Ilya Chukhman
e52cb3f82c
docker container support
...
Dockerfile and makefile rules to build several volatility docker images.
The images share a common builder image. A generic volatility image is
used for staging. The 3 docker images that are produced have the same
layers and only differ in entrypoint definition. The images are:
* vol -- used to run plugins with vol.py
* volshell -- used to enter a volshell
* pdbconv -- used to convert pdb files to json files
The symbols used for analysis need to be provided via a defined /symbols
volume. The image used for analysis also needs to be provided via a
user-defined volume.
2020-02-11 19:52:41 -05:00
Mike Auty
920b85743b
Revert "Automagic: Add excessive debugging to symbol cache"
...
This reverts commit db8ba4029c
2020-01-30 01:58:07 +00:00
Mike Auty
c4829ccca3
Caching: Add clear-cache option (except hashcaches)
2020-01-30 01:57:48 +00:00
Mike Auty
db8ba4029c
Automagic: Add excessive debugging to symbol cache
2020-01-30 01:34:30 +00:00
Mike Auty
6e38727ffe
Mac: Refactor/optimize repeated code.
2020-01-28 01:37:21 +00:00
Mike Auty
f111e9e051
Mac: Ensure queues error check all entries, not just the first.
2020-01-28 01:37:21 +00:00
comet and ikelos
beed68b8bf
update
2020-01-27 23:31:05 +00:00
Mike Auty
f00453e366
Procdump: Remove redundant line as caught by @iMHLv2
2020-01-22 19:49:11 +00:00
Michael Ligh and ikelos
1d7da6402b
svcscan cleanup: win10 before 15063 uses win8 types
2020-01-22 19:23:30 +00:00
Mike Auty
b664e38c66
Resources: Add a comment about removing the old python code.
2020-01-22 19:22:02 +00:00
Michael Ligh and ikelos
d6c8ac87d7
try unverified retrieval if ssl.SSLCertVerificationError or ssl.SSLError with CERTIFICATE_VERIFY_FAILED
2020-01-22 19:19:48 +00:00
Mike Auty
ddfd5ec2d2
Framework: Refactor where the python version check happens.
...
Fixes issue #181 .
2020-01-22 19:05:06 +00:00
Mike Auty
9fe6e6ba37
registry: Add the hivedump plugin
2020-01-17 17:22:04 +00:00
Mike Auty
fe999aa9e2
registry: Fix up previous naive mapping method
2020-01-17 17:14:16 +00:00
Mike Auty
5b9c8feba6
General: Improve import warning for volatility.framework.plugins
2020-01-17 02:14:22 +00:00
Mike Auty
81653dba6d
Registry: Ignore errors if ignore_errors is set.
2020-01-17 01:14:09 +00:00
Mike Auty
8f71c61440
layerwriter: Fix mistaken hardcoded layer name.
2020-01-16 23:07:27 +00:00
Mike Auty
99af98f639
layerwiter: Refactor to classmethod.
2020-01-16 22:57:47 +00:00
Mike Auty
572313cc34
Objects: Make sure bytes provide a template size.
2020-01-16 11:06:16 +00:00
Mike Auty
a3def09a13
Registry: Optimize calls to DataLength and improve documentation.
2020-01-15 22:59:58 +00:00
Mike Auty
cedca0bb84
Objects: Document void size a little more.
2020-01-15 21:55:30 +00:00
Mike Auty
2d408491bd
Printkey: Slightly improve subkey name determination.
2020-01-15 02:19:12 +00:00
Mike Auty
3f5b96f3c7
Yapf: Clean-up the whole codebase.
2020-01-14 15:44:07 +00:00
Mike Auty
b7ba877727
procdump: Enure proc_id is defined.
2020-01-14 15:36:54 +00:00
doomedraven and ikelos
07b94abc1e
Update procdump.py
2020-01-14 10:52:05 +00:00
doomedraven and ikelos
cdc0835863
Update procdump.py
2020-01-14 10:52:05 +00:00
doomedraven and ikelos
e4d7b7975f
expose process_dump to other plugins
2020-01-14 10:52:05 +00:00
Mike Auty
fda64dde95
Mac tasks: Swap the shortcircuiting order
2020-01-13 14:13:37 +00:00
Mike Auty
8a03cf53f0
Objects: Ensure templates objects aren't ReferenceTemplates.
2020-01-13 13:58:35 +00:00
Mike Auty
b4a9937da7
Objects: Void has no size, and BitFields don't inherit from Integer.
2020-01-13 02:16:35 +00:00
Mike Auty
0f49673aa0
Objects: Ensure string template objects return the right size.
2020-01-13 01:41:57 +00:00
Mike Auty
3977a3c356
objects: Fixes for the comments in #159
2020-01-10 12:47:06 +00:00
Mike Auty
d969d89da9
Objects: Ensure array sizes change with their count
2020-01-10 12:47:06 +00:00
Mike Auty
fba6511486
Objects: Add size to ObjectInfo so it can be statically access later
2020-01-10 12:47:06 +00:00
Michael Ligh and ikelos
e80e9e09b6
the hand-written 32-bit windows 10 service record types were missing the Tag member
2020-01-05 01:53:52 +00:00
iMHLv2 and GitHub
f7cc94a244
Merge pull request #168 from volatilityfoundation/issue-10-vad-protection-layer
...
Use a kernel layer to read vad protection constants
2020-01-04 10:02:59 -06:00
Michael Ligh
b7b6c44eab
remove unused variable in vaddump.py
2020-01-04 09:35:51 -06:00
iMHLv2 and GitHub
af468e7657
Merge pull request #162 from Lyx09/fix_vad_dump_var
...
VadDump: Fix incorrect variable out_of_range in vad_dump
2020-01-04 09:34:25 -06:00
Mike Auty
d2daa12564
Malfind: Rename the layer_name parameter to be more descripttive
2020-01-03 22:12:04 +00:00
Daniel Milnes and ikelos
f573f22721
Add issue templates
2020-01-03 22:06:23 +00:00
Andrew Case and ikelos
d7f5a13c46
Mac - properly check for broken proc pointers
2020-01-03 19:42:18 +00:00
Andrew Case and ikelos
3bf3e0601a
Remove earliler trigger of SymbolError
2020-01-03 17:50:06 +00:00
Andrew Case and ikelos
a66e1bb6c2
Move symbol catching to generator
2020-01-03 17:50:06 +00:00
Andrew Case and ikelos
65556a2c92
Linux - update handling of kernels that do not have loadable module support
2020-01-03 17:50:06 +00:00
Mike Auty
fc005d08cc
CLI: Fix issue #163 , incorrect parallelism option
2019-12-28 21:21:55 +00:00
William LIN
e6656c96af
VadDump: Fix incorrect variable out_of_range in vad_dump
2019-12-26 19:51:13 +01:00
Mike Auty
604e8adcbc
Renderers: Fix up the JSON renderer's timedate formatting
2019-12-16 21:58:22 +00:00
Mike Auty
681da142c5
Renderers: Split JSON output into JSON and JSONL
2019-12-16 21:58:22 +00:00
Mike Auty
fc5062fbe0
Renderers: Don't include the title in JSON output.
2019-12-16 21:58:22 +00:00
Mike Auty
0746fd2994
Add in JSON renderer.
2019-12-16 21:58:22 +00:00
Ilya Chukhman