_19041-2025_03.zip
2025-03-24 20:36:25 +01:00
Mike Auty
3153cd7e30
Remove the chainmap and multiple dictionaries to reduce memory consumption
2025-03-24 19:21:51 +00:00
David McDonald
a6f9a0e95b
Framework: Replace PluginRequirements
...
This replaces all uses of `requirements.PluginRequirements` with
`requirements.VersionRequirement`.
2025-03-24 11:30:17 -05:00
Andrew Case
003c139597
Add a --script-only flag that exits after the given volshell script is completed
2025-03-24 15:10:37 +00:00
Andrew Case
36b66f00fe
Add delete on close detection to process ghosting. Update plugin to current coding flow
2025-03-24 05:05:08 +00:00
Andrew Case
e3d35aa425
update from feedback
2025-03-24 02:49:31 +00:00
Andrew Case
57c07631b0
Add win32 start address listing. Add paths for both thread starting address types
2025-03-23 21:23:42 -05:00
Mike Auty
f0153817c5
Add in slots to object model
2025-03-24 00:58:28 +00:00
Odysseas Stavrou
bb39081e33
Volshell: Add byteorder argument for display_* functions
2025-03-23 22:29:16 +02:00
Mike Auty
e86981c880
Various: Update yarascan plugins to output LayerData instead of just bytes
2025-03-23 00:42:13 +00:00
Mike Auty
6f599fa645
Various: Minor bump malfind functions for all OSes
2025-03-23 00:42:13 +00:00
Mike Auty
af01fcdcff
Core: Remove unnecessary f-string
2025-03-23 00:42:13 +00:00
Mike Auty
c18c6cbf30
Core: Shift renderers from interfaces
2025-03-23 00:42:13 +00:00
Mike Auty
6af8cd09f0
Renderers: Add in fallback method for formatting cellrenderers
2025-03-23 00:42:13 +00:00
Mike Auty
94d6f4f131
CLI: Indicate missing bytes from padded bytes
2025-03-23 00:42:13 +00:00
Mike Auty
85870a9a94
Windows: Update the required framework version for plugins outputting LayerData
2025-03-23 00:42:13 +00:00
Mike Auty
4145ef2c0d
Renderers: Add no_surrounding to LayerData and include MINOR version bump
2025-03-23 00:42:11 +00:00
Mike Auty
e936b33784
CLI: Fix ruff check error
2025-03-23 00:41:43 +00:00
Mike Auty
2e8d18e7cb
Windows: Convert mbrscan over to LayerData output
2025-03-23 00:41:43 +00:00
Mike Auty
2304ea4cbe
Windows: Convert mftscan plugins to LayerData output
2025-03-23 00:41:43 +00:00
Mike Auty
1d5d981be1
Windows: Convert malfind to LayerData renderer
2025-03-23 00:41:43 +00:00
Mike Auty
ba82067dac
CLI: Add in initial LayerData renderer
2025-03-23 00:41:43 +00:00
Mike Auty
d3a5883130
Core: Fix up more bad typing operators
2025-03-23 00:41:43 +00:00
Mike Auty
45ee399623
Core: Fix up yet another typo
2025-03-23 00:41:43 +00:00
Mike Auty
16d1b2697c
Core: Fix typing for python < 3.10
2025-03-23 00:41:43 +00:00
Mike Auty
4fd501d38f
Core: Resolve ruff errors
2025-03-23 00:41:43 +00:00
Mike Auty
1ecd75f665
Core: Apply black to interfaces and the CLI
2025-03-23 00:41:43 +00:00
Mike Auty
453f52ba3e
CLI: Add in concept of CellRenderer
2025-03-23 00:41:43 +00:00
Mike Auty
55151f546d
Initial work on adding a LayerData renderer type
2025-03-23 00:41:43 +00:00
Andrew Case
6763031df8
Add performance event plugin to detect eBPF malware
2025-03-21 20:28:23 +00:00
ikelos and GitHub
0ddec14cf9
Merge pull request #1724 from volatilityfoundation/dgmcdona/windows_timers_raw_dpc_offset
...
Windows: Fix raw Dpc offset calculation
2025-03-20 20:28:18 +00:00
David McDonald
d097d6abeb
Timers: convert general Exception to InvalidAddressException
2025-03-20 15:18:08 -05:00
David McDonald
c4589a51d5
Timers: Adds debug log statement to catch-all exception
2025-03-20 15:13:26 -05:00
David McDonald
1e175b5d3b
Objects: rework new get_raw_value() method
...
Per code review recommendations, splits the `_unmarshall` classmethod
into two components, one of which retrieves the raw value, and the other
that returns the masked pointer. The `get_raw_value` method now calls
the `_get_raw_value` classmethod using its instance information.
2025-03-20 15:11:37 -05:00
Andrew Case