atcuno
f48afb520c
Prevent smeared Linux processes from breaking linux.pslist
2024-03-08 14:01:29 -06:00
ikelos and GitHub
148e46db75
Merge pull request #1108 from Abyss-W4tcher/mac_dmesg
...
macOS dmesg plugin support
2024-03-04 20:42:52 +00:00
ikelos and GitHub
5b2d95a91f
Merge pull request #1107 from Abyss-W4tcher/mac_process_memory_dump
...
Mac process memory dump
2024-03-04 20:41:35 +00:00
ikelos and GitHub
9189fb6589
Merge pull request #1109 from Abyss-W4tcher/cli_list_of_ints_as_hex
...
CLI : pass integers as 0x hexadecimal format in ListRequirement
2024-03-04 20:38:36 +00:00
Abyss Watcher
1f9a983f49
correct use of SymbolError
2024-03-04 20:38:01 +01:00
Abyss Watcher
f4b12c6406
allow ints in the 0x format in ListRequirement
2024-03-04 20:26:18 +01:00
Abyss Watcher
9914f339df
simplify addrs_in_vma check
2024-03-04 20:19:15 +01:00
Abyss Watcher
69a6c7d5b7
revert int as hex format commit
2024-03-04 20:16:55 +01:00
Abyss Watcher
98705e110d
more specific msg_bufx comment
2024-03-04 20:12:12 +01:00
Abyss Watcher
1bf18dbd8a
implicit pointer dereference
2024-03-04 20:11:50 +01:00
Abyss Watcher
403804431a
prefer SymbolError to TypeError
2024-03-04 20:11:17 +01:00
Mike Auty
373bf9dfaa
Windows: Fix driverirp black issue
2024-03-04 18:33:03 +00:00
ikelos and GitHub
fbcaeccf7d
Merge pull request #857 from volatilityfoundation/driverirp_hidden_module_support
...
Report IRP entries that point inside a hidden module. This is a commo…
2024-03-04 14:58:45 +00:00
ikelos and GitHub
d4b92db446
Merge pull request #960 from RuBublik/poolscanner-thread-support
...
Add threads pool tag scanning
2024-03-04 14:58:04 +00:00
ikelos and GitHub
110d9bef4a
Merge pull request #1101 from gcmoreira/linux_library_list_plugin
...
Linux: Add linux.library_list.LibraryList plugin
2024-03-04 12:33:13 +00:00
Gustavo Moreira
cb6f8c5072
Rename methods to be private
2024-03-04 20:47:49 +11:00
ikelos and GitHub
0fac32465f
Merge branch 'develop' into poolscanner-thread-support
2024-03-03 23:48:24 +00:00
ikelos and GitHub
cd81dfc8a5
Merge pull request #1106 from volatilityfoundation/feature/python3.12
...
Documentation: Fix up syntax errors involving * character
2024-03-03 23:21:48 +00:00
Abyss Watcher
2f0bb6b297
do not strip each line
2024-03-02 18:39:48 +01:00
Abyss Watcher
8d79e3211b
prefer TypeError to vollog.error
2024-03-02 17:30:51 +01:00
Abyss Watcher
caf108b604
macOS dmesg plugin support
2024-03-02 17:17:48 +01:00
Abyss Watcher
3040bc5fc2
add --dump mechanism, similarly to linux.proc
2024-03-01 14:20:13 +01:00
Abyss Watcher
d56ccbfd0b
allow specifying integers as 0x in ListRequirement
2024-03-01 14:18:30 +01:00
Gustavo Moreira
b681438ddc
Remove unnecessary 'pass' statement.
2024-02-29 16:21:34 +11:00
Gustavo Moreira
3c9af096e1
Add missing PAGE_SHIFT replacement
2024-02-29 16:17:47 +11:00
Gustavo Moreira
9b0915dc85
Add logging for unknown ELF types
2024-02-29 15:36:46 +11:00
Gustavo Moreira
e6bc0c4100
Update author and modification time
2024-02-29 15:34:48 +11:00
Gustavo Moreira
d5a0543a2d
Use the ELF class constant instead of hardcoding a value. Fixed some f-strings
2024-02-29 15:34:20 +11:00
Gustavo Moreira
338106dfe8
Move the memory page parameters to the Intel layer
2024-02-29 14:46:35 +11:00
Mike Auty
0899ba8d7f
Documentation: Fix up syntax errors involving * character
2024-02-28 23:09:46 +00:00
ikelos and GitHub
887747e3ce
Merge pull request #1098 from volatilityfoundation/feature/output-filter
...
Implement CLI support for filtering out rows during output
2024-02-22 11:00:14 +00:00
ikelos and GitHub
90de493f78
Merge pull request #1100 from adiego8/windows-psscan-offset
...
Windows: Add filtering by offset to psscan
2024-02-22 10:59:47 +00:00
ikelos and GitHub
0cfc466924
Merge pull request #1093 from eve-mem/linux_issue_1089_module_memory
...
Linux: fix issue 1089 module memory
2024-02-22 10:56:36 +00:00
ikelos and GitHub
499f70d339
Merge pull request #1103 from eve-mem/linux_psscan_memory_layer_name_optimisation
...
Linux: psscan tiny update so that memory_layer_name is reused
2024-02-22 10:26:23 +00:00
Eve
a82b93523d
Linux: psscan tiny update so that memory_layer_name is reused
2024-02-22 09:47:23 +00:00
Eve
77675d584d
Update patch version
2024-02-21 14:26:48 +00:00
Eve
3b5fde9420
Linux: update module extension logic for choosing the correct values for different kernel versions
2024-02-21 12:58:24 +00:00
Eve
e10cff979a
Linux: update module extension with memoization for _mod_mem_type
2024-02-21 12:50:05 +00:00
Eve and GitHub
abbfa7d295
Merge branch 'volatilityfoundation:develop' into linux_issue_1089_module_memory
2024-02-21 11:51:54 +00:00
Alejandro Diego
42c6a9ede6
Remove unnecessary import and correctly filter_func var
2024-02-20 20:19:02 -05:00
ikelos and GitHub
1ccbf33c04
Merge pull request #1096 from eve-mem/linux_update_mm_extension
...
Linux update mm extension
2024-02-20 21:01:23 +00:00
Alejandro Diego
5e38ffa811
Added support for virtual address filtering and validation of ph/v space
2024-02-20 15:07:15 -05:00
Eve
a597ee1776
Linux: update minor version number due to API changes with linux extension for mm_struct
2024-02-20 06:48:16 +00:00
Eve
437a91375d
Linux: add TODO for mm_struct for methods that should be removed when moving to version 3.0.0
2024-02-20 06:39:42 +00:00
Alejandro Diego
cd08cb95fd
Windows: Add filtering by offset to psscan
...
Add capability to the psscan plugin to filter by specific offset.
The filter would be used by other plugins to find specific offset using the psscan capabilities, like find
hidden processes as a result of some dkom for example.
The `--offset` flag argument should represent a physical address space.
The flag is included in the following plugins:
- dlllist
- handles
2024-02-19 13:35:31 -05:00
ikelos and GitHub
3703e119ce
Merge pull request #1084 from volatilityfoundation/feature/table-check
...
Symbols: Add support for metadata verification of symbol tables
2024-02-18 22:19:14 +00:00
Gustavo Moreira
cf81ceda82
Fix CodeQL suggestion
2024-02-13 20:20:25 +11:00
Gustavo Moreira
6e7b5b5941
Linux: Add linux_library_list test case
2024-02-13 19:41:30 +11:00
Gustavo Moreira
cc35fecf91
Linux: Add library_list plugin and other ELF related code enhacements.
...
- Add library_list plugin
- Add ELF dynamic table enum types in elf.json
- Update missing program header enum types in elf.json
- Add PAGE constants
- Add ELF ident and class enums
- Replace ELF hardcoded type numbers for enum description matching
- Fix unmanaged ValueError exception issue in Elf64Layer::_load_segments()
2024-02-13 19:40:37 +11:00
Eve
53d4ec66eb
Linux: Remove unnecessary import from linux extension.
2024-02-12 09:36:33 +00:00
atcuno