WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-02 14:28:58 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,574 Commits 80 Branches 17 Tags
1409f472dbd5d4dfa00866c080297b4db07e683b
Commit Graph
4574 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
ikelosandGitHub 1409f472db Merge pull request #1297 from volatilityfoundation/1296-sort-volshell-methods-alphabetically 
refs #1296 sort volshell methods alphabetically in hh() output
 2024-10-07 23:07:46 +01:00
ikelosandGitHub eb74437dbe Merge pull request #1263 from gcmoreira/linux_lsof_refactoring_fixes_and_improvements 
Linux: Add support for threads in both lsof and sockstat plugins.
 2024-10-07 23:04:24 +01:00
Mike Auty 9addf6bee8 Remove the old .style.yapf 
This was used before we shifted to black permanently.  It allowed
additional spacing between keyword arguments and their default values,
but it was inconsisnent and could get in a state where it would flip
between two weights, so every "fix" would then be "fixed" back again.

No longer feasible for a project of this size.
 2024-10-07 22:57:57 +01:00
ikelosandGitHub 5c4e26865d Merge pull request #1289 from dgmcdona/dgmcdona/linux-dentry-simple-dname 
Linux: Properly get paths in simple_dname paths
 2024-10-07 22:37:16 +01:00
MHL cb98a085d7 refs #1296 sort volshell methods alphabetically in hh() output 2024-10-07 09:11:49 -05:00
Gustavo Moreira ee75964345 Linux: lsof plugin: Fix typo in docstring 2024-10-07 20:46:44 +11:00
Gustavo Moreira 2859d7a641 Linux: lsof plugin: Fix list_fds() return typing 2024-10-07 18:49:38 +11:00
Gustavo Moreira bf19b9f2e0 Linux: lsof plugin: Fix dataclasses import to stick to the style guide 2024-10-07 18:46:18 +11:00
ikelosandGitHub 9477d16f1b Merge pull request #1295 from eve-mem/linux_docs_lime_warning 
Docs: Add warning around LiME raw format
 2024-10-07 08:17:45 +01:00
Gustavo Moreira bf02723695 Linux: lsof plugin: Fix module import to stick to the style guide 2024-10-07 17:59:55 +11:00
eve 5d072864d7 Docs: Add warning around LiME raw format 2024-10-07 07:00:44 +01:00
ikelosandGitHub c13c76c745 Merge pull request #1274 from volatilityfoundation/issues/issue1119 
Ensure the class for Modules is stored in the configruation
 2024-10-06 20:13:04 +01:00
ikelosandGitHub 4149c551a9 Merge pull request #1293 from volatilityfoundation/1292-dumpfiles-uses-incorrect-sector-size-for-datasectionobject 
#1292 - use correct sector size for DataSectionObject file dumping
 2024-10-06 19:03:46 +01:00
ikelosandGitHub 9bda20df34 Merge pull request #1279 from dgmcdona/dgmcdona/linux-sockstat-pytest 
Linux: Sockstat - adds pytest
 2024-10-06 18:17:45 +01:00
ikelosandGitHub c2feeecee3 Merge pull request #1259 from gcmoreira/linux_pagecache_pointer_verification_improvements 
Linux Page Cache smear memory protection improvements
 2024-10-06 18:07:48 +01:00
ikelosandGitHub cd979804e0 Merge pull request #1285 from gcmoreira/remote_isf_url 
Add --remote-isf-url argument to be able to use a remote ISF server from the command-line arguments
 2024-10-06 16:57:02 +01:00
ikelosandGitHub c67f2e51c1 Merge pull request #1284 from gcmoreira/fix_all_any_misuses 
Fix misuse of all() and any() functions across the codebase
 2024-10-06 16:41:51 +01:00
Dave Lassalle bb5a447502 #1292 - use correct sector size for DataSectionObject file dumping 2024-10-05 09:58:01 -05:00
Gustavo Moreira cffad872bb Linux: sockstat. Fix #1271 which unnecessarily extends the interface of the list_sockets() class method 2024-10-04 12:22:53 +10:00
Gustavo Moreira d7d84b4c7f Merge branch 'develop' into linux_lsof_refactoring_fixes_and_improvements 2024-10-04 12:08:10 +10:00
David McDonald 4ac9b0825a Linux: Properly get paths in simple_dname paths 
Some dentry paths were not being recovered from `simple_dname` paths,
this fixes the issue by properly dereferencing the string pointer.
 2024-10-03 10:59:59 -05:00
Gustavo Moreira a64813be43 Added metavar and single letter argument to the --remote-isf-url 2024-10-02 13:08:05 +10:00
Gustavo Moreira a63e9f1699 Add --remote-isf-url argument to be able mutually exclusive to --offline 2024-10-02 13:00:45 +10:00
Gustavo Moreira c18818aa8d Fix misuse of all() and any() functions across the codebase 2024-10-02 10:38:01 +10:00
ikelosandGitHub 72abb419cc Merge pull request #1281 from eve-mem/linux_malfind_32bit_arch_detection 
Linux: Update malfind plugin to use symbols.symbol_table_is_64bit when determining if a 32bit OS is detected in the sample
 2024-10-02 00:07:20 +01:00
Mike Auty 950ab3e201 Add in additional microarchitectures for vmscan 2024-10-01 19:47:19 +01:00
David McDonald c0672f6c4b Linux: Sockstat - adds pytest 
This adds a pytest for the `linux.sockstat.Sockstat` plugin.
 2024-10-01 10:02:25 -05:00
eve ba351f511d Linux: Update malfind plugin to use symbols.symbol_table_is_64bit when determining if a 32bit OS is detected in the sample 2024-10-01 06:36:56 +01:00
ikelosandGitHub 5d2a5f94d4 Merge pull request #1276 from dgmcdona/dgmcdona/windows-callbacks-validity-check 
Windows: Callbacks - fixes bad callback validity check
 2024-10-01 00:42:29 +01:00
ikelosandGitHub c37d9eed1f Merge pull request #1278 from dgmcdona/dgmcdona/linux-sockstat-version-bump-fix 
Linux: Sockstat - fix incorrect version bump
 2024-10-01 00:34:14 +01:00
David McDonald db55f23070 Windows: Callbacks - fix breaking API change 
Moves as much of the `is_parseable` check as possible back into an
`is_valid` method to avoid breaking API changes.
 2024-09-30 17:03:12 -05:00
David McDonald 806f78d372 Linux: Sockstat - fix incorrect version bump 
I erred when I bumped the version as a part of !1271 - The `SockHandlers`
class got the major version bump, not `Sockstat`. This reverts the
`SockHandlers` version bump and applies it to `Sockstat` instead.
 2024-09-30 15:27:03 -05:00
David McDonald 8ad592a490 Windows: Fixes bad callback validity check 
This fixes a bug in the callbacks plugin which causes it to miss
`IoRegisterShutdownNotification` callbacks on x86b samples. The
`header.NameInfo.Name` field was being incorrectly treated as the device
type. This fixes the issue by updating the `is_valid` method on the
`_SHUTDOWN_PACKET` extension type to take a `type_map` parameter, and
updates the method to correctly validate the object type.
 2024-09-30 14:56:40 -05:00
ikelosandGitHub 495f3a92d4 Merge pull request #1277 from dgmcdona/dgmcdona/windows-netscan-missing-connections 
Windows: Netscan - fix missing TCP connections
 2024-09-30 20:51:28 +01:00
David McDonald d9dc28d0b5 Windows: fix missing TCP connections 
This fixes some missing TCP connections in Windows 10 20348 by adding
a scan constraint for `TTcb` pool tags.
 2024-09-30 13:03:02 -05:00
ikelosandGitHub 5a6958befa Merge pull request #1273 from dgmcdona/dgmcdona/windows-psxview-win10-bugfix 
Windows: psxview win10 bugfix
 2024-09-29 23:42:04 +01:00
David McDonald 49dc89c30c Windows: psxview Win10+ fix 
The current implementation of this plugin does not incorporate the
cookie on Win10+ systems, causing it to fail. This commit fixes that
issue, and also contributes a performance improvement by extracting the
call to `handles_plugin.get_type_map()` from the loop. Also replaces
for-loop with list comprehension for clarity.
 2024-09-29 14:02:04 -05:00
Mike Auty d38a69fd5c Ensure the class for Modules is stored in the configruation 2024-09-29 19:49:21 +01:00
David McDonald 3ebee83d05 Windows: psxview cleanup 
Replaced this series of statements with a single invocation of the `all`
builtin for brevity and conciseness.
 2024-09-27 17:36:50 -05:00
David McDonald 4b0ece0fc9 Windows: psxview module type-hints and cleanup 
Adds type-hints to methods throughout the psxview module.
 2024-09-27 17:36:50 -05:00
David McDonald f1200c85b7 Windows: PsList type-hint cleanup 
It's more appropriate to use `Iterator` than `Iterable` as a return type
here. Also updates the `Iterator` item type to be `EPROCESS` instead of
just `ObjectInterface`.
 2024-09-27 17:36:50 -05:00
ikelosandGitHub 055f2e7d9b Merge pull request #1264 from gcmoreira/linux_lsof_namespace_dentry_name 
Linux lsof: Add namespace dentry name
 2024-09-26 00:24:51 +01:00
ikelosandGitHub e0942182c8 Merge pull request #1271 from dgmcdona/dgmcdona/linux-sockstat-procnames 
Linux: Update sockstat to render process names
 2024-09-25 23:57:30 +01:00
David McDonald 7f37135739 Linux: Update sockstat to render process names 
Currently, process names are not displayed for sockets in the sockstat
plugin, making analysis more painful than it needs to be. This updates
the `list_sockets` classmethod and the `generator` method to return the
process name in addition to the PID.

Because this is changing the public interface, this commit includes a
major version bump for `linux.sockstat.Sockstat`.
 2024-09-25 17:34:54 -05:00
ikelosandGitHub 714e987679 Merge pull request #1270 from eve-mem/windows_vadyarascan_sanity_check_warnings 
Windows: change warnings around large memory maps to debug level as per issue #1256
 2024-09-25 23:26:30 +01:00
eve 09fa859a92 Windows: change warnings around large memory maps to debug level as per issue #1256 2024-09-25 09:02:51 +01:00
ikelosandGitHub 67f8265def Merge pull request #1261 from gcmoreira/linux_checkcreds_pointer_verification_improvements 
Linux checkcreds pointer verification improvements
 2024-09-22 15:12:46 +01:00
ikelosandGitHub bb6ab45363 Merge pull request #1268 from gcmoreira/fix_constants_imports 
Fix changes introduced to volatility3.framework.constants in PRs #838
 2024-09-18 14:55:20 +01:00
Gustavo Moreira f77003b670 Fix changes introduced to volatility3.framework.constants in PRs #838 and #1247 2024-09-18 12:50:58 +10:00
Mike Auty 10ac21da2c Windows: Remove the unnecessary requirement on verinfo 
Fixes #1267
 2024-09-16 12:16:49 +01:00