David McDonald
e622acc7f8
Minor version bump: registry extensions API addition
2024-10-07 13:20:50 -05:00
David McDonald
e46d24397d
Code review fixes
2024-10-07 13:20:50 -05:00
David McDonald
f3f5784c71
Remove unused method
2024-10-07 13:17:24 -05:00
David McDonald
0bfac049de
Windows: Adds Amcache plugin
2024-10-07 13:17:24 -05:00
Dave Lassalle
1c3e5574f4
#816 - remove unused import
2024-10-07 12:39:58 -05:00
Dave Lassalle
95f56ad122
#816 - remove extra text from buffer output
2024-10-07 12:39:03 -05:00
Dave Lassalle
0dd082b7fd
#816 initial PR comment fixes
2024-10-07 12:26:17 -05:00
MHL
cb98a085d7
refs #1296 sort volshell methods alphabetically in hh() output
2024-10-07 09:11:49 -05:00
Gustavo Moreira
ee75964345
Linux: lsof plugin: Fix typo in docstring
2024-10-07 20:46:44 +11:00
Gustavo Moreira
2859d7a641
Linux: lsof plugin: Fix list_fds() return typing
2024-10-07 18:49:38 +11:00
Gustavo Moreira
bf19b9f2e0
Linux: lsof plugin: Fix dataclasses import to stick to the style guide
2024-10-07 18:46:18 +11:00
ikelos and GitHub
9477d16f1b
Merge pull request #1295 from eve-mem/linux_docs_lime_warning
...
Docs: Add warning around LiME raw format
2024-10-07 08:17:45 +01:00
Gustavo Moreira
bf02723695
Linux: lsof plugin: Fix module import to stick to the style guide
2024-10-07 17:59:55 +11:00
eve
5d072864d7
Docs: Add warning around LiME raw format
2024-10-07 07:00:44 +01:00
ikelos and GitHub
c13c76c745
Merge pull request #1274 from volatilityfoundation/issues/issue1119
...
Ensure the class for Modules is stored in the configruation
2024-10-06 20:13:04 +01:00
ikelos and GitHub
4149c551a9
Merge pull request #1293 from volatilityfoundation/1292-dumpfiles-uses-incorrect-sector-size-for-datasectionobject
...
#1292 - use correct sector size for DataSectionObject file dumping
2024-10-06 19:03:46 +01:00
ikelos and GitHub
9bda20df34
Merge pull request #1279 from dgmcdona/dgmcdona/linux-sockstat-pytest
...
Linux: Sockstat - adds pytest
2024-10-06 18:17:45 +01:00
ikelos and GitHub
c2feeecee3
Merge pull request #1259 from gcmoreira/linux_pagecache_pointer_verification_improvements
...
Linux Page Cache smear memory protection improvements
2024-10-06 18:07:48 +01:00
ikelos and GitHub
cd979804e0
Merge pull request #1285 from gcmoreira/remote_isf_url
...
Add --remote-isf-url argument to be able to use a remote ISF server from the command-line arguments
2024-10-06 16:57:02 +01:00
ikelos and GitHub
c67f2e51c1
Merge pull request #1284 from gcmoreira/fix_all_any_misuses
...
Fix misuse of all() and any() functions across the codebase
2024-10-06 16:41:51 +01:00
Dave Lassalle
bb5a447502
#1292 - use correct sector size for DataSectionObject file dumping
2024-10-05 09:58:01 -05:00
Gustavo Moreira
cffad872bb
Linux: sockstat. Fix #1271 which unnecessarily extends the interface of the list_sockets() class method
2024-10-04 12:22:53 +10:00
Gustavo Moreira
d7d84b4c7f
Merge branch 'develop' into linux_lsof_refactoring_fixes_and_improvements
2024-10-04 12:08:10 +10:00
Gustavo Moreira
f455c30e49
Linux: hidden_modules: remove missed optional heuristic_mode argument
2024-10-04 09:51:08 +10:00
Gustavo Moreira
b5948d7ec0
Linux: hidden_modules: Add @Abyss-W4tcher suggestion to optimize the fast scan method for even better performance, using the mkobj.mod self referential validation used in module.is_valid() as pre-filter
...
Removed the --heuristic-mode and the module.states validation, since the self referential check is enough by itself
2024-10-04 07:48:25 +10:00
David McDonald
e605bee411
Windows: unloadedmodules bugfix
...
This fixes a bug in the `windows.unloadedmodules` plugin. An
`InvalidAddressException` can be raised when parsing the module name;
this adds a try/except block to replace the missing module name with a
`renderers.UnreadableValue` when the exception occurs.
2024-10-03 11:52:29 -05:00
David McDonald
4ac9b0825a
Linux: Properly get paths in simple_dname paths
...
Some dentry paths were not being recovered from `simple_dname` paths,
this fixes the issue by properly dereferencing the string pointer.
2024-10-03 10:59:59 -05:00
Gustavo Moreira
e8754fadbd
Fix typo in usage help
2024-10-03 15:50:30 +10:00
Gustavo Moreira
8d925bd8ad
Added the --heuristic-mode option, which relaxes constraints to improve detection of more advanced threats
2024-10-03 15:17:02 +10:00
Gustavo Moreira
590aa9c19c
Make it callable from other plugins.
...
Additionally, classmethod helpers were added, and docstrings were enhanced for improved usability and clarity.
2024-10-03 14:50:39 +10:00
Gustavo Moreira
57b5aabdfe
Add linux.ptrace plugin to enumerate tracer and tracee tasks
2024-10-03 11:50:03 +10:00
Gustavo Moreira
a64813be43
Added metavar and single letter argument to the --remote-isf-url
2024-10-02 13:08:05 +10:00
Gustavo Moreira
a63e9f1699
Add --remote-isf-url argument to be able mutually exclusive to --offline
2024-10-02 13:00:45 +10:00
Gustavo Moreira
c18818aa8d
Fix misuse of all() and any() functions across the codebase
2024-10-02 10:38:01 +10:00
Gustavo Moreira
d5e6e7c203
Allow any module state value in both traditional and fast scan methods
2024-10-02 09:43:27 +10:00
ikelos and GitHub
72abb419cc
Merge pull request #1281 from eve-mem/linux_malfind_32bit_arch_detection
...
Linux: Update malfind plugin to use symbols.symbol_table_is_64bit when determining if a 32bit OS is detected in the sample
2024-10-02 00:07:20 +01:00
Mike Auty
950ab3e201
Add in additional microarchitectures for vmscan
2024-10-01 19:47:19 +01:00
Dave Lassalle
ece2dbe9a7
#816 formatting fixes
2024-10-01 13:00:15 -05:00
David McDonald
c0672f6c4b
Linux: Sockstat - adds pytest
...
This adds a pytest for the `linux.sockstat.Sockstat` plugin.
2024-10-01 10:02:25 -05:00
Gustavo Moreira
5dee3aeeee
Add linux.hidden_modules plugin
2024-10-01 19:30:50 +10:00
eve
ba351f511d
Linux: Update malfind plugin to use symbols.symbol_table_is_64bit when determining if a 32bit OS is detected in the sample
2024-10-01 06:36:56 +01:00
Gustavo Moreira
6cd39c04c1
Refactor of module object. Adding function helpers to simplify the control of exceptions and errors and consolidate everything on them.
2024-10-01 12:08:22 +10:00
ikelos and GitHub
5d2a5f94d4
Merge pull request #1276 from dgmcdona/dgmcdona/windows-callbacks-validity-check
...
Windows: Callbacks - fixes bad callback validity check
2024-10-01 00:42:29 +01:00
ikelos and GitHub
c37d9eed1f
Merge pull request #1278 from dgmcdona/dgmcdona/linux-sockstat-version-bump-fix
...
Linux: Sockstat - fix incorrect version bump
2024-10-01 00:34:14 +01:00
David McDonald
db55f23070
Windows: Callbacks - fix breaking API change
...
Moves as much of the `is_parseable` check as possible back into an
`is_valid` method to avoid breaking API changes.
2024-09-30 17:03:12 -05:00
David McDonald
806f78d372
Linux: Sockstat - fix incorrect version bump
...
I erred when I bumped the version as a part of !1271 - The `SockHandlers`
class got the major version bump, not `Sockstat`. This reverts the
`SockHandlers` version bump and applies it to `Sockstat` instead.
2024-09-30 15:27:03 -05:00
David McDonald
8ad592a490
Windows: Fixes bad callback validity check
...
This fixes a bug in the callbacks plugin which causes it to miss
`IoRegisterShutdownNotification` callbacks on x86b samples. The
`header.NameInfo.Name` field was being incorrectly treated as the device
type. This fixes the issue by updating the `is_valid` method on the
`_SHUTDOWN_PACKET` extension type to take a `type_map` parameter, and
updates the method to correctly validate the object type.
2024-09-30 14:56:40 -05:00
ikelos and GitHub
495f3a92d4
Merge pull request #1277 from dgmcdona/dgmcdona/windows-netscan-missing-connections
...
Windows: Netscan - fix missing TCP connections
2024-09-30 20:51:28 +01:00
David McDonald
d9dc28d0b5
Windows: fix missing TCP connections
...
This fixes some missing TCP connections in Windows 10 20348 by adding
a scan constraint for `TTcb` pool tags.
2024-09-30 13:03:02 -05:00
ikelos and GitHub
5a6958befa
Merge pull request #1273 from dgmcdona/dgmcdona/windows-psxview-win10-bugfix
...
Windows: psxview win10 bugfix
2024-09-29 23:42:04 +01:00
David McDonald