WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 21:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,528 Commits 80 Branches 17 Tags
development/plugin_module_stubs
Commit Graph
5528 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
hsarkey ef36cb5a6c Updated windows.malfind to have a "Notes" column to indicate if a process meets 
"refined" criteria, which includes common headers like MZ,PE or function
prologues. Fixed black formatting issue.
 2024-01-17 17:51:27 -05:00
hsarkey e6e138f12d Updated windows.malfind to have a "Notes" column which will indicate if a process 
meets a "refined criteria", meaning it has a common header type (MZ, PE, or a
function prologue).
 2024-01-17 17:24:26 -05:00
hsarkey 4e89040dad Updated changes to the windows.malfind plugin. Eliminated --refined as a command line option and instead 
added an additional column called "Notes" to provide info on common headers.
 2024-01-17 16:52:16 -05:00
Mike Auty 4b86b9ea89 Plugins: Remove unnecessary variable from windows.mftscan 2024-01-17 20:40:27 +00:00
Mike Auty 01ffcd9634 Core: Fixing None equality test in MapleTree implementation 2024-01-17 20:37:26 +00:00
Mike Auty 614d4d6f2b Layers: Fix cloudstorage unnecessary import 2024-01-17 20:35:54 +00:00
Mike Auty 269058021d Plugins: Fix up kmsg code issues 2024-01-17 20:34:39 +00:00
Mike Auty 7c8f4ca4ac Schemas: As of 6.3.0 we require a producer metadata, not just format 2024-01-14 23:05:12 +00:00
Mike Auty 62366d4f6f Symbols: Add support for metadata verification of symbol tables 2024-01-14 23:05:10 +00:00
bbarnacle 52dcfb45f4 Windows: Add regex filtering to dumpfiles 
In volatility2, the windows.dumpfiles plugin allows you to filter the dumped files
using a regular expression. This PR adds the same functionality to volatility3.

The regular expression is passed in using --regex=REGEX and all files matching
REGEX will be dumped. The --ignore-case flag can be passed to make the search
case-insensitive. The search is case-sensitive by default. The matching
volatility2 functionality can be found here:
https://github.com/volatilityfoundation/volatility/blob/a438e768194a9e05eb4d9ee
9338b881c0fa25937/volatility/plugins/dumpfiles.py#L844

Manual testing was performed on windows memory images across different windows
versions to verify the expected output.
 2024-01-11 13:24:05 -05:00
Gustavo Moreira da6c2d863d Fix netdev egress hooks 2024-01-10 16:43:36 -03:00
Gustavo Moreira 5b5012d08a Fix. Use the global lists. DEC hooks were wrong 2024-01-10 16:42:34 -03:00
Gustavo Moreira 5ad7dd3bbc Update netdev class names as it now supports both netdev hooks; ingress and egress 2024-01-10 16:06:55 -03:00
Gustavo Moreira abc448009e Linux: Add netfilter hooks enumeration plugin. 2024-01-10 15:56:00 -03:00
RuBublik b395815eb0 Merge branch 'poolscanner-thread-support' of https://github.com/RuBublik/volatility3 into poolscanner-thread-support 2024-01-09 21:32:46 +02:00
RuBublik b0d84e55ab fix indentation (typo) 2024-01-09 21:32:29 +02:00
Gustavo Moreira 6b3bbad537 Fix exception. Although it will be auto-instantiated it's better to explicitily use the exception instance 2024-01-09 16:13:33 -03:00
Gustavo Moreira 82668af609 Linux - Added linux.ifconfig.Ifconfig plugin 2024-01-09 16:12:56 -03:00
RuBublikandGitHub de409d7249 Merge branch 'develop' into poolscanner-thread-support 2024-01-09 00:37:13 +02:00
RuBublik 7c37012118 bumped version constants to mark change of interface (add of support for ETHREAD) 2024-01-09 00:16:18 +02:00
RuBublik 550112b848 added another sanity check to ETHREAD.is_valid 2024-01-08 23:37:38 +02:00
RuBublik 25637a41e0 added account for XP timestamps - bit shifted 2024-01-08 23:35:21 +02:00
ikelosandGitHub 66a4fc92bb Merge pull request #1075 from gcmoreira/linux_kmsg_older_kernels_support 
Linux: Add support for kernels earlier than version 3.11 in `linux.kmsg.Kmsg` plugin
 2024-01-02 19:08:03 +00:00
Gustavo Moreira 66b408d6e8 Fix minor docstring typos 2024-01-02 11:37:10 -03:00
Gustavo Moreira 8e58815c11 Bump plugin's patch version 2024-01-02 11:25:35 -03:00
Gustavo Moreira 02a389a61b Improve docstrings 2024-01-02 11:17:18 -03:00
Gustavo Moreira e4c44698f8 Reduce imports 2024-01-02 11:14:43 -03:00
Gustavo Moreira 0d934d4991 Fix error and comment 2023-12-26 16:13:47 -03:00
Gustavo Moreira 3848fc69a6 Add support for kernels earlier than version 3.11. 
* Add support for older ring buffer kernel implementation:
  - 3.5 < kernels
  - 3.5 <= kernels < 3.11
 * Enabled support for wrapped-around ring buffers in all four kernel implementations.
 * Bugfix: wrapped around buffer issue with 3.11 <= kernel < 5.10.
 2023-12-25 21:32:14 -03:00
hsarkey 409ce95980 Windows: Added '--refined' option to windows malfind plugin 
Also updated malfind to include "\x55\x48" and "\x55\x89" as part of the refined_criteria list.
 2023-12-21 15:49:00 -06:00
Valentin Obst 84401847ff add sanity check in Linux find_aslr to skip unrelocated init_task 2023-12-20 21:50:22 +01:00
ikelosandGitHub fdf93f502f Merge pull request #1062 from vobst/handle-duplicate-enum-value 
tolerate duplicate enum values, keep first name that was seen
 2023-12-20 19:42:50 +00:00
ikelosandGitHub a4b927f478 Merge pull request #1068 from vobst/remove-kernel_cap_struct-requirement 
remove kernel_cap_struct requirement
 2023-12-20 11:26:18 +00:00
Valentin Obst aa624b0339 remove kernel_cap_struct requirement 2023-12-19 10:25:26 +01:00
Valentin Obst bd96357e33 tolerate duplicate enum values, keep first name that was seen 2023-12-19 09:32:25 +01:00
ikelosandGitHub 18e5d7a7f2 Merge pull request #1061 from eve-mem/linux_kmsg_issue_1055 
Linux: Update kmsg issue 1055
 2023-12-18 18:59:30 +00:00
k1nd0ne 059f2d0128 Adding function addr + bound info. Formatting code. 2023-12-16 21:19:35 +01:00
k1nd0ne 604c23bcbc Import Address Table Plugin 2023-12-14 14:50:17 +01:00
ikelosandGitHub 4ac261c7bf Merge pull request #1057 from eve-mem/linux_fix_pstree 
Linux: Update pslist to fix pstree
 2023-12-14 11:10:49 +00:00
EveandGitHub e2f7e7ec54 Merge branch 'volatilityfoundation:develop' into linux_fix_pstree 2023-12-14 09:52:28 +00:00
Eve 9b85342673 Linux: bump version for linux kmsg 2023-12-14 09:24:51 +00:00
Eve fda3cedaba Linux: update kmsg to create objects via context rather than module 2023-12-14 09:18:01 +00:00
ikelosandGitHub 713b5f96dd Merge pull request #997 from gcmoreira/issue_985 
Issue 985
 2023-12-12 23:35:54 +00:00
ikelosandGitHub 298570aba4 Merge branch 'develop' into issue_985 2023-12-12 23:06:45 +00:00
Eve 3d9b0208cb Linux: change pstree to a basic plugin rather than inheriting from pslist 2023-12-12 06:56:14 +00:00
Eve 19499d5113 Linux: update pslist with classmethod for get_task_fields 2023-12-11 06:39:09 +00:00
Eve c08dda88de Linux: Update pslist plugin so that it can be used from pstree, and update pstree to support dumping of processes 2023-12-08 22:56:17 +00:00
EveandGitHub b9c60a5545 Merge branch 'volatilityfoundation:develop' into linux_kmsg_issue_1055 2023-12-07 09:07:15 +00:00
Eve 831e6cf341 Linux: update kmsg KmsgFiveTen class to handle symbol shift and create objects with absolute addresses 2023-12-07 09:06:13 +00:00
ikelosandGitHub a08b7809b5 Merge pull request #1050 from eve-mem/windows_vadyarascan_issue_1047 
Windows: update vadyarascan to use generic yarascan requirements
 2023-12-05 18:46:07 +00:00