 ikelosandGitHub
|
9222f4915a
|
Merge pull request #1371 from volatilityfoundation/issues/use-yara-scanner-over-handling-yara-directly
Fix up vmayarascan and vadyarascan to use yarascan properly
|
2024-12-01 01:26:04 +00:00 |
|
|
Mike Auty
|
d404747de5
|
Tests: Add in vadyarascan tests
|
2024-12-01 00:04:46 +00:00 |
|
|
Mike Auty
|
2dc1686289
|
Windows: Protect the SERICE_RECORD is_valid function a little more
The request to .Order could fail depending on where the structure lies
in memory.
|
2024-11-30 13:36:17 +00:00 |
|
|
Mike Auty
|
56f6ef0add
|
Include a test developed by @gcmoreira and @eve-mem
|
2024-11-30 11:52:16 +00:00 |
|
|
Mike Auty
|
3df385369c
|
Ensure the VAD/VMA gets scanned in a single block
|
2024-11-30 11:28:09 +00:00 |
|
|
ikelosandGitHub
|
ba98b088cb
|
Merge pull request #1369 from gcmoreira/logging_producer_information
Linux/Mac: Log producer metadata information
|
2024-11-29 10:27:32 +00:00 |
|
|
Mike Auty
|
393db1050f
|
Windows: protect again mz_offsets being None
|
2024-11-29 08:51:06 +00:00 |
|
|
Mike Auty
|
0030129ff8
|
Make suggested fixes to reduce loops and ignore insane sections
|
2024-11-29 08:43:04 +00:00 |
|
|
Gustavo Moreira
|
77778ee6f6
|
Linux/Mac: ISF metadata: Rename s/DWARF/POSIX/, as I'm not happy with the generic name. BTF source could potentially generate the same keys
|
2024-11-29 19:35:18 +11:00 |
|
|
Gustavo Moreira
|
b8023f0c97
|
Linux/Mac: Address code review suggestions
- Add getters for Linux/Mac ISF sources
- Avoid using internal attributes
- Use the dict repr instead of walking the dict to simplify code
|
2024-11-29 19:05:27 +11:00 |
|
|
Mike Auty
|
bec6bc6594
|
Fix up vmayarascan and vadyarascan to use yarascan properly
|
2024-11-28 16:59:52 +00:00 |
|
|
Mike Auty
|
3748cb89b8
|
Windows: Improve debugging output for pdbscan
|
2024-11-28 10:22:49 +00:00 |
|
|
Gustavo Moreira
|
8ecd7e2ddd
|
Linux/Mac: Log producer information
|
2024-11-28 15:17:22 +11:00 |
|
|
Gustavo Moreira
|
aaeec80fdf
|
linux: library_list testcase: Optimize testing performance by limiting the number of processes to just one. This change will reduce execution time and speed up the test
|
2024-11-28 13:53:11 +11:00 |
|
|
Gustavo Moreira
|
9048cd1ab8
|
linux: boottime: Minor, removed unnecessary blank line
|
2024-11-28 13:47:03 +11:00 |
|
|
Gustavo Moreira
|
fb4ab9d477
|
linux: test cases: remove unused variables
|
2024-11-28 13:45:26 +11:00 |
|
|
Gustavo Moreira
|
63ac0abe64
|
linux: Add 15 new test cases for plugins dependent on pslist
|
2024-11-28 13:25:08 +11:00 |
|
|
Gustavo Moreira
|
fa06064635
|
linux plugins: Update pslist major version and its 18 dependent plugins
|
2024-11-28 13:16:33 +11:00 |
|
|
Gustavo Moreira
|
97534f02de
|
linux: sockstat: It should import and verify the pslist version directly, instead of relying on lsof
|
2024-11-28 12:19:56 +11:00 |
|
|
Gustavo Moreira
|
7c559c53f4
|
test_cases: underscore unused variables
|
2024-11-28 12:11:14 +11:00 |
|
|
ikelosandGitHub
|
0233193c9d
|
Merge pull request #1335 from gcmoreira/linux_prot_none_L1TF_and_layer_addr_translation_fixes
Linux - PROT_NONE, L1TF mitigation and layer address translation fix
|
2024-11-27 10:31:18 +00:00 |
|
|
Gustavo Moreira
|
eff2a529c8
|
Linux: intel: Remove the bitwise zero complement to simplify the protnone mask calculation
|
2024-11-27 18:10:14 +11:00 |
|
|
Gustavo Moreira
|
641e008caf
|
Linux: intel: The non-present mapping shouldn't be inverted
|
2024-11-27 15:06:33 +11:00 |
|
|
ikelosandGitHub
|
bdd3e1e48e
|
Merge pull request #1365 from volatilityfoundation/issues/pr1343
CLI: Partial changes by @lesander contributed in #1343
|
2024-11-24 09:58:04 +00:00 |
|
|
Mike Auty
|
523a6e92fc
|
CLI: Apply black to recent changes
|
2024-11-24 09:33:30 +00:00 |
|
|
lesanderandMike Auty
|
1a0d1a238d
|
CLI: Partial changes by @lesander contributed in #1343
|
2024-11-24 09:31:26 +00:00 |
|
|
ikelosandGitHub
|
47baec8bba
|
Merge pull request #1363 from volatilityfoundation/issues/fix-linuxstacker-to-use-cache-interface
Core: Add in generic cache-manager chooser function
|
2024-11-24 09:19:02 +00:00 |
|
|
ikelosandGitHub
|
15f2011eed
|
Merge pull request #1342 from lesander/improvement/remove-requirements-and-setup
Update pyproject.toml and remove requirements and setup files
|
2024-11-23 18:58:21 +00:00 |
|
|
Mike Auty
|
4bc6e1001d
|
Windows: Improve logging of slowscan to show possible PDB entries
|
2024-11-22 19:45:15 +00:00 |
|
|
ikelosandGitHub
|
4c55c0fe43
|
Merge pull request #1353 from eve-mem/regex_plugins
Add first version of regex scanning plugins
|
2024-11-22 12:26:34 +00:00 |
|
|
Mike Auty
|
76ecfc0883
|
Core: Add in generic cache-manager chooser function
|
2024-11-22 12:16:14 +00:00 |
|
|
Gustavo Moreira
|
bbd2f9bc37
|
linux: intel VMCoreInfo: Fix bug introduced in last commit reverting the layer metadata dict
|
2024-11-22 22:40:53 +11:00 |
|
|
ikelosandGitHub
|
fb101de6fc
|
Merge pull request #1362 from c0rydoras/fix/cache-dir
Follow XDG Base Directory Specification for cache directory
|
2024-11-22 11:32:57 +00:00 |
|
|
Arthur Deierlein
|
a2b96c0dc0
|
fix: dont use / for compat
|
2024-11-22 11:46:59 +01:00 |
|
|
Arthur Deierlein
|
b93d5b7c13
|
update docs
|
2024-11-22 11:23:56 +01:00 |
|
|
Arthur Deierlein
|
1abb4cc881
|
comply with xdg base directory spec by using XDG_CACHE_HOME if its set
|
2024-11-22 11:13:21 +01:00 |
|
|
Gustavo Moreira
|
41d2e924d1
|
linux: intel VMCoreInfo: Revert changes associated with adding vmcoreinfo dict to the layer metadata
|
2024-11-20 11:47:37 +11:00 |
|
|
Gustavo Moreira
|
9f6d194980
|
linux: intel VMCoreInfo: The _direct_metadata class attribute needs to be modified; otherwise, it will only exist within the instance namespace.
|
2024-11-19 12:47:56 +11:00 |
|
|
Gustavo Moreira
|
96f5fdae2f
|
linux: intel VMCoreInfo: Add the vmcoreinfo to the layer metadata
|
2024-11-19 11:25:52 +11:00 |
|
|
ikelosandGitHub
|
ac482e3e13
|
Merge pull request #1359 from eve-mem/windows_svcscan_remove_yara_dep
Windows: Remove dep on vadyarascan from svcscan plugin
|
2024-11-18 22:29:15 +00:00 |
|
|
eve
|
1ba5b04b7d
|
Windows: Remove dep on vadyarascan from svcscan plugin
|
2024-11-18 21:20:04 +00:00 |
|
|
eve
|
e374ca9647
|
Windows.vadregexscan: update imports, revert vadyarascan changes
|
2024-11-18 21:15:06 +00:00 |
|
|
eve
|
07701fc4cf
|
windows.vadregexscan: remove dependency on vadyarascan
|
2024-11-18 18:32:51 +00:00 |
|
|
Gustavo Moreira
|
13729ac25f
|
linux: VMCoreInfo API: AARCH64 uses NUMBER() with hex values. Fortunately, includes the 0x prefix, allowing the parser to still handle these cases correctly
|
2024-11-18 18:18:14 +11:00 |
|
|
Gustavo Moreira
|
d80ef55325
|
linux: intel VMCoreInfo: Select the fastest scanner for each scenario
|
2024-11-18 17:49:30 +11:00 |
|
|
eve
|
6d366f16ee
|
Windows.vadregexscan: update imports
|
2024-11-18 06:38:06 +00:00 |
|
|
Gustavo Moreira
|
f2a2f8aa67
|
linux: intel VMCoreInfo: immediately abort processing the current VMCOREINFO if DTB is not found
|
2024-11-18 17:00:00 +11:00 |
|
|
Gustavo Moreira
|
4a88a7450b
|
linux: VMCoreInfo API: Integrate support for value parsing within the VMCoreInfo API
|
2024-11-18 16:47:45 +11:00 |
|
|
Gustavo Moreira
|
4c0ddca796
|
linux: intel VMCoreInfo: BugFix. Return layer if both values are present
|
2024-11-18 15:20:38 +11:00 |
|
|
Abyss Watcher
|
f192437a94
|
typo
|
2024-11-15 17:11:11 +01:00 |
|