WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-30 11:49:42 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,337 Commits 80 Branches 17 Tags
1a3c48a33f13ef4eaf53ebb233cdcf47a68a4f79
Commit Graph
4337 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Andrew Case 1a3c48a33f Address feedback 2024-09-02 14:18:01 -05:00
Andrew Case f1c5bbdfaf Address feedback 2024-07-29 19:11:32 -05:00
Andrew Case 2e0f7371ac Add pe_symbols plugin for user specified symbol resolution as well as programtic access 2024-07-23 14:41:53 -05:00
ikelosandGitHub 721971652c Merge pull request #1168 from volatilityfoundation/svcdiff_malware_detection 
Add svclist and svcdiff plugins. Make svcscan more modular to support…
 2024-07-21 18:37:49 +01:00
Andrew Case 111873e173 Fix class vs static method and leading underscores 2024-07-21 11:54:06 -05:00
Andrew Case 21396185d0 Address feedback 2024-07-21 11:10:38 -05:00
ikelosandGitHub fba7255b23 Merge pull request #1204 from volatilityfoundation/pedump_v2 
Add pedump plugin and unified API for extracting PE files to disk
 2024-07-21 17:05:42 +01:00
Andrew Case 9454181b98 Address feedback 2024-07-21 09:42:19 -05:00
ikelosandGitHub 5645c4ff4b Merge pull request #1167 from volatilityfoundation/process_ghosting 
Add processghosting plugin to detect process ghosting and related tec…
 2024-07-21 13:31:35 +01:00
ikelosandGitHub be10469702 Merge pull request #1202 from dgmcdona/dgmcdona/windows-shimcachemem 
Windows: ShimcacheMem
 2024-07-21 13:21:45 +01:00
ikelosandGitHub d494df2673 Merge pull request #1201 from volatilityfoundation/issues/issue1200 
Windows: Fix vadyarascan sanity check and bad documentation
 2024-07-21 13:11:51 +01:00
ikelosandGitHub 6043e740ca Merge pull request #1177 from volatilityfoundation/118-missing-plugins-threads-timers 
118 missing plugins threads timers
 2024-07-21 12:03:18 +01:00
ikelosandGitHub 7aa509b92b Merge pull request #1186 from volatilityfoundation/userassist_timeline 
Add timeliner support to userassist
 2024-07-21 12:00:27 +01:00
atcuno 12f3beacfc Add dedicated plugin and API for extracting PE files from kernel and process memory 2024-07-18 17:56:24 -05:00
atcuno 75ccf1bfab Add dedicated plugin and API for extracting PE files from kernel and process memory 2024-07-18 17:54:33 -05:00
atcuno 920b3ec615 Black fix 2024-07-18 15:48:21 -05:00
atcuno b0a89f2109 Address feedback 2024-07-18 15:47:37 -05:00
atcuno 2a5e94a094 Black fixes 2024-07-18 15:01:10 -05:00
atcuno a7af052509 Black fixes 2024-07-18 14:59:40 -05:00
atcuno 8da046530f Address feedback 2024-07-18 14:57:31 -05:00
Andrew Case 1508a41499 Move registry table init into the generator function 2024-07-18 11:33:30 -05:00
David McDonald 4048d0b122 Windows: Adds shimcachemem plugin 2024-07-18 11:07:49 -05:00
David McDonald a684e284cc Windows: Adds shimcache symbol files + extensions 2024-07-18 11:07:49 -05:00
Mike Auty a5cf635fd8 Windows: Fix the vadyarascan sanity check 2024-07-17 17:31:44 +01:00
Mike Auty be5423f786 Windows: Fix up broken imports in info plugin 2024-07-17 17:08:15 +01:00
ikelosandGitHub 30dff64967 Merge pull request #1080 from gcmoreira/linux_netfilter_hooks_plugin 
Linux netfilter hooks plugin
 2024-07-16 22:59:53 +01:00
ikelosandGitHub 727cd878c0 Merge pull request #1176 from volatilityfoundation/unloadedmodules 
#1175 - initial unloadedmodules plugin
 2024-07-16 22:51:33 +01:00
Dave Lassalle 43e22d72bd #118 - black formatting 2024-07-16 09:23:06 -05:00
Gustavo Moreira cf6c7fb1f4 linux.netfilter.Netfilter: Add lsmod version requirement check on AbstractNetfilter 2024-07-16 09:38:49 +10:00
Dave Lassalle 99cf48597a #118 - use canonicalize for offset 2024-07-15 15:46:27 -05:00
Dave Lassalle 7e3615335c #1175 - config_path change 2024-07-15 15:40:22 -05:00
Dave Lassalle 55fe4ba47a #118 - MR feedback 2024-07-15 15:20:10 -05:00
Mike Auty cb6929163b Windows: Fix vadyarascan sanity check and bad documentation 2024-07-15 18:14:50 +01:00
ikelosandGitHub 50dbeac080 Merge pull request #1190 from gcmoreira/windows_psscan_fix 
Windows - psscan plugin fixes
 2024-07-15 18:09:45 +01:00
Gustavo Moreira a6d8ba8bfa windows eprocess validation: Make the creation and exit year checks dynamic 2024-07-15 20:22:40 +10:00
Gustavo Moreira ac9236cb43 linux.netfilter.Netfilter: Add LinuxUtilities version requirement check on AbstractNetfilter 2024-07-15 19:59:41 +10:00
ikelosandGitHub ccaa473972 Merge pull request #1199 from volatilityfoundation/issues/python-3.8 
Core: Bump the version and minium python to support pip
 2024-07-14 19:12:49 +01:00
Mike Auty 61e3e894ee Core: Bump the version and minium python to support pip 2024-07-14 19:04:06 +01:00
ikelosandGitHub d3345259ac Merge pull request #1157 from branchvincent/full-extra 
add full and dev extras
 2024-07-14 18:58:41 +01:00
ikelosandGitHub e8dc54a4b8 Merge pull request #1173 from brandon-barnacle/bbarnacle/windows-modscan-modules 
Windows: Bug fixes and additions to modules and modscan
 2024-07-14 18:37:38 +01:00
ikelosandGitHub d077fa06be Merge pull request #1192 from volatilityfoundation/issues/issue1162 
Implement the fix that was reverted as part of #1162.
 2024-07-14 18:20:15 +01:00
ikelosandGitHub 987ecaf5ed Merge pull request #1193 from volatilityfoundation/issues/issue1155 
Initial draft of complete-vad vadyarascan
 2024-07-14 15:16:35 +01:00
Brandon BarnacleandBrandon Barnacle 8d60e9160f PR comment changes. 2024-07-08 09:40:19 -04:00
Brandon BarnacleandBrandon Barnacle b35169d0bc Windows: Bug fixes and additions to modules and modscan 
This pull request adds several changes to the modules and modscan
plugins that fix bugs, unify options and operations, and allow for
filtering by name and base address in both plugins. Previously,
modscan and modules had a substantial amount of partially duplicated
code, which led to bugs, such as:
	Only one allowed filtering by --name
	Only one cycled through the session layers to find the one hosting the kernel module
With the new inheritance and combined implementation, the correct
and complete implementation applies to both.

This PR also addresses the feedback in
https://github.com/volatilityfoundation/volatility3/pull/1099. In this PR,
--name and –base apply to the processing of modules and determine
both which plugins are displayed in output as well as which are
processed for extraction. This fixes the issue of using --filters, which
only filters the final command line output, but leads to every module
being extracted.
 2024-07-08 09:40:02 -04:00
Mike Auty ac15840fd8 Windows: Fix up yara plugin code scanning warnings 2024-07-07 15:23:48 +01:00
Mike Auty bb4cfb6e00 Initial draft of complete-vad vadyarascan 2024-07-07 15:13:06 +01:00
Mike Auty 4938195113 Implement the fix that was reverted as part of #1162. 2024-07-06 17:04:51 +01:00
ikelosandGitHub 1d4a27ea41 Merge pull request #1170 from volatilityfoundation/hollow_process 
Add new plugin to detect hollowed processes using a variety of techni…
 2024-07-05 19:10:28 +01:00
ikelosandGitHub 41c6963cb3 Merge pull request #1183 from hsarkey/hsarkey/windows-dlllist 
Windows: Adding name & base filtering for --dump on dlllist
 2024-07-05 18:50:46 +01:00
atcuno 96a382ed52 Further type information 2024-07-05 09:33:34 -05:00