WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 21:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,528 Commits 80 Branches 17 Tags
development/plugin_module_stubs
Commit Graph
5528 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
ikelosandGitHub 795477e24b Merge pull request #1094 from iyassou/feature/windows-truecrypt 
Windows: add TrueCrypt plugin
 2024-02-04 09:28:55 +00:00
Iyassou Shimels d44c0fef36 run Black formatter 2024-02-04 11:21:14 +03:00
ikelosandGitHub bee98efd96 Merge pull request #1063 from forensicxlab/feature/IAT 
Feature: Import Address Table
 2024-02-03 23:50:11 +00:00
k1nd0ne cf9029fd85 Fixing the year in the Copyright 2024-02-04 00:43:33 +01:00
Iyassou Shimels 41cbfbfa34 add license 2024-02-03 11:58:25 +03:00
Iyassou Shimels ab8ed049a4 Windows: add TrueCrypt plugin 2024-02-03 11:32:00 +03:00
k1nd0ne 130621a2e7 Changing comment when Type error is occuring 2024-02-02 20:04:36 +01:00
EveandGitHub 4a2a9dabd6 Merge branch 'volatilityfoundation:develop' into linux_issue_1089_module_memory 2024-02-02 14:12:29 +00:00
Eve 261d7ffbf2 Linux: include all mod mem types in size calculations 2024-02-02 14:03:55 +00:00
Eve ecf20d99b4 Linux: fix typo in error message in module.get_module_init extension 2024-02-02 13:28:57 +00:00
Eve d1c7f14a75 Linux: attempt to fix issue 1089 2024-02-02 13:28:04 +00:00
Gustavo Moreira 828b688232 Fix issue with net namespace id and improve code 2024-02-02 21:29:10 +11:00
Gustavo Moreira 5219e8aaae Remove lowercase matching from linux.ip.Addr test 2024-02-02 21:03:03 +11:00
Gustavo Moreira 8b6bd0f74e Add linux.ip.Link test using linux-sample-1.bin image 2024-02-02 21:02:05 +11:00
Gustavo Moreira 7b1c75cc87 Linux: Add the linux.ip.Link plugin by @eve-mem 
- On top of the @eve-mem, I've added the queue length field to mimic the ip link command.
- Furthermore, I've included some functions to export the network device flags exactly as they are presented to userland
 2024-02-02 20:57:26 +11:00
Gustavo Moreira 260fbd8d24 Python os.path module precisely does that by checking the current platform and, based on it, utilizes either the posixpath or ntpath modules 2024-02-02 17:03:14 +11:00
Gustavo Moreira 6f1e7c2145 Add test for linux.ip.Addr and linux-sample-1.bin 2024-02-02 16:43:58 +11:00
ikelosandGitHub 18dd23a6b1 Merge pull request #1076 from ckusek15/windows-pstree 
Windows: Add additional command line argument info to windows pstree
 2024-02-01 11:16:24 +00:00
ikelosandGitHub 9b281c478b Merge pull request #1071 from hsarkey/hsarkey/windows-malfind 
Windows: Added '--refined' option to windows malfind plugin
 2024-02-01 09:18:41 +00:00
ikelosandGitHub e436328e88 Merge pull request #1092 from volatilityfoundation/stable 
Stable
 2024-01-31 21:43:57 +00:00
Mike Auty f95be04305 Documentation: Bump the copyright here to 2024 2024-01-31 21:36:21 +00:00
ikelosandGitHub d2f7b416de Merge pull request #1091 from volatilityfoundation/release/v2.5.2 
Documentation: Update copyright in README.md for 2024
v2.5.2 		2024-01-31 21:21:20 +00:00
Mike Auty ba488c78cd Documentation: Bump the copyright here to 2024 2024-01-31 21:13:00 +00:00
Mike Auty 86b0fd431a Core: Apply black 24.1.0 across the whole codebase 2024-01-31 21:09:48 +00:00
Mike Auty 7de7dfdabf Documentation: Update copyright in README.md for 2024 2024-01-31 21:05:00 +00:00
Mike Auty 6d093a4e43 Documentation: Update copyright in README.md for 2024 2024-01-31 21:04:16 +00:00
hsarkey 470c750d82 Updated to use dictionary for refined criteria and BaseAbsentValue for when criteria is not met 2024-01-31 16:00:29 -05:00
ikelosandGitHub 2b15f3fd87 Merge pull request #1069 from dgmcdona/dgmcdona/windows_svcscan 
Windows: SvcScan Binary Info
 2024-01-30 16:49:18 +00:00
Gustavo Moreira 1b153cc567 Manage net_device flag default value & error 2024-01-30 13:13:19 -03:00
Gustavo Moreira c72fa7544d Convert IF_OPER_STATES to enum 2024-01-30 12:55:16 -03:00
Gustavo Moreira 5a8a0def35 Fix docstring typos 2024-01-30 12:53:09 -03:00
David McDonald 43e8e01daf Removes unnecessary pass and deindents return stmt 2024-01-30 09:26:17 -06:00
David McDonald 4192e8a711 Fix condition in OsDistinguisher 2024-01-29 00:38:06 -06:00
David McDonald 42c2a86a37 Add logging for when a Services key cannot be retrieved 2024-01-29 00:38:06 -06:00
David McDonald c517a44cde Add type hints/casts to _get_service_key method 2024-01-29 00:38:06 -06:00
David McDonald f5c1bf0f1f Remove argument that matches default 2024-01-29 00:38:06 -06:00
David McDonald 5541378afe Create unique config path 2024-01-29 00:38:06 -06:00
David McDonald 4b400b6df6 Refactor out code duplication in OS version checks 2024-01-29 00:38:06 -06:00
David McDonald 86d6b4f724 Bump plugin version 2024-01-29 00:38:06 -06:00
David McDonald 77b0110635 Windows: Fixes svc symbols and OS version detection 
There were some changes made to the service structures between certain
versions of Windows that caused the PID/binary path to fail to parse
across quite a few samples. This adds the appropriate version detection
logic and updated symbol files to ensure that services are parsed
correctly across Windows versions.
 2024-01-29 00:38:06 -06:00
David McDonald 837d3b7b9f Windows: Add parsing of service binary/dll 
Parses the binary or dll associated with each service from the Windows
SYSTEM hive and includes it in the output for each service.
 2024-01-29 00:38:06 -06:00
Mike Auty 497d291ef4 Windows: Fix black on dumpfiles 2024-01-29 00:07:40 +00:00
ikelosandGitHub b211dc17b0 Merge pull request #1083 from brandon-barnacle/bbarnacle/windows-dumpfiles 
Windows: Add regex filtering to dumpfiles
 2024-01-28 23:58:16 +00:00
Mike Auty 4dc6f637b0 Core: Apply black 24.1.0 to the whole codebase 2024-01-28 23:50:45 +00:00
gcmoreiraandGitHub cd867bf5d2 Merge branch 'volatilityfoundation:develop' into linux_ifconfig_plugin 2024-01-27 20:32:33 -03:00
Gustavo Moreira 620b9b4183 Fix: Explicit returns mixed with implicit (fall through) returns 2024-01-27 17:52:26 -03:00
Gustavo Moreira 97007e8b86 Minor fixes 2024-01-27 17:48:09 -03:00
Gustavo Moreira 6e0ffc9d62 Plugin renamed. Added net iface status and other improvements from @eve #1029 
* IP address conversion via renderers.coversion.*
* Use MAC address internal size instead of hardcoded.
* Read NET_DEVICE_FLAGS from enumeration
 2024-01-27 17:39:34 -03:00
Brandon Barnacle ae5375a622 PR comment changes 
Change the --regex flag to --filter. Add a check so that --filter
cannot be used with --physaddr or --virtaddr. Change
self.config["filter"] check to check if file_re has been set.
 2024-01-26 11:21:16 -05:00
Calvin Kusek a50ebb6014 Windows: Display additional process info for windows.pstree 2024-01-18 22:25:54 -05:00