ikelos and GitHub
1ccbf33c04
Merge pull request #1096 from eve-mem/linux_update_mm_extension
...
Linux update mm extension
2024-02-20 21:01:23 +00:00
Eve
a597ee1776
Linux: update minor version number due to API changes with linux extension for mm_struct
2024-02-20 06:48:16 +00:00
Eve
437a91375d
Linux: add TODO for mm_struct for methods that should be removed when moving to version 3.0.0
2024-02-20 06:39:42 +00:00
ikelos and GitHub
3703e119ce
Merge pull request #1084 from volatilityfoundation/feature/table-check
...
Symbols: Add support for metadata verification of symbol tables
2024-02-18 22:19:14 +00:00
Eve
683319bd7f
Linux: add deprecation warning for get_maple_tree_iter and get_mmap_iter mm_struct extensions.
2024-02-12 08:47:02 +00:00
ikelos and GitHub
6d34e43667
Merge pull request #754 from volatilityfoundation/feature/cli-config-hierarchy
...
CLI: Add support for a configuration options file
2024-02-08 12:05:24 +00:00
Mike Auty
7b42ef0a9f
Documentation: Add in more information about overriding configuration values
2024-02-08 11:59:50 +00:00
Mike Auty
a66a446190
CLI: Reblack after updating PR - take 2
2024-02-08 11:16:41 +00:00
Mike Auty
9127509db9
CLI: Reblack after updating PR
2024-02-08 11:13:14 +00:00
ikelos and GitHub
da06d2e55a
Merge branch 'develop' into feature/cli-config-hierarchy
2024-02-08 11:10:28 +00:00
Eve
18220498ae
Linux: update linux.pslist plugin to use task.mm.get_vma_iter() so that it works correctly on newer kernels
2024-02-07 09:08:25 +00:00
Eve
6a384c197c
Linux: update mm_struct extension so that _get_maple_tree_iter and _get_mmap_iter are more clearly identified, showing that get_vma_iter should be used instead
2024-02-07 09:04:55 +00:00
ikelos and GitHub
795477e24b
Merge pull request #1094 from iyassou/feature/windows-truecrypt
...
Windows: add TrueCrypt plugin
2024-02-04 09:28:55 +00:00
Iyassou Shimels
d44c0fef36
run Black formatter
2024-02-04 11:21:14 +03:00
ikelos and GitHub
bee98efd96
Merge pull request #1063 from forensicxlab/feature/IAT
...
Feature: Import Address Table
2024-02-03 23:50:11 +00:00
k1nd0ne
cf9029fd85
Fixing the year in the Copyright
2024-02-04 00:43:33 +01:00
Iyassou Shimels
41cbfbfa34
add license
2024-02-03 11:58:25 +03:00
Iyassou Shimels
ab8ed049a4
Windows: add TrueCrypt plugin
2024-02-03 11:32:00 +03:00
k1nd0ne
130621a2e7
Changing comment when Type error is occuring
2024-02-02 20:04:36 +01:00
ikelos and GitHub
18dd23a6b1
Merge pull request #1076 from ckusek15/windows-pstree
...
Windows: Add additional command line argument info to windows pstree
2024-02-01 11:16:24 +00:00
ikelos and GitHub
9b281c478b
Merge pull request #1071 from hsarkey/hsarkey/windows-malfind
...
Windows: Added '--refined' option to windows malfind plugin
2024-02-01 09:18:41 +00:00
ikelos and GitHub
e436328e88
Merge pull request #1092 from volatilityfoundation/stable
...
Stable
2024-01-31 21:43:57 +00:00
Mike Auty
f95be04305
Documentation: Bump the copyright here to 2024
2024-01-31 21:36:21 +00:00
ikelos and GitHub
d2f7b416de
Merge pull request #1091 from volatilityfoundation/release/v2.5.2
...
Documentation: Update copyright in README.md for 2024
2024-01-31 21:21:20 +00:00
Mike Auty
ba488c78cd
Documentation: Bump the copyright here to 2024
2024-01-31 21:13:00 +00:00
Mike Auty
86b0fd431a
Core: Apply black 24.1.0 across the whole codebase
2024-01-31 21:09:48 +00:00
Mike Auty
7de7dfdabf
Documentation: Update copyright in README.md for 2024
2024-01-31 21:05:00 +00:00
Mike Auty
6d093a4e43
Documentation: Update copyright in README.md for 2024
2024-01-31 21:04:16 +00:00
hsarkey
470c750d82
Updated to use dictionary for refined criteria and BaseAbsentValue for when criteria is not met
2024-01-31 16:00:29 -05:00
ikelos and GitHub
2b15f3fd87
Merge pull request #1069 from dgmcdona/dgmcdona/windows_svcscan
...
Windows: SvcScan Binary Info
2024-01-30 16:49:18 +00:00
David McDonald
43e8e01daf
Removes unnecessary pass and deindents return stmt
2024-01-30 09:26:17 -06:00
David McDonald
4192e8a711
Fix condition in OsDistinguisher
2024-01-29 00:38:06 -06:00
David McDonald
42c2a86a37
Add logging for when a Services key cannot be retrieved
2024-01-29 00:38:06 -06:00
David McDonald
c517a44cde
Add type hints/casts to _get_service_key method
2024-01-29 00:38:06 -06:00
David McDonald
f5c1bf0f1f
Remove argument that matches default
2024-01-29 00:38:06 -06:00
David McDonald
5541378afe
Create unique config path
2024-01-29 00:38:06 -06:00
David McDonald
4b400b6df6
Refactor out code duplication in OS version checks
2024-01-29 00:38:06 -06:00
David McDonald
86d6b4f724
Bump plugin version
2024-01-29 00:38:06 -06:00
David McDonald
77b0110635
Windows: Fixes svc symbols and OS version detection
...
There were some changes made to the service structures between certain
versions of Windows that caused the PID/binary path to fail to parse
across quite a few samples. This adds the appropriate version detection
logic and updated symbol files to ensure that services are parsed
correctly across Windows versions.
2024-01-29 00:38:06 -06:00
David McDonald
837d3b7b9f
Windows: Add parsing of service binary/dll
...
Parses the binary or dll associated with each service from the Windows
SYSTEM hive and includes it in the output for each service.
2024-01-29 00:38:06 -06:00
Mike Auty
497d291ef4
Windows: Fix black on dumpfiles
2024-01-29 00:07:40 +00:00
ikelos and GitHub
b211dc17b0
Merge pull request #1083 from brandon-barnacle/bbarnacle/windows-dumpfiles
...
Windows: Add regex filtering to dumpfiles
2024-01-28 23:58:16 +00:00
Mike Auty
4dc6f637b0
Core: Apply black 24.1.0 to the whole codebase
2024-01-28 23:50:45 +00:00
Brandon Barnacle
ae5375a622
PR comment changes
...
Change the --regex flag to --filter. Add a check so that --filter
cannot be used with --physaddr or --virtaddr. Change
self.config["filter"] check to check if file_re has been set.
2024-01-26 11:21:16 -05:00
Calvin Kusek
a50ebb6014
Windows: Display additional process info for windows.pstree
2024-01-18 22:25:54 -05:00
hsarkey
ef36cb5a6c
Updated windows.malfind to have a "Notes" column to indicate if a process meets
...
"refined" criteria, which includes common headers like MZ,PE or function
prologues. Fixed black formatting issue.
2024-01-17 17:51:27 -05:00
hsarkey
e6e138f12d
Updated windows.malfind to have a "Notes" column which will indicate if a process
...
meets a "refined criteria", meaning it has a common header type (MZ, PE, or a
function prologue).
2024-01-17 17:24:26 -05:00
hsarkey
4e89040dad
Updated changes to the windows.malfind plugin. Eliminated --refined as a command line option and instead
...
added an additional column called "Notes" to provide info on common headers.
2024-01-17 16:52:16 -05:00
Mike Auty
4b86b9ea89
Plugins: Remove unnecessary variable from windows.mftscan
2024-01-17 20:40:27 +00:00
Mike Auty
01ffcd9634
Core: Fixing None equality test in MapleTree implementation
2024-01-17 20:37:26 +00:00
