WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-26 19:44:50 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,219 Commits 80 Branches 18 Tags
issue_197_windows_dumpfiles_debug_parent
Commit Graph
494 Commits
Author SHA1 Message Date
iMHLv2 e8245289d2 add debugging and parent chain walking 2020-07-17 10:22:07 -05:00
iMHLv2 0bae72f4f2 refs #197 initial commit of windows.dumpfiles 2020-07-17 09:35:19 -05:00
Michael Lighandikelos 87ff6dd87c refs #200 raise ValueError if an object doesn't have a name 2020-07-01 20:51:22 +01:00
Mike Auty ac1d99677d ISF: Support deprecating versions 2020-06-27 18:33:30 +01:00
Hanno Heinrichsandikelos deb2b78312 Clear symbol cache after ASLR computation on Linux. 2020-06-23 16:45:22 +01:00
Mike Auty 6564f0a3a4 Layers: Add in initial qemu layer code 2020-06-10 20:22:35 +01:00
Mike Auty 4437c29790 Symbols: Ensure all formats support symbol_shift (thanks Andrew!) 2020-06-10 19:39:20 +01:00
Mike Auty ede5ba07aa Symbols: Apply symbol_masking option to IntermediateSymbolTables 2020-06-10 19:39:20 +01:00
Mike Auty 085ccc47e0 SymbolTableRequirement: Do a merry dance around ASLR shifts in automagic 2020-06-10 19:39:20 +01:00
Mike Auty d6741435ef SymbolTables: Clear out the clone method and tidy up inheritance 2020-06-10 19:39:20 +01:00
Mike Auty d11ffa1f23 SymbolTable: Remove the no longer necessary mask_symbol_table method 2020-06-10 19:39:20 +01:00
Mike Auty 573590878a SymbolTable: Rework symbol_shift so it's part of the config 2020-06-10 19:39:20 +01:00
Mike Auty ad8fa0e934 Automagic: Improve mask/shift documentation 2020-06-10 19:39:20 +01:00
Mike Auty a6cd344e22 Automagic: Refactor ASLR finding for all symbol_finder using OSes 2020-06-10 19:39:20 +01:00
Mike Auty 054b95c8ed Remove debugging statements 2020-06-10 19:39:20 +01:00
Mike Auty d9ac5300fa Move from using deepcopy to a clone method. 2020-06-10 19:39:20 +01:00
Mike Auty 2748ce32d8 Initial attempts at cloning a symbol table 2020-06-10 19:39:20 +01:00
Mike Auty fabb4f4924 Store and re-store the original get_symbol method masking 2020-06-10 19:39:20 +01:00
Mike Auty a0da5fef83 Issue #186: Rebase and apply yapf 2020-05-27 23:16:18 +01:00
superponibleandikelos a21ab89019 issue #186 - add bigpools plugin 2020-05-27 23:16:18 +01:00
superponibleandikelos e969f44471 issue #186 - _CMHIVE.is_valid() 2020-05-27 23:16:18 +01:00
Mike Auty 0c43beb42d Core: Apply yapf across all files again. 2020-05-05 22:14:33 +01:00
Mike Auty 2cd6a9478f Intermed: Resolve unintended change of length to size and issue with anonymous checking 2020-04-03 00:00:57 +01:00
Mike Auty be1faa91a5 Initial attempt at resolving anonymoous fields. 2020-03-26 13:32:30 +00:00
Andrew Caseandikelos 7b21e83b07 Mac - convert socket gathering to class method and clean up associated code 2020-03-12 19:47:15 +00:00
Tamas K Lengyelandikelos 6a6cf37b02 pdbconv: save _imp functions in JSON 2020-02-14 09:20:15 +00:00
Andrew Caseandikelos a60bef3283 Mac - update queue walking code 2020-02-12 21:04:23 +00:00
Michael Lighandikelos 4c7f2a3762 catch InvalidAddressException when traversing left and right child VADs (triggered on terminated processes) 2020-02-12 19:19:27 +00:00
Andrew Caseandikelos ab42f0941c Add sysctl docstrings and return types 2020-02-12 19:17:19 +00:00
Andrew Caseandikelos 29cc435b5e update sysctl v2 2020-02-12 19:17:19 +00:00
Mike Auty 7873a65999 Procdump: Don't loop through twice without good reason. 2020-02-12 19:07:24 +00:00
Mike Auty 6e38727ffe Mac: Refactor/optimize repeated code. 2020-01-28 01:37:21 +00:00
Mike Auty f111e9e051 Mac: Ensure queues error check all entries, not just the first. 2020-01-28 01:37:21 +00:00
Mike Auty a3def09a13 Registry: Optimize calls to DataLength and improve documentation. 2020-01-15 22:59:58 +00:00
Mike Auty 3f5b96f3c7 Yapf: Clean-up the whole codebase. 2020-01-14 15:44:07 +00:00
Michael Lighandikelos e80e9e09b6 the hand-written 32-bit windows 10 service record types were missing the Tag member 2020-01-05 01:53:52 +00:00
Andrew Caseandikelos 65556a2c92 Linux - update handling of kernels that do not have loadable module support 2020-01-03 17:50:06 +00:00
Mike Auty 83a8afba6b Objects: Simplify get_symbol_table to get_symbol_table_name. 2019-12-04 23:41:27 +00:00
Mike Auty 386f94d9ee Pool: Make object_header type checking the plugin's responsibility. 2019-12-04 22:11:42 +00:00
Mike Auty 8691c68604 Pool: Refactor pool extension to its own file. 2019-12-04 22:11:42 +00:00
Mike Auty 1eea645da0 EPROCESS: Wrap get_peb functions in error handlers 2019-12-04 21:13:19 +00:00
Mike Auty 17247426d8 pdbconv: Avoid more name-collisions 
Previously we allow name-collisions for types with name <anonymouos-tag>
so this has now been resolved, as well as descending too deeply down the
type to tree determine the size of array occassionally.
 2019-12-04 20:04:22 +00:00
xabiugarteandikelos 35abb343da Raise exception instead of return None 2019-12-04 20:02:31 +00:00
xabiugarteandikelos 3545ab7746 Fixes on pydoc, types, exception catching 2019-12-04 20:02:31 +00:00
xabiugarteandikelos c9520dc37f Remove extra line 2019-12-04 20:02:31 +00:00
xabiugarteandikelos 11d3d304ba Refactor get_peb functionality in EPROCESS 2019-12-04 20:02:31 +00:00
xabiugarteandikelos a6944f7a06 Add InitOrder and MemOrder functions to EPROCESS 2019-12-04 20:02:31 +00:00
xabiugarteandikelos 949a2a2ddc Change unsigned long long by pointer 2019-12-02 13:07:04 +00:00
xabiugarteandikelos 8da9d90c19 Small fix on EPROCESS is_valid 2019-12-02 13:07:04 +00:00
xabiugarteandikelos 1123ed074d Tiny fix in EPROCESS.is_valid 2019-12-02 13:07:04 +00:00