Gustavo Moreira
54ce358e8e
framework: minor version bump
2025-02-03 07:37:38 +11:00
Mike Auty
fbb9627d36
Keep the advanced configuration requirements out of the interfaces
2025-02-02 16:18:42 +00:00
Mike Auty
144a7cc3f5
Add error checking when accessing the KVO
...
Also bumps hivescan to take a module name rather than a
layer_name/symbol_table combo.
2025-02-02 16:07:32 +00:00
Gustavo Moreira
bf0271cd57
linux: kallsyms plugin: simplify argument by removing the "only-" prefix, which was also causing confusion.
2025-02-02 12:29:01 +11:00
Gustavo Moreira
5347926ab6
linux: Add pscallstack plugin testcase
2025-02-02 11:34:31 +11:00
Gustavo Moreira
80f6d0dad6
linux: Add kallsyms plugin testcase
2025-02-02 11:33:34 +11:00
ikelos and GitHub
9a01f8307f
Merge pull request #1595 from volatilityfoundation/walk_internal_list_bug
...
Add smear checks and missing absolute flag to walk_internal_list
2025-02-01 12:31:48 +00:00
Mike Auty
df310c0d92
Manually revert 74a834b
...
This should resolve the issue experienced #1590 was trying to resolve.
2025-02-01 12:27:49 +00:00
Gustavo Moreira
1da15d1352
linux: pscallstack plugin: Fix canonical addresses
2025-02-01 20:55:54 +11:00
Gustavo Moreira
0ba331f34c
linux: kallsyms api: Added support for older kernels lacking mod_tree. Enhanced module address search performance by using the new module memory boundaries function
2025-02-01 20:55:40 +11:00
Gustavo Moreira
2af8b95ea4
linux: module object extension: add method to know the module memory boundaries based on its symbols addresses and sizes
2025-02-01 20:55:35 +11:00
Gustavo Moreira
9175c1b1e9
linux: kallsyms api: ensure all the addresses are in the same range
2025-02-01 20:55:29 +11:00
Gustavo Moreira
4469ab49c8
linux: kallsyms api: move the unsupport implementation message to the info log level
2025-02-01 18:12:51 +11:00
Gustavo Moreira
fbba4c7675
linux: new pscallstack plugin: add a poor man's process stack call enumeration plugin to showcase the power of the kallsyms API
2025-02-01 17:55:50 +11:00
Gustavo Moreira
d665fcc2b5
linux: kallsyms plugin: Enable filtering of symbols by subsystem
2025-02-01 17:55:42 +11:00
Gustavo Moreira
97135a992a
linux: add Kallsyms plugin
2025-02-01 17:55:33 +11:00
Gustavo Moreira
6174687204
linux: Introduce Kallsyms API
2025-02-01 17:55:21 +11:00
Gustavo Moreira
7e4b548e17
linux: task_struct object extension: Add method to get the task address space layer, even if its a kernel thread
2025-02-01 17:55:13 +11:00
Gustavo Moreira
e2431eebdf
linux: bpf_prog: Add methods to get the program address and its memory regions
2025-02-01 17:55:05 +11:00
Gustavo Moreira
0e0daffc45
linux: Add kernel_symbol object extension
2025-02-01 17:54:55 +11:00
Gustavo Moreira
88b32b0803
linux: task_struct object extension: Add helper to obtain the task state
2025-02-01 17:54:47 +11:00
Gustavo Moreira
dba90ac217
linux: Add support for module symbol types
2025-02-01 17:54:41 +11:00
Gustavo Moreira
18a69b9417
linux: add latched RB-trees implementation
2025-02-01 17:54:27 +11:00
Andrew Case
60dc0c04f4
Address feedback. Add doc strings
2025-01-31 22:37:21 -06:00
ikelos and GitHub
5a046ea0e4
Merge pull request #1590 from volatilityfoundation/mnt_parent_missing
...
Add mnt_parent check to kernel version validation
2025-02-01 01:46:46 +00:00
ikelos and GitHub
75b55c3b30
Merge pull request #1593 from volatilityfoundation/mountinfo_superblock_check
...
Add missing pointer validation check in mountinfo
2025-02-01 01:43:13 +00:00
ikelos and GitHub
346a5d98da
Merge pull request #1592 from volatilityfoundation/kthread_name_smear
...
Prevent backtraces when kthread full name is smeared
2025-02-01 00:56:10 +00:00
ikelos and GitHub
4df047beac
Merge pull request #1591 from volatilityfoundation/check_sock_access
...
Fix broken socket retrieval that causes backtrace
2025-02-01 00:55:08 +00:00
David McDonald
1d1af696ff
Windows: Handles - catch exception in handle iteration
...
An `InvalidAddressException` can occur inside of `__iter__` when
iterating over the handle table (the exact exception occurs when
creating the subtype in `objects.Array.__getitem__`. This changes the
handle code to do a manual iteration over the sequence using the array
length and indexes, catch the exception, log the index, and continue.
In the test sample that prompted this change, the exception occurred on
the access of the very last item in the array.
closes #1573
2025-01-31 17:35:08 -06:00
Andrew Case
b81d2a2781
Fix get_name API, fix malfind
2025-01-31 23:03:43 +00:00
Andrew Case
941e40c368
Fix get_name API, fix malfind
2025-01-31 22:59:32 +00:00
Andrew Case
3b3331a58d
Add smear checks and missing absolute flag to walk_internal_list
2025-01-31 22:32:35 +00:00
Andrew Case
efbc410c4d
Add missing pointer validation check in mountinfo
2025-01-31 21:43:32 +00:00
Andrew Case
644b967c62
Prevent backtraces when kthread full name is smeared
2025-01-31 21:31:07 +00:00
Andrew Case
4d43ac9a6d
Catch invalid address exception for invalid sock values
2025-01-31 20:46:16 +00:00
Andrew Case
cb3542f76a
Catch invalid address exception for invalid sock values
2025-01-31 20:40:51 +00:00
Andrew Case
1132bd9830
Add mnt_parent check to kernel version validation
2025-01-31 18:11:22 +00:00
Andrew Case
55b27a68d5
Add mnt_parent check to kernel version validation
2025-01-31 18:10:12 +00:00
ikelos and GitHub
1f983aca73
Merge pull request #1585 from volatilityfoundation/issues/issue1577
...
Expose and use `get_pefile_obj` rather than having local copies
2025-01-31 17:30:22 +00:00
ikelos and GitHub
b51acfd3fb
Merge pull request #1407 from eve-mem/WindowsCommitCharge_issue1400
...
Windows: Update get_commit_charge extension to handle Core.CommitCharge case
2025-01-31 16:44:24 +00:00
eve
e9d1831a7c
Windows: update get_commit_charge with CommitCharge fix by BeanBagKing
2025-01-31 14:45:28 +00:00
Mike Auty
68c8b2389a
Make error messages a little more descriptive
2025-01-31 10:00:16 +00:00
ikelos and GitHub
b81105f508
Merge pull request #1587 from gcmoreira/intel_translation_performance_improvement
...
intel: address translation: performance improvements caching by page address
2025-01-31 09:55:06 +00:00
ikelos and GitHub
702257fb4e
Merge pull request #1586 from gcmoreira/framework_improve_conversion_to_strings
...
Framework improve conversion to strings
2025-01-31 09:04:33 +00:00
Gustavo Moreira
815b2fe918
Fix bug in address_to_string() helper
2025-01-31 19:49:04 +11:00
Gustavo Moreira
c82ef0cfd2
intel: address translation: performance improvements caching by page address
2025-01-31 19:29:33 +11:00
Gustavo Moreira
b91724c3ef
Replace *_to_string() for a block reader implementation for better performance. Add new address_to_string() helper
2025-01-31 18:48:52 +11:00
Gustavo Moreira
9218e0e07f
fix double null-termination search
2025-01-31 18:47:11 +11:00
ikelos and GitHub
f83386f19b
Update volatility3/framework/symbols/linux/extensions/__init__.py
...
My bad, little typo when trying to fix it last time
2025-01-30 11:13:25 +00:00
ikelos and GitHub
f6106c8f19
Apply suggestions from code review
...
Try to patch up ruff failures through suggestions.
2025-01-30 11:10:36 +00:00
Gustavo Moreira