 Gustavo Moreira
|
241cf832f9
|
Plugin parameters removed. Instead, it now shows each capability set in their textual representation. The dictionary was replaced by a dataclass.
Last but not leas, CAP_FULL moved to constants.
|
2023-07-10 00:07:40 +02:00 |
|
|
RuBublik
|
abf1c2e03d
|
fixed typos
|
2023-07-07 20:25:02 +03:00 |
|
|
RuBublik
|
524ff59107
|
bumped MINOR_VERSION to 2.5.2 after changes, and updated dependent thrdscan plugin's required version to this
|
2023-07-07 20:22:58 +03:00 |
|
|
Mike Auty
|
6c0ce1d130
|
Volshell: Typo Fixes #958
|
2023-07-01 20:58:36 +01:00 |
|
|
Mike Auty
|
66598f5b63
|
Core: Second fix is the charm...
|
2023-07-01 19:05:22 +01:00 |
|
|
Mike Auty
|
c8e53ff16a
|
Core: Fix small typing issue in previous patch
|
2023-07-01 19:02:51 +01:00 |
|
|
Mike Auty
|
50b5d2232b
|
Core: Add type parameter to object_from_symbol
|
2023-07-01 19:00:03 +01:00 |
|
|
Mike Auty
|
1ff2d80b44
|
Documentation: Update basics - memory layer information
|
2023-07-01 17:02:10 +01:00 |
|
|
Mike Auty
|
a9698e4e73
|
Documentation: minor fixes/updates
|
2023-07-01 17:01:33 +01:00 |
|
|
ikelosandGitHub
|
5aa0a64cfa
|
Merge pull request #884 from eve-mem/linux_proc_dump
First attempt at adding a --dump option to linux.proc
|
2023-06-18 15:07:19 +01:00 |
|
|
EveandGitHub
|
fa5af08c81
|
Merge branch 'develop' into linux_proc_dump
|
2023-06-18 07:34:45 +01:00 |
|
|
ikelosandGitHub
|
e17cb1532b
|
Merge pull request #970 from volatilityfoundation/issues/issue969
Windows: Fix VAD offset canonicalization
|
2023-06-16 19:01:21 +01:00 |
|
|
Mike Auty
|
aa04b8ca3d
|
Windows: Fix VAD offset canonicalization #969
|
2023-06-16 18:03:07 +01:00 |
|
|
ikelosandGitHub
|
2e577790d2
|
Merge pull request #962 from gcmoreira/fix_dentry_mem_smear_issue_961
Fix issue #961: Prevent potential dentry pointer memory smear
|
2023-05-30 17:51:05 +01:00 |
|
|
RuBublik
|
5d32ca542c
|
fix black formatting
|
2023-05-28 20:52:26 +03:00 |
|
|
Mike Auty
|
b9e5cfb393
|
Core: Protect from clearing a non-existant cache
Issue kindly raised by @garanews, thanks! 5:D
|
2023-05-22 15:05:43 +01:00 |
|
|
RuBublik
|
5072728e89
|
formated with black
|
2023-05-22 15:50:22 +03:00 |
|
|
RuBublik
|
9bdd249aad
|
added _version to ThrdScan
|
2023-05-22 15:39:12 +03:00 |
|
|
RuBublik
|
c6c501ecb5
|
implemented generate_timeline method in ThrdScan
|
2023-05-22 15:31:25 +03:00 |
|
|
RuBublik
|
bef5149ba6
|
changed TreeGrid yielded types to specific simpletypes instead of str
|
2023-05-22 11:39:38 +03:00 |
|
|
RuBublik
|
950a76d1e0
|
fixed typo
|
2023-05-22 11:17:23 +03:00 |
|
|
Gustavo Moreira
|
0f42f0eaf1
|
fix typo
|
2023-05-22 01:39:14 +01:00 |
|
|
Gustavo Moreira
|
bea981180d
|
Prevent potential dentry pointer memory smear
|
2023-05-22 01:32:00 +01:00 |
|
|
RuBublik
|
5749b3ef52
|
added test for thrdscan plugin
|
2023-05-21 19:22:22 +03:00 |
|
|
RuBublik
|
fab818b48d
|
added thrdscan plugin to utilize added support for ethread pool tag scanning
|
2023-05-21 18:24:01 +03:00 |
|
|
RuBublik
|
046c8e4d1e
|
fix of is_valid - removed reliace on owning _eprocess and added exclusion for system process (does not have creation time)
|
2023-05-21 18:18:02 +03:00 |
|
|
RuBublik
|
601870829e
|
twicked thread constraint for edge cases
|
2023-05-21 18:12:46 +03:00 |
|
|
RuBublik
|
0fd475e10b
|
added permanent implementation for 'ETHREAD.is_valid'
|
2023-05-20 15:49:09 +03:00 |
|
|
RuBublik
|
550d1096eb
|
temporary fix to ETHREAD class, add 'is_valid' method
|
2023-05-20 14:20:15 +03:00 |
|
|
Gustavo Moreira
|
f0bd978716
|
Fix typo
|
2023-05-20 12:17:09 +02:00 |
|
|
RuBublik
|
7469872c8b
|
added 'PoolConstraint' of Thread objects to 'PoolScanner.default_constraints' as part of adding support for thread pool tag scanning
|
2023-05-17 21:41:37 +03:00 |
|
|
Gustavo Moreira
|
4f5ca6116c
|
Add black recommendations
|
2023-05-17 16:07:56 +01:00 |
|
|
Gustavo Moreira
|
d5d318d3cf
|
Fix wrong constants module
|
2023-05-17 15:26:24 +01:00 |
|
|
Gustavo Moreira
|
3d9efc3b34
|
Added linux capabilities plugin
|
2023-05-17 14:14:33 +01:00 |
|
|
Eve
|
cd03c52fd3
|
Linux: Update linux.vmayarascan to use task.mm.get_vma_iter() which means it will work on linux kernels 6.1 and above
|
2023-05-12 13:37:15 +01:00 |
|
|
Eve
|
09b0c8e406
|
Linux: Update linux.vmayarascan and yarascan so that command line options are taken from the base yarascan plugin
|
2023-05-12 13:30:32 +01:00 |
|
|
Eve
|
860c947e17
|
Merge branch 'vmayarascan' of github.com:eve-mem/volatility3 into vmayarascan
|
2023-05-12 11:10:02 +01:00 |
|
|
EveandGitHub
|
d0d30dc87f
|
Merge branch 'volatilityfoundation:develop' into vmayarascan
|
2023-05-12 11:09:51 +01:00 |
|
|
Eve
|
8624e01644
|
Merge branch 'vmayarascan' of github.com:eve-mem/volatility3 into vmayarascan
|
2023-05-12 11:08:41 +01:00 |
|
|
Eve
|
b54bbfb88f
|
Update linux.vmayarascan to pull requirements from the generic yarascan plugin
|
2023-05-12 11:08:32 +01:00 |
|
|
Eve
|
57e8234e6c
|
remove unused variable in linux.vmayarascan
|
2023-05-12 11:08:32 +01:00 |
|
|
Eve
|
2279a83e3b
|
liniting for linux.vmayarascan
|
2023-05-12 11:08:32 +01:00 |
|
|
Eve
|
1a7ec07c28
|
add linux.vmayarascan based on windows.vadtarascan
|
2023-05-12 11:08:32 +01:00 |
|
|
Mike Auty
|
8e56cb39d1
|
Docs: Fix the documentation dependencies
|
2023-05-10 22:07:38 +01:00 |
|
|
Mike Auty
|
3f1797f7e5
|
Core: Change readthedocs build platform
Fixes #953
|
2023-05-10 21:57:59 +01:00 |
|
|
Mike Auty
|
e28b42731e
|
Core: Change readthedocs python version
Attempting to fix #953
|
2023-05-10 21:55:23 +01:00 |
|
|
ikelosandGitHub
|
2149231bb7
|
Merge pull request #949 from cpuu/mac-tutorial
Add tutorial for macOS Analysis
|
2023-05-10 11:11:21 +01:00 |
|
|
ikelosandGitHub
|
534f9be127
|
Merge pull request #928 from eve-mem/linux_maple_tree
Add basic support for Linux maple tree struct
|
2023-05-10 11:06:44 +01:00 |
|
|
ikelosandGitHub
|
e4db77d20a
|
Merge pull request #942 from gcmoreira/mountinfo_fixes
Mountinfo fixes
|
2023-05-10 11:03:32 +01:00 |
|
|
Gustavo Moreira
|
7516346b64
|
Adjust framework versioning
|
2023-05-10 10:55:19 +02:00 |
|