 SolitudePy
|
d13de25b46
|
Constants: add MAX_ARG_STRLEN linux constant
|
2025-12-31 00:26:09 +02:00 |
|
|
SolitudePy
|
9c5950e595
|
Plugins: process_spoofing bump required_framework_version
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
4cb326fb6e
|
black and ruff
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
c3ddc094cb
|
Plugins: process spoofing handle none values and set more classmethods
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
cbe5b46b8e
|
Plugins: process_spoofing change extract_process_names to classmethod
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
1359a11f24
|
Plugins: truncate deleted to check spoofing in process_spoofing
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
9686b5ae8b
|
Plugins: utilize linuxutilities.path_for_file (deleted) logic solely
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
d384f62721
|
Plugins: make get_executable_path more accurate in process_spoofing
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
41f964cfe1
|
Plugins: determine process exe deletion structurally
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
5c7cf11152
|
black
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
d11f50906a
|
Plugins: swap notes for boolean flags in process_spoofing
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
1a92e749ff
|
Plugins: more precise exception handling in process_spoofing
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
8349479643
|
Plugins: process_spoofing log exceptions as debug
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
939034cd33
|
Plugins: consistent return values in process_spoofing
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
cc6aa2117b
|
Plugins: convert useful methods to classmethods
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
d55cf9a9d0
|
Plugins: remove exe_file dereference()
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
15dc9ec463
|
Plugins: precise exception handling in process_spoofing
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
fd270a208d
|
categorize as a malware plugin
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
5c3fca3544
|
added mechanism for deleted exe
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
cf6fa422b4
|
cosmetics
|
2025-12-29 19:00:30 +02:00 |
|
|
SolitudePy
|
5aea7f92e9
|
process_spoofing plugin
|
2025-12-29 19:00:29 +02:00 |
|
|
ikelosandGitHub
|
fa6b9a8db3
|
Merge pull request #1773 from Abyss-W4tcher/issue_1761_module_sect_attr_fix
Issue #1761: handle new bin_attribute format for module sections
|
2025-12-29 10:01:33 +00:00 |
|
|
ikelosandGitHub
|
36b70a09bc
|
Merge branch 'develop' into vma_enumeration_smearing_protection
|
2025-12-29 09:54:34 +00:00 |
|
|
Mike Auty
|
0089aefaf6
|
Reformat because ruff and black disagree
|
2025-12-28 14:13:44 +00:00 |
|
|
Mike Auty
|
105ee08d91
|
Avoid trying to lookup child nodes that have been filtered
Fixes issue1309.
|
2025-12-28 14:09:59 +00:00 |
|
|
ikelosandGitHub
|
a1cab3438e
|
Merge pull request #1849 from volatilityfoundation/issues/issue1848
Windows: Fix pe_symbols type checking
|
2025-12-28 13:48:56 +00:00 |
|
|
ikelosandGitHub
|
3a953262e6
|
Merge pull request #1924 from volatilityfoundation/issues/issue1923
Document the reason for skipping entirely duplicated page tables
|
2025-12-22 09:35:40 +00:00 |
|
|
Mike Auty
|
50f64f66d5
|
Document the reason for skipping entirely duplicated page tables
|
2025-12-16 10:03:37 +00:00 |
|
|
Abyss Watcher
|
0138aec419
|
manually iterate over the pointers to detect OOB locally
|
2025-12-03 17:43:39 +01:00 |
|
|
Abyss Watcher
|
d7103a2214
|
ensure that _parse_sections returns a constant number of None on failure
|
2025-12-03 17:41:58 +01:00 |
|
|
Abyss Watcher
|
89c5fc325a
|
move iterator_guard_value down the parameters list
|
2025-12-03 17:34:25 +01:00 |
|
|
ikelosandGitHub
|
674996ffcd
|
Merge pull request #1921 from Abyss-W4tcher/issue_1920_slow_addrspace_scan
Improve Intel layer's address space scanning
|
2025-12-03 15:36:30 +00:00 |
|
|
Abyss Watcher
|
93d6282817
|
version bump: 2.27.0 -> 2.27.1
|
2025-12-03 11:25:56 +01:00 |
|
|
Abyss Watcher
|
f4e2f1391e
|
refactor use of "invalid_bits" inside _mapping into a dedicated variable
|
2025-12-03 11:22:27 +01:00 |
|
|
Abyss Watcher
|
ae0f0ca440
|
skip invalid blocks more efficiently
|
2025-12-01 15:56:56 +01:00 |
|
|
Abyss Watcher
|
e18b37abf5
|
remove PTEs "large_page" attribute and re-order large_page check
|
2025-12-01 15:54:58 +01:00 |
|
|
ikelosandGitHub
|
493950c634
|
Merge pull request #1902 from Abyss-W4tcher/issue_1889_low_stub_scan_fix
[issue #1889] Fix missing address increment in low stub scanner
|
2025-11-30 22:14:12 +00:00 |
|
|
Abyss Watcher
|
8b132eafd1
|
extend _fix_sym_table's docstring
|
2025-11-24 17:57:37 +01:00 |
|
|
Abyss Watcher
|
32f37ee632
|
remove hasattr check on bin_attribute
|
2025-11-24 17:34:31 +01:00 |
|
|
ikelosandGitHub
|
a17281a214
|
Merge pull request #1868 from Abyss-W4tcher/fix_broken_mount_enum_after_6_13
Linux: Fix broken mount enumeration on 6.13+
|
2025-11-24 09:05:18 +00:00 |
|
|
Abyss Watcher
|
e9ce095b29
|
black formatting
|
2025-11-20 15:57:56 +01:00 |
|
|
Abyss Watcher
|
b8e12bec29
|
move ModuleExtract class in modules.py
|
2025-11-20 15:18:53 +01:00 |
|
|
Abyss Watcher
|
c89c7c3a06
|
rollback to 635237b to prevent circular import
|
2025-11-20 13:20:18 +01:00 |
|
|
Abyss Watcher
|
5d50ad2b2e
|
slight readability adjustment
|
2025-11-20 13:20:18 +01:00 |
|
|
Abyss Watcher
|
c8d90cffe4
|
adjust to the new NULL-terminated processing
|
2025-11-20 13:20:18 +01:00 |
|
|
Abyss Watcher
|
a5cc616d53
|
leverage the existing Array facility
|
2025-11-20 13:20:18 +01:00 |
|
|
Abyss Watcher
|
6e67674c20
|
add section address sanity check
|
2025-11-20 13:20:18 +01:00 |
|
|
Abyss Watcher
|
44969090e7
|
lru_cache get_modules_memory_boundaries()
|
2025-11-20 13:20:06 +01:00 |
|
|
Abyss Watcher
|
b20da9c7f5
|
correct type hinting
|
2025-11-20 13:19:34 +01:00 |
|
|
Abyss Watcher
|
15a8af5c93
|
use dynamically_sized_array_of_pointers in _get_sect_count
|
2025-11-20 13:19:34 +01:00 |
|