Mike Auty
260f879334
Core: Fix caching of pointer objects
2021-08-19 15:32:48 +01:00
Mike Auty
98db5e46d4
Windows: Remove hardcoded parameter in poolscanner
2021-08-19 11:12:05 +01:00
Mike Auty
db2ec8cfb2
Core: Ensure module configuration is recordable
2021-08-16 16:59:11 +01:00
x
ef27d07183
Add missing patch that fixes KERB_ECRYPT structure size
2021-08-13 15:06:48 +00:00
x
70750d2b92
Remove unused variable from plugin
2021-08-12 22:52:08 +00:00
ikelos and GitHub
5f276df35c
Merge pull request #484 from volatilityfoundation/skeleton_key_check_plugin
...
Skeleton key check plugin
2021-08-12 23:39:39 +01:00
x
d86b9b34e4
Fix return types, change confusing use of continue, switch to get_absolute_symbol_address
2021-08-12 15:47:16 +00:00
Mike Auty
19b2a06964
Layers: Coalesce intel mapping responses
2021-08-11 22:02:08 +01:00
Mike Auty
3ad20d566c
Automagic: Minor fixes for jar files and layers
2021-08-11 21:51:41 +01:00
Mike Auty
e7623baf45
Linux: Support None to turn off remote banner locations
2021-08-11 21:24:39 +01:00
Mike Auty
bb40a8a207
Automagic: Catch remote download exceptions
2021-08-11 21:22:03 +01:00
Mike Auty
3b2aae40d2
Automagic: Support remote banner versioning and chaining
2021-08-11 21:22:03 +01:00
Mike Auty
79b3be4cf6
Automagic: Add in remote banner cache first attempt
2021-08-11 21:22:03 +01:00
Mike Auty
4016b096c2
Core: Add in offline constant
2021-08-11 21:22:00 +01:00
ikelos and GitHub
595f377f19
Merge pull request #538 from volatilityfoundation/feature/better-modules-support2
...
Feature/better modules support
2021-08-11 21:09:24 +01:00
Mike Auty
86771d15d5
Core: Don't get to hasty with the API version
2021-08-11 21:08:33 +01:00
Mike Auty
2cfb65380a
Core: Include API changes file
2021-08-11 21:06:43 +01:00
Mike Auty
8745931dea
Windows: Add coalesce support to memmap
2021-08-05 17:28:36 +01:00
Mike Auty
1611a72eb9
Windows: Fix memmap not to create empty files
2021-08-05 16:21:48 +01:00
Mike Auty
058de2d9a8
Windows: Mute crypto warnings from lgtm
2021-08-04 22:25:13 +01:00
ikelos and GitHub
ee70c1c6ab
Merge pull request #540 from volatilityfoundation/feature/pdbconv-vs19
...
Feature/pdbconv vs19
2021-08-02 11:02:12 +01:00
Mike Auty
0343c8f81e
Windows: Pdbsan typing and doc fixes
2021-07-30 21:20:33 +01:00
Mike Auty
30eec0cb76
Windows: Ensure the kernel contains an actual kvo
2021-07-30 00:17:26 +01:00
Mike Auty
e793956e02
Windows: Update netscan offsets for win10-17763-x64 ( #478 )
2021-07-29 00:17:22 +01:00
Mike Auty
fda1512273
Windows: Fix pdbconv handling of unknown types
2021-07-29 00:05:36 +01:00
Frank Gomulka
7311f24149
Comment and Pydoc changes
2021-07-28 08:38:53 -04:00
Frank Gomulka
6f4ff5f2df
Add patch for driverscan for windows 7 and earlier
...
This patches an issue for some versions of windows that require the
bottom-up approach for finding the size of "object body" by
recognizing additional structures occupying the "object body"
position. The sizes of these additional structures are added to
the size of `_DRIVER_OBJECT` to more accurately compute the actual
size of "object body".
2021-07-28 08:38:53 -04:00
Andrew Case
f6c1e0eafc
Fix several code paths that could infinite loop and were triggered based on @fgomulka testing
2021-07-27 21:31:07 +00:00
ikelos and GitHub
d1173b07ee
Merge pull request #545 from volatilityfoundation/skip_invalid_socket_references
...
Skip invalid sockets in netstat enumeration, based on @fgomulka testing
2021-07-27 22:23:47 +01:00
ikelos and GitHub
0c925a49a8
Merge pull request #544 from volatilityfoundation/improve_mac_vnode_handling
...
Cleanup vnode processing and smear protection based on @fgomulka testing
2021-07-27 22:23:07 +01:00
Andrew Case
c9232ab7b5
Skip invalid sockets in netstat enumeration, based on @fgomulka testing
2021-07-27 20:04:24 +00:00
Andrew Case
c1bf63db83
Adding missing change for pointer_to_string exception catching
2021-07-27 19:59:28 +00:00
Andrew Case
63b4c60d3b
Cleanup vnode processing and smear protection based on @fgomulka testing
2021-07-27 19:51:55 +00:00
ikelos and GitHub
01a63ff331
Merge pull request #499 from gcmoreira/kmsg-plugin
...
Linux kernel ring buffer reader plugin
2021-07-26 21:48:18 +01:00
Mike Auty
deaa86f625
Windows: Ensure we emit LF_STRUCTURE_VS19 types
2021-07-24 23:01:11 +01:00
Mike Auty
9358700553
Windows: Refactor PDB code and support VS19 new types
2021-07-24 22:39:02 +01:00
Mike Auty
6fdf6e9e9f
Windows: Convert pslist as an example
2021-07-22 22:46:39 +01:00
Mike Auty
cd2f40bc34
Mac: Update all plugins to ModuleRequirement
2021-07-22 22:42:06 +01:00
Mike Auty
1480aca453
Linux: Update all plugins to ModuleRequirement
2021-07-22 22:40:09 +01:00
Mike Auty
abbd516f99
Layers: Add minimum framework requirements
2021-07-22 22:37:58 +01:00
Mike Auty
31dc6f34c9
Automagic: Make symbol_shift automagic change
2021-07-22 22:37:58 +01:00
Mike Auty
213eeda268
Core: Add module collection support
2021-07-22 22:37:58 +01:00
Mike Auty
d2420899c5
Layers: Fix minor pointless typo
2021-07-22 22:37:45 +01:00
Mike Auty
c993c35152
Core: Further python 3.6 fixes
2021-07-22 22:23:32 +01:00
Mike Auty
66c96644ac
Core: Minor flynt and typing fixes
2021-07-22 21:36:37 +01:00
Mike Auty
787f61d5a7
Documentation: Update minimum python version.
2021-07-22 21:30:08 +01:00
Mike Auty
767eea614b
Windows: Add extra checks to pdbscan
2021-07-19 12:31:13 +01:00
Mike Auty
59ab92e99d
Development: Update development scripts with f-strings
2021-07-18 23:20:27 +01:00
Mike Auty
0d48261201
Core: Change all 3.5 type hints to variable annotations
2021-07-18 16:49:37 +01:00
Mike Auty
9f52a15734
Core: Convert to format strings across the whole base
2021-07-18 15:53:58 +01:00
Mike Auty