 Andrew Case
|
00c4a13567
|
remove errant space
|
2025-03-17 18:58:55 -05:00 |
|
|
Andrew Case
|
f906bde338
|
change lmsod call
|
2025-03-17 18:56:54 -05:00 |
|
|
Andrew Case
|
971f06996b
|
bump version on kallsyms
|
2025-03-17 18:56:49 -05:00 |
|
|
Andrew Case
|
7146b45fa7
|
Create versioned parent class for all plugins that enumerate Linux kernel modules. Convert plugins to new method.
|
2025-03-17 18:56:05 -05:00 |
|
|
ikelosandGitHub
|
93e2072509
|
Merge pull request #1723 from volatilityfoundation/fix_extension_checks
Add needed checks to prevent backtraces in ELF parsing
|
2025-03-17 23:53:01 +00:00 |
|
|
ikelosandGitHub
|
03bc1c79ed
|
Merge pull request #1722 from volatilityfoundation/kallsyms_fixes_and_remove_deprecated_calls
Fix bugs in kallsyms and the related pscallstack found in testing and…
|
2025-03-17 23:52:51 +00:00 |
|
|
Andrew Case
|
07b74fd8e3
|
Add typing to functions in modules class
|
2025-03-17 18:28:13 -05:00 |
|
|
Andrew Case
|
e48d2972a6
|
Add needed checks to prevent backtraces in ELF parsing
|
2025-03-17 17:46:25 -05:00 |
|
|
Andrew Case
|
1eacddc79c
|
Add needed checks to prevent backtraces in ELF parsing
|
2025-03-17 17:45:13 -05:00 |
|
|
Andrew Case
|
b8a427c130
|
Fix bugs in kallsyms and the related pscallstack found in testing and switch calls to deprecated functions
|
2025-03-17 17:08:27 -05:00 |
|
|
ikelosandGitHub
|
ed3bcf1f5f
|
Merge pull request #1721 from volatilityfoundation/fix_iomem
Prevent backtrace on smeared iomem entry
|
2025-03-17 21:29:17 +00:00 |
|
|
ikelosandGitHub
|
7bdeddf050
|
Merge pull request #1720 from volatilityfoundation/fix_check_syscall
Prevent backtrace on corrupt system call table entry
|
2025-03-17 21:28:31 +00:00 |
|
|
ikelosandGitHub
|
a1229f902e
|
Merge pull request #1718 from volatilityfoundation/first_elf_fixes
Fix first set of ELF parsing unhandled smear protection
|
2025-03-17 21:13:34 +00:00 |
|
|
ikelosandGitHub
|
3a6415ab83
|
Merge pull request #1717 from volatilityfoundation/update_netfilter_v2
Update netfilter to current rookit detection API and update displayed…
|
2025-03-17 21:12:05 +00:00 |
|
|
Andrew Case
|
ee35fa1ef9
|
Prevent backtrace on smeared iomem entry
|
2025-03-17 19:10:23 +00:00 |
|
|
Andrew Case
|
f697287784
|
Prevent backtrace on corrupt system call table entry
|
2025-03-17 19:09:05 +00:00 |
|
|
Andrew Case
|
4b403d50ef
|
Fix first set of ELF parsing unhandled smear protection
|
2025-03-17 15:29:28 +00:00 |
|
|
Andrew Case
|
18abe9c508
|
Fix first set of ELF parsing unhandled smear protection
|
2025-03-17 15:25:43 +00:00 |
|
|
Andrew Case
|
04cd65ef2b
|
Update netfilter to current rookit detection API and update displayed columns to current standards
|
2025-03-17 15:23:44 +00:00 |
|
|
ikelosandGitHub
|
ffd38c5bff
|
Merge pull request #1716 from volatilityfoundation/add_windows_plugin
Add the windows plugin and associated extensions updates
|
2025-03-16 22:17:37 +00:00 |
|
|
Andrew Case
|
dae430ff58
|
Address feedback
|
2025-03-16 22:19:41 +00:00 |
|
|
Andrew Case
|
4e1ddadb40
|
Fix version requirements
|
2025-03-16 17:53:55 +00:00 |
|
|
Andrew Case
|
7e5a34ae49
|
Black and Ruff fixes
|
2025-03-16 17:17:46 +00:00 |
|
|
Andrew Case
|
c8869d87cd
|
Version the GUI extensions. Correctly check windows procedure
|
2025-03-16 17:15:43 +00:00 |
|
|
ikelosandGitHub
|
894f43c254
|
Merge pull request #1715 from volatilityfoundation/fix_windows_strings_bytes
Fix broken truncation from Vol3 bytes to string conversion
|
2025-03-16 16:54:46 +00:00 |
|
|
Andrew Case
|
d22d513716
|
Re-type the correct function
|
2025-03-16 16:40:53 +00:00 |
|
|
Andrew Case
|
bad34a112a
|
Add the windows plugin and associated extensions updates
|
2025-03-15 22:58:07 +00:00 |
|
|
Andrew Case
|
2d2228b06e
|
Fix signature
|
2025-03-15 21:25:39 +00:00 |
|
|
Andrew Case
|
fbb4003a32
|
Fix broken truncation from Vol3 bytes to string conversion
|
2025-03-15 20:59:14 +00:00 |
|
|
ikelosandGitHub
|
5bd7a4f4c2
|
Merge pull request #1710 from volatilityfoundation/update_deprecated_api_usage
Update nearly all callers of now deprecated Linux kernel APIs
|
2025-03-15 20:44:08 +00:00 |
|
|
Andrew Case
|
458e8eb692
|
retrigger checks
|
2025-03-15 20:41:09 +00:00 |
|
|
Andrew Case
|
f73717a39d
|
retrigger checks
|
2025-03-15 20:36:34 +00:00 |
|
|
Mike Auty
|
9550db82a9
|
Bump the ruff action
|
2025-03-15 20:31:01 +00:00 |
|
|
Andrew Case
|
9da147df1b
|
simplify check
|
2025-03-15 19:10:00 +00:00 |
|
|
Andrew Case
|
e79f03691a
|
Add name to interface and validate it in processing loop
|
2025-03-15 19:01:52 +00:00 |
|
|
|
0f5dd10aa9
|
Apply suggestions from code review
Co-authored-by: ikelos <ikelos@users.noreply.github.com>
|
2025-03-15 13:23:01 -05:00 |
|
|
Andrew Case
|
674cc045d2
|
Update to using str dictionary key. Add requirements for each gatherer in modxview. Validate names are unique while sanity checking.
|
2025-03-15 17:22:31 +00:00 |
|
|
Andrew Case
|
53e32e36f6
|
Add versioning on gatherers, make check non-specific to kernel gatherer, add requirements to ModuleGatherers
|
2025-03-14 22:34:06 +00:00 |
|
|
ikelosandGitHub
|
023fdfd293
|
Merge pull request #1708 from volatilityfoundation/fix_windows_strings
Properly reconstruct strings from memory buffers and allow for plugin…
|
2025-03-14 21:53:01 +00:00 |
|
|
Andrew Case
|
b2ec21fcf2
|
Simplify last_address handling
|
2025-03-14 21:15:03 +00:00 |
|
|
Andrew Case
|
a0f3cba6f6
|
Fix stale comments
|
2025-03-14 21:08:15 +00:00 |
|
|
Andrew Case
|
bb0a17004f
|
Add return_truncated for plugin-specified handling of truncated strings
|
2025-03-14 20:59:15 +00:00 |
|
|
Andrew Case
|
f38ddaf715
|
Fix string scanning code
|
2025-03-14 20:53:02 +00:00 |
|
|
Andrew Case
|
f5ae7928a3
|
Black fix
|
2025-03-14 20:45:14 +00:00 |
|
|
Andrew Case
|
2e93b8ed09
|
Prevent CodeQL from losing its mind. Properly checking for instances of the interface
|
2025-03-14 20:43:12 +00:00 |
|
|
Andrew Case
|
cf8bb3dfbc
|
Adjust run_modules_scanners to avoid special handling of hidden modules, adjust modxview to new API, add classes and version requirements on module gathering interface
|
2025-03-14 20:27:25 +00:00 |
|
|
ikelosandGitHub
|
e0ff0018a6
|
Merge pull request #1709 from volatilityfoundation/feature/ipython
Feature: Add support for IPython in volshell
|
2025-03-14 19:32:45 +00:00 |
|
|
David McDonald
|
196bf8187d
|
Volshell: Address comments from code review
- Add failure message when readline or rlcompleter can't be imported
- Fix unclosed file handle in context manager
|
2025-03-14 12:22:15 -05:00 |
|
|
Andrew Case
|
4225adce56
|
Convert to .mapping and let Python had all encodings
|
2025-03-14 16:32:54 +00:00 |
|
|
Andrew Case
|
36b3c28859
|
Update encodings
|
2025-03-14 03:12:06 +00:00 |
|