Donghyun Kim
19b5e31ac0
Make MermaidRenderer plugin-agnostic via TreeGrid path_depth
...
Address review feedback that the renderer was tightly coupled to plugins
exposing PID/PPID columns: the previous implementation looked up "PID"
and "PPID" by name to build parent->child edges and raised a generic
exception otherwise, which prevented any non-pstree tree plugin from
being rendered as Mermaid.
The relationship is already encoded in the TreeGrid -- every TreeNode
carries its path_depth -- so the new render() walks the rows in
traversal order and tracks ancestry with a parent stack:
* descending one or more levels pushes the previously-emitted node
once per level (so a level skip still produces sane pops);
* ascending pops the corresponding number of levels;
* the stack top is always the parent of the next emitted node, or
empty for a root-level node.
Each node is given a stable per-render identifier (n1, n2, ...) instead
of being keyed by a column value such as PID, since PIDs are not unique
across a TreeGrid and may contain characters that are unsafe in Mermaid
node IDs.
A small label-escaping helper replaces the previous ad-hoc string
replacement of parentheses, and embedded newlines in cell renderings
are folded to <br> so each row stays a single Mermaid node.
The unused tree_indent_column placeholder (flagged by code scanning)
is dropped as part of the rewrite.
2026-05-26 08:43:24 +09:00
Donghyun Kim
473bf2386b
Merge remote-tracking branch 'origin/develop' into feature/mermaid
2026-05-26 08:39:23 +09:00
ikelos and GitHub
dfb8f5e78c
Merge pull request #1981 from volatilityfoundation/issues/issue1979
...
Rework where the banner output happens
2026-05-22 08:14:43 +01:00
Mike Auty
392df7745e
Rework where the banner output happens
2026-05-01 15:05:37 +01:00
ikelos and GitHub
6b497259a9
Merge pull request #1980 from volatilityfoundation/stable
...
Merge pull request #1977 from volatilityfoundation/release/v2.28.0
2026-04-30 23:51:40 +01:00
ikelos and GitHub
fb148ba25b
Merge pull request #1972 from cpuu/develop
...
Add deprecation warning for macOS analysis support
2026-04-30 22:15:52 +01:00
ikelos and GitHub
d61335e2a5
Merge pull request #1977 from volatilityfoundation/release/v2.28.0
...
Release/v2.28.0
2026-04-30 20:29:02 +01:00
ikelos and GitHub
c2db6ae5de
Merge pull request #1971 from volatilityfoundation/issues/higher-dtb-ranges
...
Add in a much larger range if earlier checks don't find the DTB
2026-04-23 20:02:59 +01:00
Jaeyou PARK and GitHub
514f9d6a11
Add deprecation warning for macOS analysis support
...
Add a warning directive to the macOS tutorial noting that macOS analysis support is no longer actively maintained as of the Volatility 3 parity release.
The existing plugins remain available but may not receive future updates.
Links to the official announcement for details.
2026-04-08 10:29:32 +09:00
Mike Auty
9c2de16e2a
Add in a much larger range if earlier checks don't find the DTB
2026-04-06 22:14:22 +01:00
ikelos and GitHub
9424c3a601
Merge pull request #1966 from Abyss-W4tcher/issue_1965_linux_malfind
...
[linux.malware.malfind] Allow dumping enumerated VMAs/pages
2026-04-02 21:40:00 +01:00
Mike Auty
eb52181836
Bump the non-release version number now
2026-04-02 21:26:52 +01:00
ikelos and GitHub
905b03d375
Merge pull request #1962 from volatilityfoundation/issues/github-infrastructure
...
Switch to using github infrastructure for test cases...
2026-04-02 21:05:09 +01:00
Abyss Watcher
f6930214e0
add dump-regions option to malfind and adjust dirty page enumeration
2026-03-23 17:16:51 +01:00
ikelos and GitHub
fc8edc4f66
Merge pull request #1956 from oh2fih/fix/windows-pdb-download-to-cache
...
Add user cache directory as fallback for downloaded symbols
2026-03-16 23:44:41 +00:00
Esa Jokinen
7707a14092
PDBUtility: Log per-path symbol write failures at DEBUG level
2026-03-16 15:44:07 +02:00
Esa Jokinen
dd06faa7ce
Add user cache directory as fallback for downloaded symbols
2026-03-16 08:47:19 +02:00
Mike Auty
34384ddb4b
Switch to using github infrastructure for test cases...
2026-03-12 22:25:46 +00:00
ikelos and GitHub
a8c0832f62
Merge pull request #1960 from oh2fih/fix/pycryptodome-namespace-compat
...
Support Cryptodome namespace when Crypto is unavailable
2026-03-12 19:18:13 +00:00
ikelos and GitHub
bb8237e825
Merge pull request #1961 from volatilityfoundation/revert-1927-issues/issue1255-2
...
Revert "Only act on local cache symbols under the symbol basepaths"
2026-03-10 22:08:31 +00:00
ikelos and GitHub
0b6229871f
Revert "Only act on local cache symbols under the symbol basepaths"
2026-03-10 21:09:05 +00:00
Esa Jokinen
5e955e5220
Support Cryptodome namespace when Crypto is unavailable
2026-03-10 17:08:01 +02:00
ikelos and GitHub
8c67953c50
Merge pull request #1955 from volatilityfoundation/issues/shift-to-ruff-for-formatting
...
Switch to using ruff for formatting as well as linting
2026-03-09 21:35:49 +00:00
Mike Auty
86b53d90b0
Update documentation to remove black and use ruff
2026-03-09 20:47:24 +00:00
ikelos and GitHub
927a462b93
Merge pull request #1927 from volatilityfoundation/issues/issue1255-2
...
Only act on local cache symbols under the symbol basepaths
2026-03-09 19:50:38 +00:00
Mike Auty
013921e787
Switch to using ruff for formatting as well as linting
2026-03-08 20:48:02 +00:00
Mike Auty
98e2f7a1f5
Put back in the debugging line
2026-03-08 20:35:33 +00:00
ikelos and GitHub
4de5482e1a
Merge pull request #1953 from Abyss-W4tcher/issue_1944_dtb_check
...
Issue #1944 Windows adjust dummy page table check
2026-03-08 20:34:24 +00:00
ikelos and GitHub
fa732a337a
Merge branch 'develop' into issue_1944_dtb_check
2026-03-08 20:34:16 +00:00
Mike Auty
d3a9481a31
Tidy the threshold code for empty DTBs using code from @abyss-w4tcher and reduce it slightly
2026-03-08 20:29:18 +00:00
Abyss Watcher
55cd4d9759
adjust dummy page table check
2026-03-06 14:24:48 +01:00
ikelos and GitHub
ba466f8064
Merge pull request #1948 from Androsh7/1945-set-default-encoding-to-utf8
...
Set default encoding to utf-8
2026-03-02 08:50:23 +00:00
androsh7@gmail.com
5606baf4e6
Added argument to set default encoding to utf-8
2026-03-01 22:14:40 -05:00
ikelos and GitHub
ca83f52f3e
Merge pull request #1941 from volatilityfoundation/issues/issue1940-timerliner-output
...
Timeliner output repeated lines and entries due to how it was constructed
2026-02-26 10:24:57 +00:00
ikelos and GitHub
4762fb5e26
Merge pull request #1942 from volatilityfoundation/issues/issue1875-improve-win11-detection
...
Improve Win11 DTB detection
2026-02-26 10:24:02 +00:00
Mike Auty
e095851ab9
Improve Win11 DTB detection
...
It seems windows 11 has started moving the DTB further afield. This
change adds another region located empirically, so it might need
extending for everything between the second and third regions
potentially. It may also be possible to shrink the third region, but
that will need more example images (it's still not clear what causes
the use of the higher DTB, although the image it was found in was 18Gb).
2026-02-20 18:34:39 +00:00
Mike Auty
81fae3a83b
We weren't breaking between accumulating lines and outputting them
2026-02-19 22:48:03 +00:00
Mike Auty
fd22429b0b
Ubunutu-latest no longer supports 3.9
2026-02-19 20:20:10 +00:00
ikelos and GitHub
c65c2ef43a
Merge pull request #1929 from volatilityfoundation/issues/windows11-dtb
...
Improve windows intel detection for Windows 11
2026-02-19 20:08:42 +00:00
ikelos and GitHub
e8ffe1ddb0
Merge pull request #1937 from volatilityfoundation/issues/issue1373-add-windows-support-to-banners
...
Issues/issue1373 add windows support to banners
2026-02-05 16:07:14 +00:00
Mike Auty
48a5000f78
Make the output of banners match the identifier in isfinfo
2026-01-31 18:03:55 +00:00
Mike Auty
743927d6a2
Make black happy
2026-01-31 18:00:07 +00:00
Mike Auty
1b58e7e25b
Add version to pdb signature scanner and require it for the banners plugin
2026-01-31 17:58:45 +00:00
Mike Auty
881d4e85e8
Add in intial support for locating windows 'banners'
2026-01-31 17:53:30 +00:00
Mike Auty
a52b26e15c
Merge branch 'stable' into develop
2026-01-29 21:54:34 +00:00
ikelos and GitHub
f54c4db6ef
Merge pull request #1935 from volatilityfoundation/release/v2.27.0
...
Release/v2.27.0
2026-01-29 21:28:51 +00:00
Mike Auty
d8485fe460
Add arrow support to pyinstaller build
2026-01-29 21:04:51 +00:00
Mike Auty
6b9a6f84c3
Bump year for copyrights to 2026
2026-01-29 20:39:09 +00:00
ikelos and GitHub
0f95d6e44c
Merge pull request #1932 from kyrre/feature/multitypedata-repr
...
Fix format_hints.MultiTypeData representation in Parquet/Arrow renderers
2026-01-25 14:01:45 +00:00
kyrre
9949565bd8
use pa.bytes instead of pa.utf8 for format_hints.MultiTypeData
2026-01-14 19:55:43 +01:00
Donghyun Kim