ikelos and GitHub
1bfaf960ef
Merge pull request #421 from volatilityfoundation/issue_368_windows_handles_x86_win8
...
refs #368 fix handles on 32-bit windows 8 and 10 - finding SAR is not necessary on these platforms
2021-01-13 00:27:12 +00:00
Mike Auty
53169b15ab
Intel: Fix PAE typo
2021-01-08 17:40:52 +00:00
ikelos and GitHub
1ea9a493a8
Merge pull request #415 from volatilityfoundation/windows_info_add_Is64Bits_and_IsPAE
...
add Is64Bit and IsPAE properties to the windows.info plugin
2021-01-06 21:10:26 +00:00
ikelos and GitHub
95c19f1676
Merge pull request #416 from volatilityfoundation/issues/intel-pae-metadata
...
Layers: Ensure intel PAE reports pae in the metadata
2021-01-06 21:09:33 +00:00
ikelos and GitHub
cc3818391c
Merge pull request #405 from volatilityfoundation/issues/mac_vpager_native_layer
...
Linux: Use native_layer when constructing from a pointer offset
2021-01-06 21:05:00 +00:00
ikelos and GitHub
b3339437fb
Merge pull request #404 from volatilityfoundation/issues/bad_dtb_finder_code
...
Automagic: Windows DTB finder was too limited
2021-01-06 21:04:07 +00:00
Mike Auty
e1032623fe
Layers: Ensure intel PAE reports pae in the metadata
2021-01-06 19:28:24 +00:00
iMHLv2
d7d176d040
add Is64Bit and IsPAE properties to the windows.info plugin
2021-01-06 11:36:56 -06:00
iMHLv2
53397117ef
remove unnecessary and unused imports from the windows extensions init file
2021-01-06 10:30:01 -06:00
iMHLv2
2c3b6668d5
refs #368 fix handles on 32-bit windows 8 and 10 - finding SAR is not necessary on these versions
2021-01-06 10:10:51 -06:00
Mike Auty
f75e77997d
Layerwriter: Remove erroneous debugging statements
2021-01-03 10:38:49 +00:00
Mike Auty
1c2a9921ff
Windows: Partial fix for #368 error messages
2020-12-27 15:21:18 +00:00
Mike Auty
ccef55e448
Linux: Use native_layer when constructing from a pointer offset
2020-12-21 15:57:18 +00:00
Mike Auty
c45b1b3423
Automagic: Windows DTB finder was too limited
...
The DTB finder test returns a full DTB, if that's over the scan chunk
size it'll get discarded, so we remove that test.
2020-12-21 15:52:43 +00:00
Mike Auty
f9102a60b8
Release: Update the version number for this release
...
Entering code-freeze
10th Dec - Bug fixes and documentation, no new features
7th Jan - Only critical fixes
21st Jan - Release date
2020-12-10 22:42:39 +00:00
Andrew Case and ikelos
93c6a62972
Detect attempts to fix the image base for LARGEADDRESSAWARE executables and provide the user with a warning. #332
2020-12-10 18:58:00 +00:00
Mike Auty
d63aef566f
Codebase: Yapf the codebase again
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
747fe8609f
update copywrite to 2020
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
17e629a4c4
converted process_file_object into a classmethod
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
e9f870ff05
revert self.context change back to self._context
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
9f977080c5
changed self._context to self.context
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
d98337cc09
added debug statements to dump_file_producer when none is returned
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
4f37a28185
dump_file_producer is now a classmethod and returns a FileInterface Object
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
49acf44302
dumpfiles.py is now consistent with master and runs correctly
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
8e1a599203
changed PluginRequirement to VersionRequirement
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
0a9e663c41
remove the _VACB.is_valid() method - do all validity checks in the calling function
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
442f877e9a
refs #197 initial commit of windows.dumpfiles
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
20f4fbf157
add --virtaddr and --physaddr options so users can supply virtual or physical addresses (or both)
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
0c09b98318
use native_layer_name in file_name_with_device() in case the FILE_OBJECT is instantiated from a memory (physical) layer
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
25b56b5ca4
remove the _VACB.is_valid() method - do all validity checks in the calling function
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
3ac89577cc
refs #197 initial commit of windows.dumpfiles
2020-12-10 15:37:40 +00:00
Mike Auty
56ff75a74b
Layers: Add internal intel debugging flag
2020-12-10 12:18:14 +00:00
Mike Auty
e28016e45b
Pdbutility: Improve usability of symbol_table_from_offset
2020-12-08 16:34:59 +00:00
Jan and ikelos
3dea2b4187
adds os_distinguisher for 18363
2020-12-08 10:34:07 +00:00
Jan and ikelos
b3ffddcff0
fixes wrong offset in 18363 x64
2020-12-08 10:34:07 +00:00
Jan and ikelos
774528206c
adds new vol3 netscan profiles and fixes rare bug
2020-12-08 10:34:07 +00:00
Mike Auty
0d267d0d56
Codebase: Improve typing using monkeytype
2020-12-06 21:34:28 +00:00
cecio and ikelos
c9c37a9b35
OS check reworked as suggested by @iMHLv2 and @ikelos
2020-12-02 14:23:12 +00:00
cecio and ikelos
1cf625fc89
fix: the bounce from physical to virtual process is required only for OS < Win10.
...
Added the check in the "dump" option
2020-12-02 14:23:12 +00:00
Mike Auty
f88ce55199
Automagic: Improve debugging output for linux/mac
2020-12-02 09:51:42 +00:00
Mike Auty
8fb53a32a8
PdbUtility: Support multiple debug directories
2020-12-01 01:21:36 +00:00
Mike Auty
4d0a07194a
PDBUtility: Update to use only pefile
2020-12-01 01:21:36 +00:00
Mike Auty
d77399b82b
Pdbconv: Use both pefile and volatility to get the guid
2020-12-01 01:21:36 +00:00
Mike Auty
65310eb841
Pdbconv: Slight tweaks to database_name finding
2020-11-29 23:05:21 +00:00
Mike Auty
dd0f690988
Pdbconv: Extract appropriate database name if possible
...
Fixes #381
2020-11-29 22:56:01 +00:00
AsafEitani and ikelos
4ec006e606
Fix 'maxsize variable doing nothing' bug
...
In one of the earlier commits the varible was erased from being passed to vaddump - that corrects it.
2020-11-18 19:56:30 +00:00
Mike Auty
9150cd971b
Core: Change base class for FileHandlerInterface
...
Python 3.6 doesn't appear to support IO[bytes] (and this is also from
the typing library), so we instead now inherit from RawIOBase. This
provides read, but does not come with a constructor (like FileIO) so
is suitable for our needs.
Fixes issue #376 .
2020-11-17 22:04:55 +00:00
Mike Auty
30de81795c
Windows: Update requirements to pslist 2.0.0
2020-11-16 09:41:42 +00:00
Mike Auty
745fce2281
Symbols: Fix pool error handling
...
Fixes #375
2020-11-15 23:56:07 +00:00
Mike Auty
4a8b4d1706
Plugins: Bump remaining plugins to framework require 2.0.0
2020-11-15 16:53:03 +00:00
