Mike Auty
094a3c0a47
Volshell: Update to use KernelRequirement
2022-02-17 00:21:59 +00:00
ikelos and GitHub
96d4aafd6c
Merge pull request #647 from volatilityfoundation/issues/issue646
...
Fix infinite loop in mftscan and timeliner body file updates
2022-02-14 20:35:24 +00:00
ikelos and GitHub
f5ecdbe28d
Merge pull request #645 from pudii/issues/issue313
...
Implement LDRmodules plugin
2022-02-14 01:12:21 +00:00
Mike Auty
22a7328e4c
Windows: Prevent infinite loop in mftscan
2022-02-13 20:45:42 +00:00
pudii
12c3f34037
Add comments and fix minor code issues
2022-02-13 18:29:35 +01:00
Mike Auty
9cabf5362b
Timeliner: Write out directly to the body file
...
Since the body file doesn't need sorting, we can output it immediately,
and this also means that partial results can be recorded even in the run
is terminted before it compeletes.
Goes someway to improving #646
2022-02-13 00:19:32 +00:00
pudii
cf11de174a
Implement LDRmodules plugin
2022-02-11 18:19:53 +01:00
Mike Auty
05b4eb22fa
Core: Bump the development version to 2.0.2
2022-02-09 20:19:17 +00:00
Mike Auty
497eaea512
Core: Slight speed-up for all single struct.unpack calls
2022-02-09 20:07:13 +00:00
ikelos and GitHub
3e742bf1f7
Merge pull request #643 from ilay122/bugfix/mz_parsing
...
fix pdb mz parsing
2022-02-09 19:46:09 +00:00
trashcan122
ce166b9263
fix pdb mz parsing
2022-02-09 16:30:40 +02:00
ikelos and GitHub
dbf6245b85
Merge pull request #641 from paulkermann/bugfix/pdb-scanning-offset-bug
...
Fixed pdb scanning bug
2022-02-09 09:04:11 +00:00
Paul Kermann
a67121f1c1
Added data_offset to pattern matching result, fixes pdb scanning bug
2022-02-09 10:40:37 +02:00
ikelos and GitHub
52f325ed54
Merge pull request #633 from Digitalisx/develop
...
Correcting typo for Windows constants code comment.
2022-01-31 11:38:12 +00:00
Donghyun Kim and GitHub
7c238f93a0
Update __init__.py
...
Correcting typos for Windows Constants
2022-01-31 20:15:39 +09:00
ikelos and GitHub
b84e478371
Merge pull request #623 from volatilityfoundation/issues/issue542
...
Plugins: Timeliner improve support for body files
2022-01-18 21:01:46 +00:00
ikelos and GitHub
0de8448f89
Merge pull request #622 from volatilityfoundation/issues/issue616
...
Plugins: yara python module check improvement
2022-01-18 21:00:33 +00:00
Mike Auty
0f90f7f6ca
Plugins: Remove unused timeliner parameter
2022-01-18 20:58:48 +00:00
ikelos and GitHub
290e9fdb39
Merge pull request #628 from kevthehermit/plugin/sessions
...
add timeliner output to windows.sessions
2022-01-18 20:53:07 +00:00
KevTheHermit
ac7cecf231
add timeliner output to windows.sessions
2022-01-18 20:42:38 +00:00
ikelos and GitHub
a686042789
Merge pull request #626 from kevthehermit/plugin/sessions
...
Sessions Plugin
2022-01-18 19:37:37 +00:00
KevTheHermit
be0dd49d31
Sessions Plugin use ModuleRequirement
2022-01-18 19:34:06 +00:00
KevTheHermit
0f23089cb4
Create Sessions Plugin
2022-01-17 00:28:59 +00:00
Mike Auty
91a844a8b0
Merge branch 'stable' into develop
2022-01-16 23:26:54 +00:00
ikelos and GitHub
02ff56ba71
Merge pull request #624 from volatilityfoundation/readthedocs-requirements
...
Fix readthedocs builds
2022-01-16 22:54:24 +00:00
Nick L. Petroni, Jr
fa2a608cd2
update doc copyright
2022-01-16 17:32:02 -05:00
Nick L. Petroni, Jr
64acff1b59
use doc/requirements.txt when building with readthedocs
2022-01-16 17:11:53 -05:00
Mike Auty
57c9470f66
Documentation: Fix building from different directories
2022-01-16 22:09:15 +00:00
ikelos and GitHub
7650cfd7d1
Merge pull request #614 from kevthehermit/plugin/mftscan
...
Create MFTScanner plugin
2022-01-16 14:08:08 +00:00
KevTheHermit
e3a7ac5668
Use lookups on mft enums instead of choices
2022-01-16 02:20:55 +00:00
ikelos and GitHub
45e2597399
Merge pull request #610 from volatilityfoundation/feature/pretty-multiline-output
...
CLI: Support multi-line fields and tabstops in pretty renderer
2022-01-16 01:34:13 +00:00
ikelos and GitHub
84df55a15b
Merge pull request #612 from volatilityfoundation/issues/issue588
...
Automagic: Allow automagic to exclude unsupported OSes
2022-01-16 01:28:52 +00:00
Mike Auty
a31f846b14
Documentation: Reorganize and consolidate pages
2022-01-16 00:47:40 +00:00
KevTheHermit
f31bc853c4
remove MFTIntermedSymbols
2022-01-15 23:30:39 +00:00
Mike Auty
742d46786b
Plugins: Don't forget missing values
2022-01-15 22:56:36 +00:00
Mike Auty
d9ba3e6bd9
Plugins: Timeliner improve support for body files
2022-01-15 22:50:21 +00:00
Mike Auty
dab746aff0
Plugins: yara python module check improvement
...
Fixes #616
2022-01-15 22:44:24 +00:00
KevTheHermit
32abab8733
Remove debug print from mftscan
2022-01-15 22:38:05 +00:00
Mike Auty
a9e5589260
Documentation: Add summary table for linux/mac ISF creation
2022-01-15 22:02:02 +00:00
KevTheHermit
4aaba89d02
Unity timeliner output for mftscan
2022-01-15 21:47:37 +00:00
Mike Auty
8791631db5
Documentation: More minor fixes
2022-01-15 21:40:25 +00:00
Mike Auty
c93e20ab36
Plugins: linux.kmsg update documentation and reformat
2022-01-15 21:14:52 +00:00
Mike Auty
1f7acf2779
Documentation: Update sphinx requirement to 4.0.0
2022-01-15 21:02:20 +00:00
KevTheHermit
c5987a45d2
Relative Offset MFT Header
2022-01-15 20:54:22 +00:00
KevTheHermit
a8f5b03816
Apply yapf to mftscan plugin
2022-01-15 15:57:23 +00:00
KevTheHermit
1c6cd0fb52
Move mftscan enums to ISF file.
2022-01-15 15:53:35 +00:00
ikelos and GitHub
0abff16580
Merge pull request #615 from volatilityfoundation/feature/yara-rules-update
...
Plugins: Update yarascan options
2022-01-13 15:21:41 +00:00
Mike Auty
d91a6f94fb
Automagic: Ensure linxu/mac are excluded from windows automagic
2022-01-13 01:01:20 +00:00
Mike Auty
f67f1e242d
Documentation: Ensure the doc reqs are included in s_dist builds
2022-01-12 22:11:25 +00:00
Mike Auty
8920fd634a
Merge branch 'release/v2.0.0' into develop
2022-01-12 21:39:12 +00:00
Mike Auty