David McDonald
aedacea603
Packaging: Refactor JSON data handling
...
This changes the way that JSON resources required for plugins are
handled within the volatility3 package. Instead of operating directly on
paths, it uses Python's builtin `importlib.resources` module to identify
a data directory with JSON files as a resource location. This greatly
simplifies how resources are found within the plugins.
References:
https://docs.python.org/3/library/importlib.resources.html#module-importlib.resources
2025-03-14 22:32:39 -05:00
ikelos and GitHub
023fdfd293
Merge pull request #1708 from volatilityfoundation/fix_windows_strings
...
Properly reconstruct strings from memory buffers and allow for plugin…
2025-03-14 21:53:01 +00:00
Andrew Case
b2ec21fcf2
Simplify last_address handling
2025-03-14 21:15:03 +00:00
Andrew Case
bb0a17004f
Add return_truncated for plugin-specified handling of truncated strings
2025-03-14 20:59:15 +00:00
Andrew Case
f38ddaf715
Fix string scanning code
2025-03-14 20:53:02 +00:00
ikelos and GitHub
e0ff0018a6
Merge pull request #1709 from volatilityfoundation/feature/ipython
...
Feature: Add support for IPython in volshell
2025-03-14 19:32:45 +00:00
David McDonald
196bf8187d
Volshell: Address comments from code review
...
- Add failure message when readline or rlcompleter can't be imported
- Fix unclosed file handle in context manager
2025-03-14 12:22:15 -05:00
Andrew Case
4225adce56
Convert to .mapping and let Python had all encodings
2025-03-14 16:32:54 +00:00
Andrew Case
36b3c28859
Update encodings
2025-03-14 03:12:06 +00:00
Andrew Case
7ab62365fb
Vastly improve string reading while keeping intended behaviour
2025-03-14 03:05:11 +00:00
ikelos and GitHub
d82200f9f7
Merge pull request #1711 from volatilityfoundation/fix_bad_symbol_parsing
...
Update symbol splitting to handle symbols without attached module name
2025-03-13 23:11:13 +00:00
Andrew Case
39d39292f0
Update symbol splitting to handle symbols without attached module name
2025-03-13 22:55:47 +00:00
David McDonald
c3123e8839
Volshell: Handle script running in ipython shell
2025-03-13 17:17:17 -05:00
David McDonald
fa2a93ade4
Volshell: Fix import logic around readline + rlcomplete
2025-03-13 17:09:56 -05:00
David McDonald
6f9f5c34b9
Feature: Add support for IPython in volshell
2025-03-13 16:37:31 -05:00
Andrew Case
48a5736a57
Properly reconstruct strings from memory buffers and allow for plugin-specified encodings
2025-03-13 21:09:38 +00:00
ikelos and GitHub
e2d48b8018
Merge pull request #1701 from volatilityfoundation/1476-all-calls-to-get_name-on-registry-keys-need-auditing
...
1476 all calls to get name on registry keys need auditing
2025-03-11 22:53:13 +00:00
Dave Lassalle
95aee9a664
#1476 - introduce RegistryException for simpler exception handling
2025-03-11 16:04:06 -05:00
ikelos and GitHub
aff84858ca
Merge pull request #1706 from volatilityfoundation/1446-pstreepy-has-broken-types-and-pid-handling
...
#1446 - pid is objects.Pointer, not int
2025-03-11 20:49:40 +00:00
Dave Lassalle
d9c9e11127
#1446 - uses ints instead of objects.Pointer
2025-03-11 13:41:01 -05:00
ikelos and GitHub
27142bec4c
Merge pull request #1702 from volatilityfoundation/1645-change-registry-processing-to-not-walk-the-process-list-in-the-registry-layer
...
#1645 - duplicate list_processes code
2025-03-11 16:30:24 +00:00
Dave Lassalle
7f7295cdb7
#1476 - remove unfinished prefetch plugin
2025-03-11 09:52:24 -05:00
Dave Lassalle
d32f3e76d4
#1645 - remove quoutes around type
2025-03-11 09:47:47 -05:00
ac74de694a
Update volatility3/framework/layers/registry.py
...
Co-authored-by: ikelos <ikelos@users.noreply.github.com >
2025-03-11 09:46:10 -05:00
Dave Lassalle
d148d8f9d8
#1446 - black fixes
2025-03-11 09:31:54 -05:00
Dave Lassalle
cbab1d1f49
#1446 - pid is objects.Pointer, not int
2025-03-11 09:30:38 -05:00
ikelos and GitHub
1639ae2396
Merge pull request #1704 from volatilityfoundation/remove_module_creation_at_offset_zero
...
No longer allocate session modules in support of the GUI objects at o…
2025-03-10 23:30:36 +00:00
ikelos and GitHub
398578aff6
Merge pull request #1703 from volatilityfoundation/update_gui_pool_types
...
Allow desktops and window stations to come from the paged or non-page…
2025-03-10 22:39:56 +00:00
Andrew Case
740ce520d6
retrigger checks
2025-03-10 22:13:09 +00:00
Andrew Case
c1b4866ba7
retrigger checks
2025-03-10 21:36:54 +00:00
Andrew Case
f17907200d
No longer allocate session modules in support of the GUI objects at offset 0. Instantiate objects at the absolute address explicility.
2025-03-10 21:26:58 +00:00
Andrew Case
7d5d379144
Allow desktops and window stations to come from the paged or non-paged pool
2025-03-10 21:24:55 +00:00
Dave Lassalle
4b74de4104
#1645 - duplicate list_processes code
2025-03-10 15:32:13 -05:00
ikelos and GitHub
f69bdfad07
Merge pull request #1686 from volatilityfoundation/fix_fbdev
...
Update fbdev plugin to gracefully handle old/broken symbol tables
2025-03-10 19:47:13 +00:00
ikelos and GitHub
6ac7c1edb1
Merge pull request #1656 from volatilityfoundation/fix_linux_networking_paths
...
Fix broken code and APIs in Linux networking paths
2025-03-10 19:44:39 +00:00
ikelos and GitHub
831eea5daa
Merge pull request #1696 from volatilityfoundation/fix_symbol_table_api
...
Fix symbol table PDB API that mixes returns, None values, and exceptions
2025-03-10 19:37:50 +00:00
ikelos and GitHub
1c5fdccf1e
Merge pull request #1673 from volatilityfoundation/linux_kernel_api_overhaul
...
Merge two Linux APIs for mapping kernel modules to pointers. Fix bugs…
2025-03-10 19:36:56 +00:00
Dave Lassalle
9b23feef2b
#1476 - ruff fixes
2025-03-10 14:17:24 -05:00
Dave Lassalle
f52a857aa0
#1476 - code cleanup
2025-03-10 14:10:59 -05:00
e0168c7bec
Potential fix for code scanning alert no. 374: Testing equality to None
...
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
2025-03-10 14:03:45 -05:00
6061270816
Potential fix for code scanning alert no. 381: Unused import
...
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
2025-03-10 14:03:34 -05:00
Dave Lassalle
e1c88f065b
#1476 - black fixes
2025-03-10 13:57:14 -05:00
Dave Lassalle
a41721277d
#1476 - merge develop
2025-03-10 13:56:08 -05:00
Dave Lassalle
8b302ff7fc
#1476 - additional exception handling for registry plugins
2025-03-10 13:39:00 -05:00
Andrew Case
6c96ffacdd
Update fbdev plugin to gracefully handle old/broken symbol tables
2025-03-10 16:38:30 +00:00
Andrew Case
2d4e0f66d8
Update fbdev plugin to gracefully handle old/broken symbol tables
2025-03-10 16:38:30 +00:00
Andrew Case
f7f8cf24cd
Address feedback
2025-03-10 16:36:53 +00:00
Andrew Case
dad88965e9
Fix broken code and APIs in Linux networking paths
2025-03-10 16:30:16 +00:00
Andrew Case
897069c6d0
Throw more specific exception
2025-03-10 16:27:49 +00:00
Andrew Case
2a99a53784
Make exception throwing consistent in the PDB gathering API. Avoid returning an empty symbol_table name when the PDB cannot be downloaded.
2025-03-10 16:23:00 +00:00
David McDonald