WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 02:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,049 Commits 80 Branches 17 Tags
threadpool
Commit Graph
457 Commits
Author SHA1 Message Date
Mike Auty 83a8afba6b Objects: Simplify get_symbol_table to get_symbol_table_name. 2019-12-04 23:41:27 +00:00
Mike Auty 386f94d9ee Pool: Make object_header type checking the plugin's responsibility. 2019-12-04 22:11:42 +00:00
Mike Auty 8691c68604 Pool: Refactor pool extension to its own file. 2019-12-04 22:11:42 +00:00
Mike Auty 1eea645da0 EPROCESS: Wrap get_peb functions in error handlers 2019-12-04 21:13:19 +00:00
Mike Auty 17247426d8 pdbconv: Avoid more name-collisions 
Previously we allow name-collisions for types with name <anonymouos-tag>
so this has now been resolved, as well as descending too deeply down the
type to tree determine the size of array occassionally.
 2019-12-04 20:04:22 +00:00
xabiugarteandikelos 35abb343da Raise exception instead of return None 2019-12-04 20:02:31 +00:00
xabiugarteandikelos 3545ab7746 Fixes on pydoc, types, exception catching 2019-12-04 20:02:31 +00:00
xabiugarteandikelos c9520dc37f Remove extra line 2019-12-04 20:02:31 +00:00
xabiugarteandikelos 11d3d304ba Refactor get_peb functionality in EPROCESS 2019-12-04 20:02:31 +00:00
xabiugarteandikelos a6944f7a06 Add InitOrder and MemOrder functions to EPROCESS 2019-12-04 20:02:31 +00:00
xabiugarteandikelos 949a2a2ddc Change unsigned long long by pointer 2019-12-02 13:07:04 +00:00
xabiugarteandikelos 8da9d90c19 Small fix on EPROCESS is_valid 2019-12-02 13:07:04 +00:00
xabiugarteandikelos 1123ed074d Tiny fix in EPROCESS.is_valid 2019-12-02 13:07:04 +00:00
Mike Auty b0b868d79c Typing: General typing fixes across the tree 2019-11-27 11:30:14 +00:00
Mike Auty 0e016797bb Typing: Change signatures to co-variant Mapping from Dict 2019-11-27 11:30:14 +00:00
Mike Auty 06c4a6dcc7 pdbconv: Swap the suffix ordering to make the less common option second. 2019-11-20 20:04:14 +00:00
Mike Auty 9928b40afb pdbconv: ResourceAccessor now logs the written file 2019-11-20 20:04:14 +00:00
Mike Auty cb41c5e960 Pdbconv: Switch pdb downloading to resource accessing 2019-11-20 20:04:14 +00:00
Mike Auty b99ace86fb Tidy up exceptions to be more accurate. 2019-11-13 19:58:14 +00:00
Mike Auty 40fcdf9469 exceptions: SymbolErrors now contain specific information 2019-11-13 19:27:00 +00:00
Mike Auty face38436e layers: Fix up uses of is_valid. 2019-11-12 09:09:51 +00:00
xabiugarteandikelos 5b04492463 Fix on 'end_bit' computation 2019-11-11 17:03:04 +00:00
Mike Auty 989f08eff2 Revert "EPROCESS: Fix is_valid check missing cast." 
This reverts commit 60eda0a52b.

Turns out, this is pull request #110, only done worse.
 2019-11-09 16:06:30 +00:00
Mike Auty 60eda0a52b EPROCESS: Fix is_valid check missing cast. 2019-11-09 15:56:19 +00:00
Mike Auty 73aa73f30e Ensure we test None using is rather than ==. 2019-11-03 22:46:20 +00:00
Mike Auty 6f73310d88 Add in initial Elf64 support. 2019-11-03 20:37:12 +00:00
Mike Auty ce2b83fc34 Add in support for sizing LF_ARGLISTs. Fixes issue #99. 2019-10-23 00:09:45 +01:00
atcuno 2cad54ea6b Windows - prevent LIST_ENTRY enumeration code from returning objects on invalid/not mapped pages 2019-10-17 10:27:14 -04:00
Mike Auty 2229c50de8 Remove executable bit from data files. 2019-10-13 10:09:10 +01:00
Mike Auty 3b656e337a Update windows extensions to ensure they're documented. 2019-10-02 20:25:54 +01:00
Mike Auty ba14e10d00 pdbconv: Ensure voids do not have a size 
This partially reverts e17427b9a0
which was an attempt to match other generators, but was inaccurate.
 2019-09-29 15:36:26 +01:00
Andrew Caseandikelos a4a918ea58 Suggested changes from ikelos 2019-09-27 20:50:21 +01:00
Andrew Caseandikelos bf29e23e1c add updated mac ifconfig support 2019-09-27 20:50:21 +01:00
Mike Auty c00b820f74 Fix up recent Mac PagedInvalidAddress additions. 2019-09-27 11:21:49 +01:00
Mike Auty 153b3b7d39 Make sure we catch the most general exception for what we mean. 2019-09-27 11:19:53 +01:00
Andrew Case eeb04655e6 Mac - smear protection in network address enumeration 2019-09-26 22:08:47 -05:00
Mike Auty 2acdc3e060 Fix up PADDING_INFO for very specific versions of windows. 2019-09-26 13:35:23 +01:00
Mike Auty e0b9d72c84 Update the license URL and LICENSE.txt 2019-09-25 21:44:05 +01:00
Mike Auty ee008cb76b Make sure we accurately check the PADDING_INFO presence. 2019-09-25 21:32:53 +01:00
Mike Auty 2252876375 Correct the PADDING_INFO handling. 2019-09-25 21:32:53 +01:00
Mike Auty 5a8946da83 Shift the InfoMask stuff into the top-down approach. 2019-09-25 21:32:53 +01:00
Mike Auty b0559656fc Update the header offsets for the InfoMask. 2019-09-25 21:32:53 +01:00
Mike Auty 6a3a6cdb3c Add this as more of an example of how to cache. 
In a volatility object, we can use our own internal _vol variable to
expose values externally, or just for us to cache.  It will override
preexisting values though, so when used as a cache, best to make its key
long and unique as possible.
 2019-09-25 21:32:53 +01:00
Mike Auty 0fd9bf2dbb Try to shave some time from the poolscanner by Infomask checking. 2019-09-25 21:32:53 +01:00
Mike Auty 37cb541013 Change the layer naming convention to include the underscores when necessary. 2019-09-25 19:38:39 +01:00
Mike Auty 926288a7ac Ensure process layer name contains the process ID. 2019-09-25 01:15:58 +01:00
Mike Auty 72567e1c50 Yapf-0.28.0 rerun across the whole codebase. 2019-09-21 21:08:23 +01:00
Mike Auty 7efe19224e Make several small typing information fixes. 2019-09-17 18:01:11 +01:00
Mike Auty 76a1bb972c Restore the mac queue_event class override. 
For some reason, this went missing in commit
a3caf39097, which looks to have been an
error.
 2019-09-16 12:04:50 +01:00
Michael Lighandikelos e71b72b3a7 add the windows callbacks plugin 2019-09-08 16:08:48 +01:00