WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 04:37:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,629 Commits 80 Branches 17 Tags
06ced0d59a8864fa052d698cfc843c01b6211f99
Commit Graph
3629 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mike Auty d1b10781d4 CLI: Parse windows file as files not URIs 
Fixes #408
 2020-12-30 18:06:41 +00:00
Jan 71e48cc672 complex objects are not passed as arguments directly anymore, but rather by offset 2020-12-28 21:51:28 +01:00
Jan f731ceba3a optimizations as raised by #397 2020-12-28 21:22:50 +01:00
Mike Auty 1c2a9921ff Windows: Partial fix for #368 error messages 2020-12-27 15:21:18 +00:00
Mike Auty feefc93adc CLI: Fix inaccurate documentation 2020-12-27 15:21:18 +00:00
Mike Auty 991a0a1091 Objects: Make repr(object) more useful 2020-12-22 17:11:46 +00:00
Jan 0e136b9437 adds partition_table type to ISFs 2020-12-22 17:18:20 +01:00
Jan 2e70a9cb45 addresses issues raised in pr #399 2020-12-22 17:11:55 +01:00
Mike Auty f262821924 Documentation: minor bugfix 2020-12-21 17:07:51 +00:00
Mike Auty ccef55e448 Linux: Use native_layer when constructing from a pointer offset 2020-12-21 15:57:18 +00:00
Mike Auty c45b1b3423 Automagic: Windows DTB finder was too limited 
The DTB finder test returns a full DTB, if that's over the scan chunk
size it'll get discarded, so we remove that test.
 2020-12-21 15:52:43 +00:00
Jan bcc79d4cb9 better documentation and support for more x64 Windows versions 2020-12-19 17:13:53 +01:00
Mike Auty 1abc65c2ac CLI: Fix inaccurate documentation 2020-12-11 16:04:13 +00:00
Mike Auty f9102a60b8 Release: Update the version number for this release 
Entering code-freeze
10th Dec - Bug fixes and documentation, no new features
7th Jan - Only critical fixes
21st Jan - Release date
 2020-12-10 22:42:39 +00:00
Andrew Caseandikelos 93c6a62972 Detect attempts to fix the image base for LARGEADDRESSAWARE executables and provide the user with a warning. #332 2020-12-10 18:58:00 +00:00
Mike Auty d63aef566f Codebase: Yapf the codebase again 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos 747fe8609f update copywrite to 2020 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos 17e629a4c4 converted process_file_object into a classmethod 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos e9f870ff05 revert self.context change back to self._context 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos 9f977080c5 changed self._context to self.context 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos d98337cc09 added debug statements to dump_file_producer when none is returned 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos 4f37a28185 dump_file_producer is now a classmethod and returns a FileInterface Object 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos 49acf44302 dumpfiles.py is now consistent with master and runs correctly 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos 8e1a599203 changed PluginRequirement to VersionRequirement 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 0a9e663c41 remove the _VACB.is_valid() method - do all validity checks in the calling function 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 442f877e9a refs #197 initial commit of windows.dumpfiles 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 20f4fbf157 add --virtaddr and --physaddr options so users can supply virtual or physical addresses (or both) 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 0c09b98318 use native_layer_name in file_name_with_device() in case the FILE_OBJECT is instantiated from a memory (physical) layer 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 25b56b5ca4 remove the _VACB.is_valid() method - do all validity checks in the calling function 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 3ac89577cc refs #197 initial commit of windows.dumpfiles 2020-12-10 15:37:40 +00:00
Mike Auty 56ff75a74b Layers: Add internal intel debugging flag 2020-12-10 12:18:14 +00:00
Mike Auty db86aeb861 Volshell: Fix up filename/location confusion 2020-12-10 12:17:39 +00:00
Mike Auty b759ff3966 Volshell: Clarify load_file to accept location and filename 2020-12-10 10:07:44 +00:00
Mike Auty dbda8998bc Volshell: Make it easier to make configurables 2020-12-10 10:07:44 +00:00
Jan 972d3d7076 netlist for 16299 and 17134 2020-12-08 20:04:03 +01:00
Mike Auty e28016e45b Pdbutility: Improve usability of symbol_table_from_offset 2020-12-08 16:34:59 +00:00
Janandikelos 3dea2b4187 adds os_distinguisher for 18363 2020-12-08 10:34:07 +00:00
Janandikelos b3ffddcff0 fixes wrong offset in 18363 x64 2020-12-08 10:34:07 +00:00
Janandikelos 774528206c adds new vol3 netscan profiles and fixes rare bug 2020-12-08 10:34:07 +00:00
Mike Auty 84741c30fd Documentation: Make improvements based on feedback from NiklasBeierl 2020-12-07 23:13:22 +00:00
Mike Auty 754cfcd7ac Documentation: Add more detail on writing objects 
Fixes #390
 2020-12-06 23:55:49 +00:00
Mike Auty 3b700bbee5 Documentation: Ensure non-os plugins are documented 2020-12-06 23:55:26 +00:00
Mike Auty 0d267d0d56 Codebase: Improve typing using monkeytype 2020-12-06 21:34:28 +00:00
Mike Auty 9fa107a6c0 CLI: Support MultiTypeData in JSON output. Fixes #384 2020-12-02 23:41:21 +00:00
Mike Auty 27fcd1a641 CLI: Error on non-existant output_dir 2020-12-02 23:16:17 +00:00
cecioandikelos c9c37a9b35 OS check reworked as suggested by @iMHLv2 and @ikelos 2020-12-02 14:23:12 +00:00
cecioandikelos 1cf625fc89 fix: the bounce from physical to virtual process is required only for OS < Win10. 
Added the check in the "dump" option
 2020-12-02 14:23:12 +00:00
Mike Auty f88ce55199 Automagic: Improve debugging output for linux/mac 2020-12-02 09:51:42 +00:00
Mike Auty 8fb53a32a8 PdbUtility: Support multiple debug directories 2020-12-01 01:21:36 +00:00
Mike Auty 4d0a07194a PDBUtility: Update to use only pefile 2020-12-01 01:21:36 +00:00