WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-11 04:07:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,219 Commits 80 Branches 17 Tags
issue_197_windows_dumpfiles_debug_parent
Commit Graph
345 Commits
Author SHA1 Message Date
Mike Auty 4cccbc2f69 Automagic: Fix os_chooser method 
Two issues found:
* the plugin hierarchy always start volatility.plugins, so we need
to go to index 2.
* the layers weren't loaded at the time the stacker list was generated
so all other stackers failed.
 2020-07-02 19:33:32 +01:00
Mike Auty 55dd1c6c2c Automagic: Fix bad default parameter 2020-07-02 19:33:32 +01:00
Mike Auty 16c2ddb837 Automagic: Change stackers to including an exclusion list 2020-07-02 19:33:32 +01:00
Mike Auty 33d1c696e5 Automagic: Allow stackers to be configurable 2020-07-02 19:33:32 +01:00
Mike Auty 944bf2174f Automagic: Split out the stacker code 2020-07-01 20:30:31 +01:00
Mike Auty cf988944b9 Linux: Correct the ASLR for pre-masking (KASLR is still incorrect) 2020-06-23 16:56:40 +01:00
Hanno Heinrichsandikelos deb2b78312 Clear symbol cache after ASLR computation on Linux. 2020-06-23 16:45:22 +01:00
Hanno Heinrichsandikelos 30226d2bdd Fix find_aslr() function invocation for Linux. 2020-06-23 16:10:05 +01:00
Mike Auty ede5ba07aa Symbols: Apply symbol_masking option to IntermediateSymbolTables 2020-06-10 19:39:20 +01:00
Mike Auty 085ccc47e0 SymbolTableRequirement: Do a merry dance around ASLR shifts in automagic 2020-06-10 19:39:20 +01:00
Mike Auty 573590878a SymbolTable: Rework symbol_shift so it's part of the config 2020-06-10 19:39:20 +01:00
Mike Auty a6cd344e22 Automagic: Refactor ASLR finding for all symbol_finder using OSes 2020-06-10 19:39:20 +01:00
Mike Auty 863b9915c9 Automagic: Refactor mac aslr_finding 2020-06-10 19:39:20 +01:00
Mike Auty 204657648a Linux: Narrow in on a particular symbol table 2020-06-10 19:39:20 +01:00
Mike Auty 2748ce32d8 Initial attempts at cloning a symbol table 2020-06-10 19:39:20 +01:00
Mike Auty 94426ad313 Automagic: Ensure all layers can be reconstructed 2020-05-10 19:30:58 +01:00
Mike Auty 0c43beb42d Core: Apply yapf across all files again. 2020-05-05 22:14:33 +01:00
Mike Auty 4587de356d Fix issue with cleaning the symbol cache 2020-05-02 01:16:06 +01:00
Mike Auty 8935e4dd19 Fix up linuxutils to use symbol_tables rather than hard coded values 2020-04-10 22:12:03 +01:00
Andrew Caseandikelos b42dfd614a Add API for mapping kernel addresses to kernel symbols or a specific kext 2020-04-08 18:17:34 +01:00
Andrew Caseandikelos 7d6d74bc91 Update order of arguments 2020-03-12 19:47:15 +00:00
Andrew Caseandikelos 722700d2dc Add docstrings 2020-03-12 19:47:15 +00:00
Andrew Caseandikelos 7b21e83b07 Mac - convert socket gathering to class method and clean up associated code 2020-03-12 19:47:15 +00:00
Mike Auty 77be83edc4 Layers: Change mapping signature to return domain length 2020-03-04 20:29:42 +00:00
Mike Auty a2ac55ba0b Wintel: Reorder the DTB tests 
Reorder the DTB tests, since 64-bits have more to match and are likely
more common these days.  We've had an instance where a 32-bit DTB was
detected because of a self-referential pointer over a 64-bit DTB leading
to an inaccessible image.

This fixes issue #193.
 2020-03-04 20:28:52 +00:00
Mike Auty 920b85743b Revert "Automagic: Add excessive debugging to symbol cache" 
This reverts commit db8ba4029c.
 2020-01-30 01:58:07 +00:00
Mike Auty db8ba4029c Automagic: Add excessive debugging to symbol cache 2020-01-30 01:34:30 +00:00
Mike Auty d36545d4c0 Automagic: Fix mac typing signature issues 2019-11-27 11:30:14 +00:00
Mike Auty 31ddbaaa2e Typing: Fix python3 format string/byte output issues 2019-11-27 11:30:14 +00:00
Mike Auty a85f6f80f8 Linux automagic: Add support for more recent init_top_pgt symbol. 2019-11-22 22:40:52 +00:00
Mike Auty dcf5b1f68c Stackers: Update the stack orders to try quick header check layers first 2019-11-16 12:53:56 +00:00
Mike Auty 373442ac24 pdbscan: Fix up permission error creating directories 2019-11-04 10:57:30 +00:00
xabiugarteandikelos bdee51fef0 Check progress_callback is not None before call 
Followed the same approach as in
    volatility/framework/symbols/windows/pdbconv.py
 2019-10-23 09:56:55 +01:00
Mike Auty 71e082f25f Ensure the layers are loaded on layer stacker run, not just when a layer is stacked. 2019-10-07 01:52:58 +01:00
Mike Auty d3f1a396da Handle JSON errors when caching banners. 2019-10-04 22:50:25 +01:00
Andrew Caseandikelos a4a918ea58 Suggested changes from ikelos 2019-09-27 20:50:21 +01:00
Mike Auty c00b820f74 Fix up recent Mac PagedInvalidAddress additions. 2019-09-27 11:21:49 +01:00
Mike Auty 153b3b7d39 Make sure we catch the most general exception for what we mean. 2019-09-27 11:19:53 +01:00
Andrew Case b4ad15c226 Mac - update lsof to inherit from tasks and be more smear resistant 2019-09-26 21:56:38 -05:00
Mike Auty 066a4e64f2 Minor fix for construct_layers. 2019-09-26 21:16:46 +01:00
Mike Auty ae010a2390 Improve log levels and distribution of messages. 2019-09-26 21:16:12 +01:00
Mike Auty 211ad0d524 Remove useless calls to validate. 2019-09-26 15:58:22 +01:00
Mike Auty e0b9d72c84 Update the license URL and LICENSE.txt 2019-09-25 21:44:05 +01:00
Mike Auty 72567e1c50 Yapf-0.28.0 rerun across the whole codebase. 2019-09-21 21:08:23 +01:00
Mike Auty dad88692b8 Minor improvements for pyinstaller packages. 2019-09-21 21:06:05 +01:00
Mike Auty fc2ee7e401 Improve plugin category detection for systems such as volshell. 2019-09-16 11:36:43 +01:00
Mike Auty 421af88c29 Classmethod make_subconfig so other classmethods can use it. 2019-09-08 14:50:48 +01:00
Mike Auty 10ea65a236 Remove unnecessary imports. 2019-09-08 14:19:58 +01:00
Mike Auty ffc7682d61 Ensure that layers are automatically imported when needed. 2019-09-08 14:13:28 +01:00
Mike Auty e922cef316 Improve docstrings for all plugins, and reformat all docstrings. 2019-09-07 22:59:54 +01:00