WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 21:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,528 Commits 80 Branches 17 Tags
development/plugin_module_stubs
Commit Graph
5528 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Abyss Watcher a7620cd6f6 linux fbdev subsystem api plugin 2024-11-15 17:09:21 +01:00
Abyss Watcher 36a18f405b fourcc code converter helper 2024-11-15 17:05:23 +01:00
Abyss Watcher 9f145ddcf0 pillow dependency 2024-11-15 17:04:33 +01:00
eve aa93b57f0d Fix windows.vadregexscan sections 2024-11-15 13:15:40 +00:00
eve c2058e744b Fix missing type imports for regex plugins 2024-11-15 13:12:03 +00:00
eve b802b16c62 Add first version of regex scanning plugins 2024-11-15 13:03:36 +00:00
ikelosandGitHub 8790814d54 Merge pull request #1323 from gcmoreira/linux_netfilter_fix_hooked 
Linux: netfilter plugin: Fix hooked field to match Volatility2 output
 2024-11-15 09:11:23 +00:00
Gustavo Moreira c909fdd4e7 linux: netfilter plugin: Bump minor version 2024-11-15 11:53:05 +11:00
Gustavo Moreira bee3f001b6 linux: netfilter plugin: Enhance docstring to provide a clearer explanation of 'hooked' 2024-11-15 11:31:30 +11:00
ikelosandGitHub 8e355c0eaf Merge pull request #1350 from eve-mem/volshell_display_default_constant 
Volshell: Make the default number of bytes returned by db, dw, dd, dq, rx, and dis use a constant
 2024-11-14 17:51:55 +00:00
eve 357d8a914b Volshell: Make the default number of bytes returned by db, dw, dd, dq, rx, and dis use the constant DEFAULT_NUM_DISPLAY_BYTES 2024-11-14 10:55:41 +00:00
Gustavo Moreira 41a93473e9 linux: intel VMCoreInfo: Improve layer config code 2024-11-14 19:35:47 +11:00
Gustavo Moreira 00b528aafe linux: intel VMCoreInfo: Fix docstring typo 2024-11-14 18:57:26 +11:00
Gustavo Moreira 5ab97564ac linux: intel VMCoreInfo: Move to its own stacker... 
Maximize use of VMCOREINFO data without reliance on ISF symbols:
- Obtain the DTB
- Utilize OSRELEASE (the same as UTS_RELEASE used in the Linux banner and init_uts_ns/new_utsname) to prefilter the list of Linux banners, reducing search time for linux_banner in memory.
- Find the correct layer using the VMCOREINFO data (including 32bit PAE).
 2024-11-14 16:37:05 +11:00
ikelosandGitHub fe91feac5e Merge pull request #1347 from eve-mem/regex_scan 
Volshell: add regex_scan
 2024-11-13 23:49:30 +00:00
eve af7a420cdc Volshell: rename regex_scan short hand to rx so that it does not clash with the built in python re module 2024-11-13 08:56:58 +00:00
Gustavo Moreira 173e35105a LinuxMixin: Make new methods internal 2024-11-13 12:30:11 +11:00
Gustavo Moreira 36c19aa6d9 core: Bump framework minor version 2024-11-13 12:21:03 +11:00
Gustavo Moreira 05e8f8ff10 intel layer: Move constants to the Intel class 2024-11-13 12:20:03 +11:00
ikelosandGitHub d2ae43c6d8 Merge pull request #1346 from gcmoreira/linux_misc_fixes 
Linux - miscellaneous fixes
 2024-11-12 23:09:21 +00:00
ikelosandGitHub 340bd6d7c0 Merge pull request #1348 from gcmoreira/linux_kthreads_plugin 
Linux: Add kthreads plugin to enumerate kernel threads start address
 2024-11-12 23:03:41 +00:00
Gustavo Moreira 787e15ac2b Linux: kthreads plugin: Add missing requirements 2024-11-13 09:50:08 +11:00
Gustavo Moreira 8efe429719 Linux: kthreads plugin: Adjust required framework version 2024-11-12 18:32:26 +11:00
eve 780f9ab6f5 Volshell: add regex_scan 2024-11-12 07:22:45 +00:00
Gustavo Moreira d90019657c Linux: Add kthreads plugin to enumerate kernel thread functions 2024-11-12 18:14:36 +11:00
Gustavo Moreira 3a734fdeb1 Linux: Object extensions: Remove redundant log message header; the logger handles this formatting. If needed, we can adjust the logger's format instead 2024-11-12 16:23:33 +11:00
Gustavo Moreira a2e99b2633 Linux: Object extensions: Fix type annotations for improved clarity and accuracy. 2024-11-12 16:13:50 +11:00
Gustavo Moreira 3216700d8b Linux: module object extension: Fix recursion call issue 2024-11-12 16:05:59 +11:00
Gustavo Moreira 106b3b3dd0 Linux: PageCache: Fix inode offset when logging an error 2024-11-12 16:01:04 +11:00
Abyss Watcher dd3542b127 explicit loop iterator 2024-11-08 17:51:48 +01:00
Abyss Watcher 485ef894e1 remove taints_value overload attr 2024-11-08 17:49:08 +01:00
Abyss Watcher 8f33aaf5b4 Optional type hints 2024-11-08 17:45:53 +01:00
lesander b739f8d067 revert 3.8 to 3.9 soft bump 2024-11-08 14:05:54 +01:00
lesander a04c04c4e3 fix ci 2024-11-08 14:03:08 +01:00
lesander 1fd5177260 move dependency definitions to pyproject.toml and bump minimal cpython version to 3.9.0 since 3.8.0 is EOL. 2024-11-08 12:31:59 +01:00
ikelosandGitHub 1e871af064 Merge pull request #1339 from volatilityfoundation/issues/issue1336 
Core: Limit capstone to compatible versions
 2024-11-08 11:23:41 +00:00
ikelosandGitHub 36c0b33bef Merge pull request #1341 from joren485/fix-typo-suspicious-threads 
Fix typo in SuspiciousThreads
 2024-11-08 10:15:45 +00:00
ikelosandGitHub eb5534dee4 Merge pull request #1340 from joren485/print-plugin-description 
Print plugin description on plugin --help
 2024-11-08 10:12:48 +00:00
Joren Vrancken b37ba26dd6 Fix typo in SuspiciousThreads 2024-11-08 10:19:05 +01:00
Joren Vrancken 74cf394ad0 Print plugin description on plugin --help 2024-11-08 10:06:59 +01:00
ikelosandGitHub 70188b0190 Merge pull request #1317 from gcmoreira/linux_boottime_support 
Linux - Boottime support
 2024-11-08 07:52:30 +00:00
ikelosandGitHub 932ea7f44a Merge pull request #1337 from joren485/update-amcache-description 
Improve windows.amcache plugin description
 2024-11-07 23:38:15 +00:00
Mike Auty 6494260d91 Core: Limit capstone to compatible versions 2024-11-07 23:34:30 +00:00
Abyss Watcher c725903735 introduce scatter-gather scatterlists 2024-11-07 18:08:58 +01:00
Joren Vrancken 20317e0d13 Improve windows.amcache plugin description 2024-11-07 18:05:36 +01:00
ikelosandGitHub efa4959517 Merge pull request #1300 from Abyss-W4tcher/dirty_ioc_windows_malfind 
[plugin] Add dirty state IoC detection to malfind
 2024-11-07 13:44:56 +00:00
Abyss Watcher a5253ac276 re-trigger black 2024-11-07 13:40:18 +01:00
Gustavo Moreira 73d4f2fc88 Linux: Add support for PROT_NONE, Intel Side Channel Vulnerability L1TF changes and fix _maxphyaddr in x86-64 2024-11-07 20:31:20 +11:00
Gustavo Moreira 9ae7c2bb10 Data layer interface: Convert address_mask to a cached property 2024-11-07 20:28:21 +11:00
Gustavo Moreira 0ad8054f12 intel layer: minor improve lru_cache argument 2024-11-07 20:26:26 +11:00