WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-10-01 05:54:58 +02:00
Code Issues Packages Projects Releases Wiki Activity
6,545 Commits 80 Branches 18 Tags
develop
Commit Graph
6545 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
David McDonald 49dc89c30c Windows: psxview Win10+ fix 
The current implementation of this plugin does not incorporate the
cookie on Win10+ systems, causing it to fail. This commit fixes that
issue, and also contributes a performance improvement by extracting the
call to `handles_plugin.get_type_map()` from the loop. Also replaces
for-loop with list comprehension for clarity.
 2024-09-29 14:02:04 -05:00
Mike Auty d38a69fd5c Ensure the class for Modules is stored in the configruation 2024-09-29 19:49:21 +01:00
David McDonald 3ebee83d05 Windows: psxview cleanup 
Replaced this series of statements with a single invocation of the `all`
builtin for brevity and conciseness.
 2024-09-27 17:36:50 -05:00
David McDonald 4b0ece0fc9 Windows: psxview module type-hints and cleanup 
Adds type-hints to methods throughout the psxview module.
 2024-09-27 17:36:50 -05:00
David McDonald f1200c85b7 Windows: PsList type-hint cleanup 
It's more appropriate to use `Iterator` than `Iterable` as a return type
here. Also updates the `Iterator` item type to be `EPROCESS` instead of
just `ObjectInterface`.
 2024-09-27 17:36:50 -05:00
Dave Lassalle bd678eaf80 #816 - fix cmdscan 2024-09-27 16:07:44 -05:00
Dave Lassalle 9d98ab9b65 #816 - black fixes 2024-09-27 10:39:57 -05:00
Dave Lassalle 48d4048b48 #816 - fixes and additional windows versions 2024-09-27 10:02:36 -05:00
EveandGitHub 8a3f6eee1a Merge branch 'volatilityfoundation:develop' into linux_sockscan 2024-09-27 10:35:18 +01:00
Dave Lassalle 5302e964b8 Merge branch 'develop' into 816-port-cmdscan-and-console-plugins-from-vol2-to-vol3-please 2024-09-26 17:50:46 -05:00
ikelosandGitHub 055f2e7d9b Merge pull request #1264 from gcmoreira/linux_lsof_namespace_dentry_name 
Linux lsof: Add namespace dentry name
 2024-09-26 00:24:51 +01:00
ikelosandGitHub e0942182c8 Merge pull request #1271 from dgmcdona/dgmcdona/linux-sockstat-procnames 
Linux: Update sockstat to render process names
 2024-09-25 23:57:30 +01:00
David McDonald 7f37135739 Linux: Update sockstat to render process names 
Currently, process names are not displayed for sockets in the sockstat
plugin, making analysis more painful than it needs to be. This updates
the `list_sockets` classmethod and the `generator` method to return the
process name in addition to the PID.

Because this is changing the public interface, this commit includes a
major version bump for `linux.sockstat.Sockstat`.
 2024-09-25 17:34:54 -05:00
ikelosandGitHub 714e987679 Merge pull request #1270 from eve-mem/windows_vadyarascan_sanity_check_warnings 
Windows: change warnings around large memory maps to debug level as per issue #1256
 2024-09-25 23:26:30 +01:00
eve 09fa859a92 Windows: change warnings around large memory maps to debug level as per issue #1256 2024-09-25 09:02:51 +01:00
ikelosandGitHub 67f8265def Merge pull request #1261 from gcmoreira/linux_checkcreds_pointer_verification_improvements 
Linux checkcreds pointer verification improvements
 2024-09-22 15:12:46 +01:00
ikelosandGitHub bb6ab45363 Merge pull request #1268 from gcmoreira/fix_constants_imports 
Fix changes introduced to volatility3.framework.constants in PRs #838
 2024-09-18 14:55:20 +01:00
Gustavo Moreira f77003b670 Fix changes introduced to volatility3.framework.constants in PRs #838 and #1247 2024-09-18 12:50:58 +10:00
Mike Auty 10ac21da2c Windows: Remove the unnecessary requirement on verinfo 
Fixes #1267
 2024-09-16 12:16:49 +01:00
ikelosandGitHub 48a770ae8a Merge pull request #1250 from volatilityfoundation/pe_symbols_new 
Add new pe_symbols API, debug registers plugin, unhooked system calls…
 2024-09-16 09:28:09 +01:00
Andrew Case b788733683 More comments on unhooked system calls 2024-09-15 19:48:55 -05:00
ikelosandGitHub b5b9372d16 Merge pull request #1266 from Abyss-W4tcher/set_default_req_value 
[configuration.py] use default req value in config_value call
 2024-09-16 00:34:10 +01:00
Andrew Case 79b8ff7d05 Address final feedback 2024-09-15 18:29:05 -05:00
ikelosandGitHub 5525ce5b9b Merge pull request #1260 from gcmoreira/linux_pidhashtable_plugin_pointer_verification_improvements 
Linux pidhashtable plugin pointer verification improvements
 2024-09-15 20:33:48 +01:00
ikelosandGitHub 6c5b838733 Merge pull request #1258 from gcmoreira/timeliner_plugin_improvements 
Timeliner plugin `plugin-filter` improvements
 2024-09-15 13:57:34 +01:00
Andrew Case 322f79fb50 Bail as early as possible 2024-09-14 17:18:26 -05:00
Andrew Case 291bc878ad Break in a cleaner flow 2024-09-14 16:31:33 -05:00
Andrew Case 21d21cf4b8 Break properly in all paths. Help callers to ensure always lower case module name matching. 2024-09-14 16:26:38 -05:00
Andrew Case ba0c975e73 Address all feedback 2024-09-13 18:50:47 -05:00
Abyss Watcher 67ee382c32 use default req value in config_value call 2024-09-13 18:53:33 +02:00
Gustavo Moreira cd2af74e6d Improve pointers address verification and return message chain 2024-09-13 17:58:21 +10:00
Gustavo Moreira 997abeda6d Linux lsof: Add namespace dentry name 2024-09-13 17:27:02 +10:00
Gustavo Moreira e084086ee5 Improve pointer verification in super_block->get_type() 2024-09-13 16:18:26 +10:00
Gustavo Moreira 32eaeeb7d2 Fix typing typo 2024-09-13 16:13:00 +10:00
Gustavo Moreira aecd31f095 Add missing pointer verification 2024-09-13 16:09:49 +10:00
Gustavo Moreira 867c8e3f1b Linux: Add support for threads in both lsof and sockstat plugins. 
- lsof plugin: source code refactored
- lsof plugin: Added the 'device' column to complete the inode information. An inode number is specific to the filesystem/device it belongs to.
- lsof/sockstat plugins: Add threads support. Threads may or may not share the file descriptor table with the thread group leader, depending on whether the CLONE_FILES flag is included in the clone() syscall. Also, once started, a thread can unshare the fd table with its parent. Refer to the unshare() libc syscall wrapper man page, unshare(2). Additionally, note that the Linux lsof command in user space includes thread listings by default as well. Now, there are two columns to identify the thread group ID  (PID) and the task/thread ID (TID).
- Added inode getters from both, the dentry and file structs. From kernels +3.9 the file struct cached the inode pointer. So, when possible, we get this value.
- Improve smear protection in these plugins and various APIs (https://github.com/volatilityfoundation/volatility3/pull/1243)
 2024-09-13 15:33:19 +10:00
Gustavo Moreira 48ae43d64e Bumping the major version since the output changed 2024-09-12 17:22:52 +10:00
Gustavo Moreira 7b2e259c6d fix wrong variable names 2024-09-12 17:06:29 +10:00
Gustavo Moreira ebb9f0c201 Fix typo in timeliner function 2024-09-12 17:05:45 +10:00
Gustavo Moreira a7dcd6d9e8 Minor: Add comment on TimeLinerInterface subclass filter 2024-09-12 16:19:13 +10:00
Gustavo Moreira be05ace29b Timeliner plugin: Add exception information 2024-09-12 16:06:40 +10:00
Gustavo Moreira 57de357ffd Timeliner plugin: Fix issue with filtering TimeLinerInterface plugins and using the filter argument 2024-09-12 16:05:40 +10:00
Gustavo Moreira 9e8471799a Improving code and adding the credential virtual addresses to the output. 2024-09-12 10:44:43 +10:00
Gustavo Moreira c77c662b70 Linux pidhashtable plugin pointer verification improvements 2024-09-11 21:09:08 +10:00
Gustavo Moreira 037eb1ce03 Linux Check_creds plugins pointer verification improvements 2024-09-11 16:30:41 +10:00
Gustavo Moreira c86d973329 Linux page cache plugins pointer verification improvements 2024-09-11 15:54:17 +10:00
ikelosandGitHub e76d51251b Merge pull request #1253 from volatilityfoundation/issues/issue1252 
CLI: Filter on rendered values
 2024-09-10 23:26:50 +01:00
ikelosandGitHub d238c59134 Merge pull request #1254 from volatilityfoundation/issues/plugin-requirement-recursion 
Core: Verify plugin requirements of plugins
 2024-09-10 23:26:27 +01:00
ikelosandGitHub 7d75c172f1 Merge pull request #1198 from volatilityfoundation/issues/issue1195 
Linux: Update vmayarascan to scan complete VMA blocks
 2024-09-10 22:02:14 +01:00
ikelosandGitHub f30cf39449 Merge branch 'develop' into issues/issue1195 2024-09-10 21:40:08 +01:00