Mike Auty
90c048fe02
Core: Actually return the right values for the iterator
2024-11-30 14:42:56 +00:00
Mike Auty
744adfeda0
Core: Improve the scanning, but it's still not working yet
2024-11-30 14:18:58 +00:00
Mike Auty
006d3a2043
Layers: Fix up totally off values
2024-11-30 13:36:59 +00:00
Mike Auty
58a8b2da9f
Core: Scanning only splits up the layer
...
Scanning had been rigged to chop up a layer's readable bits into the
chunks that make it up from the lower layer. Unfortunately it did this
on chunks in the lower layer, rather than chunks readable in the higher
layer. This meant chunks in Intel were already read in page sized
blocks. This vastly simplifies the reading of data and brings
non-linear layer searching in sync with linear layer searching (because
there's no good reason they should be different).
2024-11-30 13:36:59 +00:00
Mike Auty
2dc1686289
Windows: Protect the SERICE_RECORD is_valid function a little more
...
The request to .Order could fail depending on where the structure lies
in memory.
2024-11-30 13:36:17 +00:00
ikelos and GitHub
ba98b088cb
Merge pull request #1369 from gcmoreira/logging_producer_information
...
Linux/Mac: Log producer metadata information
2024-11-29 10:27:32 +00:00
Mike Auty
393db1050f
Windows: protect again mz_offsets being None
2024-11-29 08:51:06 +00:00
Gustavo Moreira
77778ee6f6
Linux/Mac: ISF metadata: Rename s/DWARF/POSIX/, as I'm not happy with the generic name. BTF source could potentially generate the same keys
2024-11-29 19:35:18 +11:00
Gustavo Moreira
b8023f0c97
Linux/Mac: Address code review suggestions
...
- Add getters for Linux/Mac ISF sources
- Avoid using internal attributes
- Use the dict repr instead of walking the dict to simplify code
2024-11-29 19:05:27 +11:00
Mike Auty
3748cb89b8
Windows: Improve debugging output for pdbscan
2024-11-28 10:22:49 +00:00
Gustavo Moreira
8ecd7e2ddd
Linux/Mac: Log producer information
2024-11-28 15:17:22 +11:00
ikelos and GitHub
0233193c9d
Merge pull request #1335 from gcmoreira/linux_prot_none_L1TF_and_layer_addr_translation_fixes
...
Linux - PROT_NONE, L1TF mitigation and layer address translation fix
2024-11-27 10:31:18 +00:00
Gustavo Moreira
eff2a529c8
Linux: intel: Remove the bitwise zero complement to simplify the protnone mask calculation
2024-11-27 18:10:14 +11:00
Gustavo Moreira
641e008caf
Linux: intel: The non-present mapping shouldn't be inverted
2024-11-27 15:06:33 +11:00
ikelos and GitHub
bdd3e1e48e
Merge pull request #1365 from volatilityfoundation/issues/pr1343
...
CLI: Partial changes by @lesander contributed in #1343
2024-11-24 09:58:04 +00:00
Mike Auty
523a6e92fc
CLI: Apply black to recent changes
2024-11-24 09:33:30 +00:00
lesander and Mike Auty
1a0d1a238d
CLI: Partial changes by @lesander contributed in #1343
2024-11-24 09:31:26 +00:00
ikelos and GitHub
47baec8bba
Merge pull request #1363 from volatilityfoundation/issues/fix-linuxstacker-to-use-cache-interface
...
Core: Add in generic cache-manager chooser function
2024-11-24 09:19:02 +00:00
ikelos and GitHub
15f2011eed
Merge pull request #1342 from lesander/improvement/remove-requirements-and-setup
...
Update pyproject.toml and remove requirements and setup files
2024-11-23 18:58:21 +00:00
Mike Auty
4bc6e1001d
Windows: Improve logging of slowscan to show possible PDB entries
2024-11-22 19:45:15 +00:00
ikelos and GitHub
4c55c0fe43
Merge pull request #1353 from eve-mem/regex_plugins
...
Add first version of regex scanning plugins
2024-11-22 12:26:34 +00:00
Mike Auty
76ecfc0883
Core: Add in generic cache-manager chooser function
2024-11-22 12:16:14 +00:00
ikelos and GitHub
fb101de6fc
Merge pull request #1362 from c0rydoras/fix/cache-dir
...
Follow XDG Base Directory Specification for cache directory
2024-11-22 11:32:57 +00:00
Arthur Deierlein
a2b96c0dc0
fix: dont use / for compat
2024-11-22 11:46:59 +01:00
Arthur Deierlein
b93d5b7c13
update docs
2024-11-22 11:23:56 +01:00
Arthur Deierlein
1abb4cc881
comply with xdg base directory spec by using XDG_CACHE_HOME if its set
2024-11-22 11:13:21 +01:00
ikelos and GitHub
ac482e3e13
Merge pull request #1359 from eve-mem/windows_svcscan_remove_yara_dep
...
Windows: Remove dep on vadyarascan from svcscan plugin
2024-11-18 22:29:15 +00:00
eve
1ba5b04b7d
Windows: Remove dep on vadyarascan from svcscan plugin
2024-11-18 21:20:04 +00:00
eve
e374ca9647
Windows.vadregexscan: update imports, revert vadyarascan changes
2024-11-18 21:15:06 +00:00
eve
07701fc4cf
windows.vadregexscan: remove dependency on vadyarascan
2024-11-18 18:32:51 +00:00
eve
6d366f16ee
Windows.vadregexscan: update imports
2024-11-18 06:38:06 +00:00
eve
aa93b57f0d
Fix windows.vadregexscan sections
2024-11-15 13:15:40 +00:00
eve
c2058e744b
Fix missing type imports for regex plugins
2024-11-15 13:12:03 +00:00
eve
b802b16c62
Add first version of regex scanning plugins
2024-11-15 13:03:36 +00:00
ikelos and GitHub
8790814d54
Merge pull request #1323 from gcmoreira/linux_netfilter_fix_hooked
...
Linux: netfilter plugin: Fix hooked field to match Volatility2 output
2024-11-15 09:11:23 +00:00
Gustavo Moreira
c909fdd4e7
linux: netfilter plugin: Bump minor version
2024-11-15 11:53:05 +11:00
Gustavo Moreira
bee3f001b6
linux: netfilter plugin: Enhance docstring to provide a clearer explanation of 'hooked'
2024-11-15 11:31:30 +11:00
ikelos and GitHub
8e355c0eaf
Merge pull request #1350 from eve-mem/volshell_display_default_constant
...
Volshell: Make the default number of bytes returned by db, dw, dd, dq, rx, and dis use a constant
2024-11-14 17:51:55 +00:00
eve
357d8a914b
Volshell: Make the default number of bytes returned by db, dw, dd, dq, rx, and dis use the constant DEFAULT_NUM_DISPLAY_BYTES
2024-11-14 10:55:41 +00:00
ikelos and GitHub
fe91feac5e
Merge pull request #1347 from eve-mem/regex_scan
...
Volshell: add regex_scan
2024-11-13 23:49:30 +00:00
eve
af7a420cdc
Volshell: rename regex_scan short hand to rx so that it does not clash with the built in python re module
2024-11-13 08:56:58 +00:00
Gustavo Moreira
173e35105a
LinuxMixin: Make new methods internal
2024-11-13 12:30:11 +11:00
Gustavo Moreira
36c19aa6d9
core: Bump framework minor version
2024-11-13 12:21:03 +11:00
Gustavo Moreira
05e8f8ff10
intel layer: Move constants to the Intel class
2024-11-13 12:20:03 +11:00
ikelos and GitHub
d2ae43c6d8
Merge pull request #1346 from gcmoreira/linux_misc_fixes
...
Linux - miscellaneous fixes
2024-11-12 23:09:21 +00:00
ikelos and GitHub
340bd6d7c0
Merge pull request #1348 from gcmoreira/linux_kthreads_plugin
...
Linux: Add kthreads plugin to enumerate kernel threads start address
2024-11-12 23:03:41 +00:00
Gustavo Moreira
787e15ac2b
Linux: kthreads plugin: Add missing requirements
2024-11-13 09:50:08 +11:00
Gustavo Moreira
8efe429719
Linux: kthreads plugin: Adjust required framework version
2024-11-12 18:32:26 +11:00
eve
780f9ab6f5
Volshell: add regex_scan
2024-11-12 07:22:45 +00:00
Gustavo Moreira
d90019657c
Linux: Add kthreads plugin to enumerate kernel thread functions
2024-11-12 18:14:36 +11:00
Mike Auty