Mike Auty
0aa59111df
Generic: YaraScanner fail on no rules
2021-08-19 23:06:55 +01:00
Mike Auty
260f879334
Core: Fix caching of pointer objects
2021-08-19 15:32:48 +01:00
Mike Auty
98db5e46d4
Windows: Remove hardcoded parameter in poolscanner
2021-08-19 11:12:05 +01:00
Mike Auty
db2ec8cfb2
Core: Ensure module configuration is recordable
2021-08-16 16:59:11 +01:00
x
ef27d07183
Add missing patch that fixes KERB_ECRYPT structure size
2021-08-13 15:06:48 +00:00
x
70750d2b92
Remove unused variable from plugin
2021-08-12 22:52:08 +00:00
ikelos and GitHub
5f276df35c
Merge pull request #484 from volatilityfoundation/skeleton_key_check_plugin
...
Skeleton key check plugin
2021-08-12 23:39:39 +01:00
x
d86b9b34e4
Fix return types, change confusing use of continue, switch to get_absolute_symbol_address
2021-08-12 15:47:16 +00:00
ikelos and GitHub
595f377f19
Merge pull request #538 from volatilityfoundation/feature/better-modules-support2
...
Feature/better modules support
2021-08-11 21:09:24 +01:00
Mike Auty
86771d15d5
Core: Don't get to hasty with the API version
2021-08-11 21:08:33 +01:00
Mike Auty
2cfb65380a
Core: Include API changes file
2021-08-11 21:06:43 +01:00
Mike Auty
8745931dea
Windows: Add coalesce support to memmap
2021-08-05 17:28:36 +01:00
Mike Auty
1611a72eb9
Windows: Fix memmap not to create empty files
2021-08-05 16:21:48 +01:00
Mike Auty
058de2d9a8
Windows: Mute crypto warnings from lgtm
2021-08-04 22:25:13 +01:00
ikelos and GitHub
ee70c1c6ab
Merge pull request #540 from volatilityfoundation/feature/pdbconv-vs19
...
Feature/pdbconv vs19
2021-08-02 11:02:12 +01:00
Mike Auty
0343c8f81e
Windows: Pdbsan typing and doc fixes
2021-07-30 21:20:33 +01:00
Mike Auty
30eec0cb76
Windows: Ensure the kernel contains an actual kvo
2021-07-30 00:17:26 +01:00
Mike Auty
e793956e02
Windows: Update netscan offsets for win10-17763-x64 ( #478 )
2021-07-29 00:17:22 +01:00
Mike Auty
fda1512273
Windows: Fix pdbconv handling of unknown types
2021-07-29 00:05:36 +01:00
ikelos and GitHub
d1173b07ee
Merge pull request #545 from volatilityfoundation/skip_invalid_socket_references
...
Skip invalid sockets in netstat enumeration, based on @fgomulka testing
2021-07-27 22:23:47 +01:00
ikelos and GitHub
0c925a49a8
Merge pull request #544 from volatilityfoundation/improve_mac_vnode_handling
...
Cleanup vnode processing and smear protection based on @fgomulka testing
2021-07-27 22:23:07 +01:00
Andrew Case
c9232ab7b5
Skip invalid sockets in netstat enumeration, based on @fgomulka testing
2021-07-27 20:04:24 +00:00
Andrew Case
c1bf63db83
Adding missing change for pointer_to_string exception catching
2021-07-27 19:59:28 +00:00
Andrew Case
63b4c60d3b
Cleanup vnode processing and smear protection based on @fgomulka testing
2021-07-27 19:51:55 +00:00
ikelos and GitHub
01a63ff331
Merge pull request #499 from gcmoreira/kmsg-plugin
...
Linux kernel ring buffer reader plugin
2021-07-26 21:48:18 +01:00
Mike Auty
deaa86f625
Windows: Ensure we emit LF_STRUCTURE_VS19 types
2021-07-24 23:01:11 +01:00
Mike Auty
9358700553
Windows: Refactor PDB code and support VS19 new types
2021-07-24 22:39:02 +01:00
Mike Auty
6fdf6e9e9f
Windows: Convert pslist as an example
2021-07-22 22:46:39 +01:00
Mike Auty
cd2f40bc34
Mac: Update all plugins to ModuleRequirement
2021-07-22 22:42:06 +01:00
Mike Auty
1480aca453
Linux: Update all plugins to ModuleRequirement
2021-07-22 22:40:09 +01:00
Mike Auty
abbd516f99
Layers: Add minimum framework requirements
2021-07-22 22:37:58 +01:00
Mike Auty
31dc6f34c9
Automagic: Make symbol_shift automagic change
2021-07-22 22:37:58 +01:00
Mike Auty
213eeda268
Core: Add module collection support
2021-07-22 22:37:58 +01:00
Mike Auty
d2420899c5
Layers: Fix minor pointless typo
2021-07-22 22:37:45 +01:00
Mike Auty
c993c35152
Core: Further python 3.6 fixes
2021-07-22 22:23:32 +01:00
Mike Auty
66c96644ac
Core: Minor flynt and typing fixes
2021-07-22 21:36:37 +01:00
Mike Auty
787f61d5a7
Documentation: Update minimum python version.
2021-07-22 21:30:08 +01:00
Mike Auty
767eea614b
Windows: Add extra checks to pdbscan
2021-07-19 12:31:13 +01:00
Mike Auty
59ab92e99d
Development: Update development scripts with f-strings
2021-07-18 23:20:27 +01:00
Mike Auty
0d48261201
Core: Change all 3.5 type hints to variable annotations
2021-07-18 16:49:37 +01:00
Mike Auty
9f52a15734
Core: Convert to format strings across the whole base
2021-07-18 15:53:58 +01:00
ikelos and GitHub
99e959a15a
Merge pull request #535 from gohar94/patch-2
...
Windows: Fix up pdb.json for LF_UDT_MOD_SRC_LINE
2021-07-14 16:54:17 +01:00
ikelos and GitHub
d4c20648e0
Merge pull request #534 from volatilityfoundation/issues/issue_528_regvaluetypes
...
issue #528 - change how registry enum members are accessed
2021-07-14 16:52:07 +01:00
ikelos and GitHub
df48d3a8d3
Merge pull request #533 from volatilityfoundation/issues/issue_457_registry_mapping_sids
...
Issues/issue 457 registry mapping sids
2021-07-14 16:51:12 +01:00
ikelos and GitHub
f65199845d
Merge pull request #523 from gcmoreira/issue-522-private-attr-name-mangled
...
Fix issue #522 : private attribute names mangle
2021-07-14 16:25:01 +01:00
Mike Auty
3ca5461f95
Windows: Ensure suitable progress callback
2021-07-14 15:47:28 +01:00
Gustavo Moreira
a795a7e2d5
Using double underscore in the find() will also include edge cases like when the calling class contains an underscore i.e. THE_CLASS
2021-07-14 20:45:43 +10:00
Gohar Irfan Chaudhry and GitHub
e0f08cdead
Windows: Fix up pdb.json for LF_UDT_MOD_SRC_LINE
...
The module field in `LF_UDT_MOD_SRC_LINE` should be `unsigned short` instead of `string` as per:
```
typedef struct lfUdtModSrcLine {
unsigned short leaf; // LF_UDT_MOD_SRC_LINE
CV_typ_t type; // UDT's type index
CV_ItemId src; // index into string table where source file name is saved
unsigned long line; // line number
unsigned short imod; // module that contributes this UDT definition
} lfUdtModSrcLine;
```
([source](https://github.com/microsoft/microsoft-pdb/blob/082c5290e5aff028ae84e43affa8be717aa7af73/include/cvinfo.h#L1707 ))
This also changes the size of the struct from 16 to 14.
2021-07-13 10:00:32 -07:00
superponible
d613b384d2
#457 - raise log level and use f-strings
2021-07-12 21:55:30 -05:00
superponible
446510ab5f
issue 528 - change how registry enum members are accessed
2021-07-12 11:40:30 -05:00
Mike Auty