WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-22 06:22:23 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,219 Commits 80 Branches 17 Tags
issue_197_windows_dumpfiles_debug_parent
Commit Graph
2219 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
iMHLv2 e8245289d2 add debugging and parent chain walking 2020-07-17 10:22:07 -05:00
iMHLv2 0bae72f4f2 refs #197 initial commit of windows.dumpfiles 2020-07-17 09:35:19 -05:00
Mike Auty 1b774bc69d Yarascan: Bump plugin to include rule name (issue/PR #253) 
In order to try to version control the scanner, a version number was
added to the yarascan plugin along with a method for calling the
scanner.
 2020-07-13 10:52:04 +01:00
Mike Auty 10f6231c87 Documentation: Fix typo (thanks NiklasBeierl!) 2020-07-11 19:34:42 +01:00
Mike Auty 878e4c0420 Documentation: Improve the man page regarding issue #250. 2020-07-11 12:16:24 +01:00
Mike Auty 432e74ecd1 CLI: Reword the help message and yapf format 2020-07-11 11:59:38 +01:00
Niklas Neierlandikelos 077cdfb36e Added instructions for help on a plugin 2020-07-11 11:52:31 +01:00
Mike Auty 07ddbb60f7 Linux: Don't forget the pslist pid parameter 2020-07-11 10:32:15 +01:00
Andrew Case 2427a7c988 Linux - add an explicit version to lsmod 2020-07-10 15:41:25 -05:00
Mike Auty ce6fb561cb Documentation: Add an important note about layer.metadata 2020-07-05 22:20:26 +01:00
Mike Auty 2b05c7ffcb README: Don't forget the line breaks 2020-07-03 14:48:34 +01:00
Mike Auty a669ba8191 README: Update to include hashes for large symbol packs 2020-07-03 14:47:00 +01:00
Mike Auty 4cccbc2f69 Automagic: Fix os_chooser method 
Two issues found:
* the plugin hierarchy always start volatility.plugins, so we need
to go to index 2.
* the layers weren't loaded at the time the stacker list was generated
so all other stackers failed.
 2020-07-02 19:33:32 +01:00
Mike Auty 55dd1c6c2c Automagic: Fix bad default parameter 2020-07-02 19:33:32 +01:00
Mike Auty 16c2ddb837 Automagic: Change stackers to including an exclusion list 2020-07-02 19:33:32 +01:00
Mike Auty 33d1c696e5 Automagic: Allow stackers to be configurable 2020-07-02 19:33:32 +01:00
Michael Lighandikelos 87ff6dd87c refs #200 raise ValueError if an object doesn't have a name 2020-07-01 20:51:22 +01:00
Mike Auty 944bf2174f Automagic: Split out the stacker code 2020-07-01 20:30:31 +01:00
Mike Auty 232fcbe499 Objects: Go back to the *much* quicker exception handling 2020-07-01 20:24:30 +01:00
Mike Auty 51c0b873cc Objects: Reduce duplicated code (thanks @atcuno) 2020-07-01 20:24:30 +01:00
Mike Auty f1613a78b3 Objects: Use contextlib instead of finally 2020-07-01 20:24:30 +01:00
Mike Auty 1cdcd8d811 Core: The has-valid-members interface bumps the version 2020-07-01 20:24:30 +01:00
Mike Auty 6f1001f290 Objects: Add in the ability to test for member validity 2020-07-01 20:24:30 +01:00
Mike Auty 826102c0b5 Logging: Fixes issue #241 2020-06-30 08:58:40 +01:00
Mike Auty 4b29cf1986 Objects: Fix incorrect pointer readability check 2020-06-28 19:32:37 +01:00
Mike Auty 888b432667 Mac: Fix an error decoding bad UTF-8 values 
Closes #228.
 2020-06-28 01:07:16 +01:00
Mike Auty ea20ae1c0c Docs: Add CLI manpage (and fix a CLI option) 2020-06-28 00:57:46 +01:00
Mike Auty 91d9d37c68 Docs: Document cross-layer communication 2020-06-27 23:52:54 +01:00
Mike Auty d28e573c18 Renderers: Fix python deprecation warnings 2020-06-27 18:34:43 +01:00
Mike Auty ac1d99677d ISF: Support deprecating versions 2020-06-27 18:33:30 +01:00
Mike Auty cd9a46ebd1 Resources: Ensure we close all file pointers 2020-06-27 18:29:51 +01:00
Hans P. Reiserandikelos cc6f4fbf9d print correct db/dd/.. offset: increment offset after printing, not before 2020-06-25 22:19:19 +01:00
Mike Auty cf988944b9 Linux: Correct the ASLR for pre-masking (KASLR is still incorrect) 2020-06-23 16:56:40 +01:00
Hanno Heinrichsandikelos deb2b78312 Clear symbol cache after ASLR computation on Linux. 2020-06-23 16:45:22 +01:00
Hanno Heinrichsandikelos 30226d2bdd Fix find_aslr() function invocation for Linux. 2020-06-23 16:10:05 +01:00
Mike Auty abb1f3d71c Renderers: Fix inaccurate old code 2020-06-22 19:26:37 +01:00
Mike Auty 99a8c69e75 Renderers: Support partial results during population 2020-06-22 19:26:37 +01:00
Mike Auty 16a8e3771b Objects: Make bool an int 
We can't inherit from bool, so __new__ can't return a bool, so
everything has be done with int.  However __bool__ is already
defined for int, so it should have no significant impact
(other than type() calls).

Fixes issue 232.
 2020-06-18 16:53:14 +01:00
Mike Auty 0ffe318cb0 Project: Update copyright headers for files added in 2020. 2020-06-10 21:13:37 +01:00
Mike Auty d3ba947a56 Mac: Fix case names of certain plugins 
Closes #201.
 2020-06-10 21:02:16 +01:00
Mike Auty c134cf6eca Timeliner: Improve the option name 2020-06-10 20:33:04 +01:00
Mike Auty 1fe9cbd51d timeliner: Add the bodyfile output requirement switch to the plugin 2020-06-10 20:33:04 +01:00
Mike Auty 32fb2364a1 Timeliner: Ensure blank lines aren't printed. 2020-06-10 20:33:04 +01:00
Mike Auty fc27efc252 Add in body-file output support. 2020-06-10 20:33:04 +01:00
Mike Auty 5921671b38 timeliner: Yield as soon as we have output 2020-06-10 20:33:04 +01:00
Mike Auty b9d0cf17e3 Fix the output of exceptions with timeliner. 2020-06-10 20:33:04 +01:00
Mike Auty 80e2117c94 Layers: QEMU add in slow warning 2020-06-10 20:22:35 +01:00
Mike Auty 2bf8247b62 Layers: Extend segments to include original size as well as mapped size. 2020-06-10 20:22:35 +01:00
Mike Auty d0d7ea84b9 Layers: Remove debugging statement 2020-06-10 20:22:35 +01:00
Mike Auty df644ef5b7 Layers: Improve QEMU format support 2020-06-10 20:22:35 +01:00