WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-30 13:34:53 +02:00
Code Issues Packages Projects Releases Wiki Activity
6,545 Commits 80 Branches 18 Tags
develop
Commit Graph
6545 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Gustavo Moreira bee3f001b6 linux: netfilter plugin: Enhance docstring to provide a clearer explanation of 'hooked' 2024-11-15 11:31:30 +11:00
ikelosandGitHub 8e355c0eaf Merge pull request #1350 from eve-mem/volshell_display_default_constant 
Volshell: Make the default number of bytes returned by db, dw, dd, dq, rx, and dis use a constant
 2024-11-14 17:51:55 +00:00
eve 357d8a914b Volshell: Make the default number of bytes returned by db, dw, dd, dq, rx, and dis use the constant DEFAULT_NUM_DISPLAY_BYTES 2024-11-14 10:55:41 +00:00
Gustavo Moreira 41a93473e9 linux: intel VMCoreInfo: Improve layer config code 2024-11-14 19:35:47 +11:00
Gustavo Moreira 00b528aafe linux: intel VMCoreInfo: Fix docstring typo 2024-11-14 18:57:26 +11:00
Gustavo Moreira 5ab97564ac linux: intel VMCoreInfo: Move to its own stacker... 
Maximize use of VMCOREINFO data without reliance on ISF symbols:
- Obtain the DTB
- Utilize OSRELEASE (the same as UTS_RELEASE used in the Linux banner and init_uts_ns/new_utsname) to prefilter the list of Linux banners, reducing search time for linux_banner in memory.
- Find the correct layer using the VMCOREINFO data (including 32bit PAE).
 2024-11-14 16:37:05 +11:00
ikelosandGitHub fe91feac5e Merge pull request #1347 from eve-mem/regex_scan 
Volshell: add regex_scan
 2024-11-13 23:49:30 +00:00
eve af7a420cdc Volshell: rename regex_scan short hand to rx so that it does not clash with the built in python re module 2024-11-13 08:56:58 +00:00
Gustavo Moreira 173e35105a LinuxMixin: Make new methods internal 2024-11-13 12:30:11 +11:00
Gustavo Moreira 36c19aa6d9 core: Bump framework minor version 2024-11-13 12:21:03 +11:00
Gustavo Moreira 05e8f8ff10 intel layer: Move constants to the Intel class 2024-11-13 12:20:03 +11:00
ikelosandGitHub d2ae43c6d8 Merge pull request #1346 from gcmoreira/linux_misc_fixes 
Linux - miscellaneous fixes
 2024-11-12 23:09:21 +00:00
ikelosandGitHub 340bd6d7c0 Merge pull request #1348 from gcmoreira/linux_kthreads_plugin 
Linux: Add kthreads plugin to enumerate kernel threads start address
 2024-11-12 23:03:41 +00:00
Gustavo Moreira 787e15ac2b Linux: kthreads plugin: Add missing requirements 2024-11-13 09:50:08 +11:00
Gustavo Moreira 8efe429719 Linux: kthreads plugin: Adjust required framework version 2024-11-12 18:32:26 +11:00
eve 780f9ab6f5 Volshell: add regex_scan 2024-11-12 07:22:45 +00:00
Gustavo Moreira d90019657c Linux: Add kthreads plugin to enumerate kernel thread functions 2024-11-12 18:14:36 +11:00
Gustavo Moreira 3a734fdeb1 Linux: Object extensions: Remove redundant log message header; the logger handles this formatting. If needed, we can adjust the logger's format instead 2024-11-12 16:23:33 +11:00
Gustavo Moreira a2e99b2633 Linux: Object extensions: Fix type annotations for improved clarity and accuracy. 2024-11-12 16:13:50 +11:00
Gustavo Moreira 3216700d8b Linux: module object extension: Fix recursion call issue 2024-11-12 16:05:59 +11:00
Gustavo Moreira 106b3b3dd0 Linux: PageCache: Fix inode offset when logging an error 2024-11-12 16:01:04 +11:00
Abyss Watcher dd3542b127 explicit loop iterator 2024-11-08 17:51:48 +01:00
Abyss Watcher 485ef894e1 remove taints_value overload attr 2024-11-08 17:49:08 +01:00
Abyss Watcher 8f33aaf5b4 Optional type hints 2024-11-08 17:45:53 +01:00
lesander b739f8d067 revert 3.8 to 3.9 soft bump 2024-11-08 14:05:54 +01:00
lesander a04c04c4e3 fix ci 2024-11-08 14:03:08 +01:00
lesander 1fd5177260 move dependency definitions to pyproject.toml and bump minimal cpython version to 3.9.0 since 3.8.0 is EOL. 2024-11-08 12:31:59 +01:00
ikelosandGitHub 1e871af064 Merge pull request #1339 from volatilityfoundation/issues/issue1336 
Core: Limit capstone to compatible versions
 2024-11-08 11:23:41 +00:00
ikelosandGitHub 36c0b33bef Merge pull request #1341 from joren485/fix-typo-suspicious-threads 
Fix typo in SuspiciousThreads
 2024-11-08 10:15:45 +00:00
ikelosandGitHub eb5534dee4 Merge pull request #1340 from joren485/print-plugin-description 
Print plugin description on plugin --help
 2024-11-08 10:12:48 +00:00
Joren Vrancken b37ba26dd6 Fix typo in SuspiciousThreads 2024-11-08 10:19:05 +01:00
Joren Vrancken 74cf394ad0 Print plugin description on plugin --help 2024-11-08 10:06:59 +01:00
ikelosandGitHub 70188b0190 Merge pull request #1317 from gcmoreira/linux_boottime_support 
Linux - Boottime support
 2024-11-08 07:52:30 +00:00
ikelosandGitHub 932ea7f44a Merge pull request #1337 from joren485/update-amcache-description 
Improve windows.amcache plugin description
 2024-11-07 23:38:15 +00:00
Mike Auty 6494260d91 Core: Limit capstone to compatible versions 2024-11-07 23:34:30 +00:00
Abyss Watcher c725903735 introduce scatter-gather scatterlists 2024-11-07 18:08:58 +01:00
Joren Vrancken 20317e0d13 Improve windows.amcache plugin description 2024-11-07 18:05:36 +01:00
ikelosandGitHub efa4959517 Merge pull request #1300 from Abyss-W4tcher/dirty_ioc_windows_malfind 
[plugin] Add dirty state IoC detection to malfind
 2024-11-07 13:44:56 +00:00
Abyss Watcher a5253ac276 re-trigger black 2024-11-07 13:40:18 +01:00
Gustavo Moreira 73d4f2fc88 Linux: Add support for PROT_NONE, Intel Side Channel Vulnerability L1TF changes and fix _maxphyaddr in x86-64 2024-11-07 20:31:20 +11:00
Gustavo Moreira 9ae7c2bb10 Data layer interface: Convert address_mask to a cached property 2024-11-07 20:28:21 +11:00
Gustavo Moreira 0ad8054f12 intel layer: minor improve lru_cache argument 2024-11-07 20:26:26 +11:00
ikelosandGitHub 130d1188e8 Merge pull request #1307 from dgmcdona/dgmcdona/windows-scheduled-tasks 
Windows: Adds scheduled tasks plugin
 2024-11-06 22:58:25 +00:00
Gustavo MoreiraandGitHub f05a1691b6 Merge branch 'develop' into linux_boottime_support 2024-11-05 06:05:50 -03:00
Gustavo Moreira c0fa2cfcd6 Linux: Boottime API: User linux_constanst import 2024-11-05 20:02:55 +11:00
Gustavo Moreira 2efb4e7d28 Merge branch 'develop' into linux_boottime_support 2024-11-05 19:56:15 +11:00
Gustavo Moreira 6610779e5c linux: VMCoreInfo: Remove debug comment 2024-11-04 19:30:30 +11:00
Gustavo Moreira b4b7834276 linux: K/ASLR via VMCoreInfo 2024-11-04 17:47:57 +11:00
Gustavo Moreira 512c1abe80 linux: VMCoreInfo plugin: Add VMCoreInfo API and its respective plugin 2024-11-04 17:45:56 +11:00
Abyss Watcher b209ea36a2 remove slashes in columns 2024-11-01 15:12:52 +01:00