WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-18 04:45:41 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,296 Commits 80 Branches 17 Tags
orphan_kernel_threads
Commit Graph
4296 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Andrew Case 4073524dc1 Add the orphan_kernel_threads plugin to help detect rootkits on Windows systems 2024-07-20 12:21:45 -05:00
Mike Auty be5423f786 Windows: Fix up broken imports in info plugin 2024-07-17 17:08:15 +01:00
ikelosandGitHub 30dff64967 Merge pull request #1080 from gcmoreira/linux_netfilter_hooks_plugin 
Linux netfilter hooks plugin
 2024-07-16 22:59:53 +01:00
ikelosandGitHub 727cd878c0 Merge pull request #1176 from volatilityfoundation/unloadedmodules 
#1175 - initial unloadedmodules plugin
 2024-07-16 22:51:33 +01:00
Gustavo Moreira cf6c7fb1f4 linux.netfilter.Netfilter: Add lsmod version requirement check on AbstractNetfilter 2024-07-16 09:38:49 +10:00
Dave Lassalle 7e3615335c #1175 - config_path change 2024-07-15 15:40:22 -05:00
ikelosandGitHub 50dbeac080 Merge pull request #1190 from gcmoreira/windows_psscan_fix 
Windows - psscan plugin fixes
 2024-07-15 18:09:45 +01:00
Gustavo Moreira a6d8ba8bfa windows eprocess validation: Make the creation and exit year checks dynamic 2024-07-15 20:22:40 +10:00
Gustavo Moreira ac9236cb43 linux.netfilter.Netfilter: Add LinuxUtilities version requirement check on AbstractNetfilter 2024-07-15 19:59:41 +10:00
ikelosandGitHub ccaa473972 Merge pull request #1199 from volatilityfoundation/issues/python-3.8 
Core: Bump the version and minium python to support pip
 2024-07-14 19:12:49 +01:00
Mike Auty 61e3e894ee Core: Bump the version and minium python to support pip 2024-07-14 19:04:06 +01:00
ikelosandGitHub d3345259ac Merge pull request #1157 from branchvincent/full-extra 
add full and dev extras
 2024-07-14 18:58:41 +01:00
ikelosandGitHub e8dc54a4b8 Merge pull request #1173 from brandon-barnacle/bbarnacle/windows-modscan-modules 
Windows: Bug fixes and additions to modules and modscan
 2024-07-14 18:37:38 +01:00
ikelosandGitHub d077fa06be Merge pull request #1192 from volatilityfoundation/issues/issue1162 
Implement the fix that was reverted as part of #1162.
 2024-07-14 18:20:15 +01:00
ikelosandGitHub 987ecaf5ed Merge pull request #1193 from volatilityfoundation/issues/issue1155 
Initial draft of complete-vad vadyarascan
 2024-07-14 15:16:35 +01:00
Brandon BarnacleandBrandon Barnacle 8d60e9160f PR comment changes. 2024-07-08 09:40:19 -04:00
Brandon BarnacleandBrandon Barnacle b35169d0bc Windows: Bug fixes and additions to modules and modscan 
This pull request adds several changes to the modules and modscan
plugins that fix bugs, unify options and operations, and allow for
filtering by name and base address in both plugins. Previously,
modscan and modules had a substantial amount of partially duplicated
code, which led to bugs, such as:
	Only one allowed filtering by --name
	Only one cycled through the session layers to find the one hosting the kernel module
With the new inheritance and combined implementation, the correct
and complete implementation applies to both.

This PR also addresses the feedback in
https://github.com/volatilityfoundation/volatility3/pull/1099. In this PR,
--name and –base apply to the processing of modules and determine
both which plugins are displayed in output as well as which are
processed for extraction. This fixes the issue of using --filters, which
only filters the final command line output, but leads to every module
being extracted.
 2024-07-08 09:40:02 -04:00
Mike Auty ac15840fd8 Windows: Fix up yara plugin code scanning warnings 2024-07-07 15:23:48 +01:00
Mike Auty bb4cfb6e00 Initial draft of complete-vad vadyarascan 2024-07-07 15:13:06 +01:00
Mike Auty 4938195113 Implement the fix that was reverted as part of #1162. 2024-07-06 17:04:51 +01:00
ikelosandGitHub 1d4a27ea41 Merge pull request #1170 from volatilityfoundation/hollow_process 
Add new plugin to detect hollowed processes using a variety of techni…
 2024-07-05 19:10:28 +01:00
ikelosandGitHub 41c6963cb3 Merge pull request #1183 from hsarkey/hsarkey/windows-dlllist 
Windows: Adding name & base filtering for --dump on dlllist
 2024-07-05 18:50:46 +01:00
atcuno 96a382ed52 Further type information 2024-07-05 09:33:34 -05:00
Hannah SarkeyandGitHub 43fa84d2d1 Update dlllist.py to have more detailed --base description 2024-07-04 21:33:55 -04:00
ikelosandGitHub 4f69638d4d Merge pull request #1110 from dgmcdona/dgmcdona/windows-callbacks 
Windows: Add support for missing callback types
 2024-07-04 23:04:55 +01:00
ikelosandGitHub 1e58547aa9 Merge pull request #1191 from gcmoreira/fix_text_renderer_hexdump 
Fix hexdump text render. Set default to 16 bytes width
 2024-07-04 19:46:20 +01:00
Gustavo Moreira 52e6812d39 Fix hexdump text render. Set default to 16 bytes width 2024-07-04 14:03:59 +10:00
Gustavo Moreira fcc9eab471 Improve smear protection on windows processes validation 2024-07-04 13:09:12 +10:00
Gustavo Moreira b36fd84ab5 Handle virtual_process_from_physical() invalid address exceptions to prevent psscan from breaking 2024-07-04 13:07:17 +10:00
David McDonald 4d6f4bba0d Windows: Add version to driverirp.DriverIrp plugin 
This plugin class was missing a `_version` attribute, so I added one and
set it to (1, 0, 0).
 2024-07-03 17:15:16 -05:00
David McDonald 55881535bb Windows: Callbacks - parse missing callback types 
Updates the Windows callbacks plugin to support several types of
callbacks that were present in the original volatility framework, but
were missing in volatility3. Adds an extension for `_SHUTDOWN_PACKET`
structures for determining validity of structure.
 2024-07-03 17:15:16 -05:00
David McDonald 89b024d8f5 Framework: Fix bad format string 
Fixes a bad format string inside of a raised exception
 2024-07-03 16:54:43 -05:00
David McDonald acc41c2b86 Windows: Callbacks - update symbol files 
Updates the windows callbacks symbol files to include structures that
were missing from the original volatility plugin.
 2024-07-03 16:54:43 -05:00
ikelosandGitHub 0da48fa23a Merge pull request #1172 from volatilityfoundation/threads 
Add threads and suspicious_threads plugins. Condense code for re-use
 2024-07-03 21:05:11 +01:00
atcuno 020005f43c Address feedback from ikelos 2024-07-03 09:55:07 -05:00
atcuno 857cd8df49 Updates from ikelos' feedback 2024-07-02 19:14:15 -05:00
Hannah SarkeyandGitHub 06a2c0c76c Merge branch 'volatilityfoundation:develop' into hsarkey/windows-dlllist 2024-06-26 12:10:11 -04:00
ikelosandGitHub ac5769cf86 Merge pull request #1178 from dgmcdona/dgmcdona/windows_poolscan_layer_bug 
Windows: fixes scanner bug for versions < win10
 2024-06-23 11:08:39 +01:00
Mike Auty 7ece5fb1bf Windows: Improve Virtmap error messages slightly 2024-06-23 00:16:32 +01:00
ikelosandGitHub 351db0e573 Merge pull request #1171 from Abyss-W4tcher/crash_layer_issue_509 
fix #509 and simplify logic in crash layer _load_segments
 2024-06-22 09:30:02 +01:00
David McDonald 898c0844c4 Windows: fixes scanner bug for versions < win10 
This commit fixes a bug where the `layer_name` gets discarded when
constructing objects. Previously, it was assumed that we would not want
to construct an object for a module with a layer_name different from that
of the module. However, because we switch to scanning the memory layer on
samples where the version is < 10, but still construct kernel executive
objects based on the result of the memory layer scan, we actually do
sometimes need to specify a different layer.
 2024-06-21 18:47:48 -05:00
Dave Lassalle b601250279 #1175 - initial unloadedmodules plugin 2024-06-21 08:29:50 -05:00
atcuno ed140e9ac4 placeholder 2024-06-20 13:06:43 -05:00
Abyss Watcher c688744f66 revert useless for-else 2024-06-20 04:16:32 +02:00
Abyss Watcher a68a482632 fix #509 and simplify logic in _load_segments 2024-06-20 04:00:20 +02:00
atcuno 178f7c45f7 formatting fixes 2024-06-19 20:13:04 -05:00
atcuno 02bda980d4 formatting fixes 2024-06-19 20:12:07 -05:00
atcuno 3d1b9ef2bc Add new plugin to detect hollowed processes using a variety of techniques and allowing for easy additions of future detection techniques 2024-06-19 20:09:05 -05:00
ikelosandGitHub b187dd9686 Merge pull request #1165 from volatilityfoundation/notes_bleed_through 
The notes variable is not reset for each VAD, allowing bleed through …
 2024-06-15 10:51:46 +01:00
atcuno 59f6a05068 The notes variable is not reset for each VAD, allowing bleed through of a previously set note value to VADs enumerated afterwards 2024-06-14 16:45:54 -05:00