WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-21 14:02:22 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,219 Commits 80 Branches 17 Tags
issue_197_windows_dumpfiles_debug_parent
Commit Graph
1711 Commits
Author SHA1 Message Date
iMHLv2 e8245289d2 add debugging and parent chain walking 2020-07-17 10:22:07 -05:00
iMHLv2 0bae72f4f2 refs #197 initial commit of windows.dumpfiles 2020-07-17 09:35:19 -05:00
Mike Auty 1b774bc69d Yarascan: Bump plugin to include rule name (issue/PR #253) 
In order to try to version control the scanner, a version number was
added to the yarascan plugin along with a method for calling the
scanner.
 2020-07-13 10:52:04 +01:00
Mike Auty 07ddbb60f7 Linux: Don't forget the pslist pid parameter 2020-07-11 10:32:15 +01:00
Andrew Case 2427a7c988 Linux - add an explicit version to lsmod 2020-07-10 15:41:25 -05:00
Mike Auty 4cccbc2f69 Automagic: Fix os_chooser method 
Two issues found:
* the plugin hierarchy always start volatility.plugins, so we need
to go to index 2.
* the layers weren't loaded at the time the stacker list was generated
so all other stackers failed.
 2020-07-02 19:33:32 +01:00
Mike Auty 55dd1c6c2c Automagic: Fix bad default parameter 2020-07-02 19:33:32 +01:00
Mike Auty 16c2ddb837 Automagic: Change stackers to including an exclusion list 2020-07-02 19:33:32 +01:00
Mike Auty 33d1c696e5 Automagic: Allow stackers to be configurable 2020-07-02 19:33:32 +01:00
Michael Lighandikelos 87ff6dd87c refs #200 raise ValueError if an object doesn't have a name 2020-07-01 20:51:22 +01:00
Mike Auty 944bf2174f Automagic: Split out the stacker code 2020-07-01 20:30:31 +01:00
Mike Auty 232fcbe499 Objects: Go back to the *much* quicker exception handling 2020-07-01 20:24:30 +01:00
Mike Auty 51c0b873cc Objects: Reduce duplicated code (thanks @atcuno) 2020-07-01 20:24:30 +01:00
Mike Auty f1613a78b3 Objects: Use contextlib instead of finally 2020-07-01 20:24:30 +01:00
Mike Auty 1cdcd8d811 Core: The has-valid-members interface bumps the version 2020-07-01 20:24:30 +01:00
Mike Auty 6f1001f290 Objects: Add in the ability to test for member validity 2020-07-01 20:24:30 +01:00
Mike Auty 4b29cf1986 Objects: Fix incorrect pointer readability check 2020-06-28 19:32:37 +01:00
Mike Auty 888b432667 Mac: Fix an error decoding bad UTF-8 values 
Closes #228.
 2020-06-28 01:07:16 +01:00
Mike Auty d28e573c18 Renderers: Fix python deprecation warnings 2020-06-27 18:34:43 +01:00
Mike Auty ac1d99677d ISF: Support deprecating versions 2020-06-27 18:33:30 +01:00
Mike Auty cd9a46ebd1 Resources: Ensure we close all file pointers 2020-06-27 18:29:51 +01:00
Mike Auty cf988944b9 Linux: Correct the ASLR for pre-masking (KASLR is still incorrect) 2020-06-23 16:56:40 +01:00
Hanno Heinrichsandikelos deb2b78312 Clear symbol cache after ASLR computation on Linux. 2020-06-23 16:45:22 +01:00
Hanno Heinrichsandikelos 30226d2bdd Fix find_aslr() function invocation for Linux. 2020-06-23 16:10:05 +01:00
Mike Auty abb1f3d71c Renderers: Fix inaccurate old code 2020-06-22 19:26:37 +01:00
Mike Auty 99a8c69e75 Renderers: Support partial results during population 2020-06-22 19:26:37 +01:00
Mike Auty 16a8e3771b Objects: Make bool an int 
We can't inherit from bool, so __new__ can't return a bool, so
everything has be done with int.  However __bool__ is already
defined for int, so it should have no significant impact
(other than type() calls).

Fixes issue 232.
 2020-06-18 16:53:14 +01:00
Mike Auty 0ffe318cb0 Project: Update copyright headers for files added in 2020. 2020-06-10 21:13:37 +01:00
Mike Auty d3ba947a56 Mac: Fix case names of certain plugins 
Closes #201.
 2020-06-10 21:02:16 +01:00
Mike Auty c134cf6eca Timeliner: Improve the option name 2020-06-10 20:33:04 +01:00
Mike Auty 1fe9cbd51d timeliner: Add the bodyfile output requirement switch to the plugin 2020-06-10 20:33:04 +01:00
Mike Auty 32fb2364a1 Timeliner: Ensure blank lines aren't printed. 2020-06-10 20:33:04 +01:00
Mike Auty fc27efc252 Add in body-file output support. 2020-06-10 20:33:04 +01:00
Mike Auty 5921671b38 timeliner: Yield as soon as we have output 2020-06-10 20:33:04 +01:00
Mike Auty b9d0cf17e3 Fix the output of exceptions with timeliner. 2020-06-10 20:33:04 +01:00
Mike Auty 80e2117c94 Layers: QEMU add in slow warning 2020-06-10 20:22:35 +01:00
Mike Auty 2bf8247b62 Layers: Extend segments to include original size as well as mapped size. 2020-06-10 20:22:35 +01:00
Mike Auty d0d7ea84b9 Layers: Remove debugging statement 2020-06-10 20:22:35 +01:00
Mike Auty df644ef5b7 Layers: Improve QEMU format support 2020-06-10 20:22:35 +01:00
Mike Auty 880bd0a2e0 Layers: Qemu only record segment data for pc.ram 2020-06-10 20:22:35 +01:00
Mike Auty 6564f0a3a4 Layers: Add in initial qemu layer code 2020-06-10 20:22:35 +01:00
Mike Auty 1a00723cb0 Core: Drastically reduce the import logging 2020-06-10 19:47:48 +01:00
Mike Auty 4437c29790 Symbols: Ensure all formats support symbol_shift (thanks Andrew!) 2020-06-10 19:39:20 +01:00
Mike Auty ede5ba07aa Symbols: Apply symbol_masking option to IntermediateSymbolTables 2020-06-10 19:39:20 +01:00
Mike Auty 085ccc47e0 SymbolTableRequirement: Do a merry dance around ASLR shifts in automagic 2020-06-10 19:39:20 +01:00
Mike Auty d6741435ef SymbolTables: Clear out the clone method and tidy up inheritance 2020-06-10 19:39:20 +01:00
Mike Auty d11ffa1f23 SymbolTable: Remove the no longer necessary mask_symbol_table method 2020-06-10 19:39:20 +01:00
Mike Auty 573590878a SymbolTable: Rework symbol_shift so it's part of the config 2020-06-10 19:39:20 +01:00
Mike Auty ad8fa0e934 Automagic: Improve mask/shift documentation 2020-06-10 19:39:20 +01:00
Mike Auty a6cd344e22 Automagic: Refactor ASLR finding for all symbol_finder using OSes 2020-06-10 19:39:20 +01:00