Mike Auty
1e1b3fda36
Windows: Fix up typo in num_entries parameter
2021-08-26 14:05:53 +01:00
Mike Auty
2371c1158d
Windows: Ensure DTBs don't have all valid entries
...
We were finding that PAE results were being masked by certain pages with
64bit results. The DTBs could be distinguished from good DTBs because
every entry was valid (which for a 64-bit or even 32-bit DTB is
extremely unlikely except on systems with *vast* quanties of memory.
As such, this now tests for all entries being allocated and doesn't return the
DTB if this is the case.
2021-08-26 11:50:04 +01:00
Mike Auty
aa1c24e60a
Core: Make pointer caching more accurate
2021-08-26 11:43:32 +01:00
ikelos and GitHub
2dda3b4946
Merge pull request #549 from volatilityfoundation/feature/intel-coalesce-by-default
...
Layers: Coalesce intel mapping responses
2021-08-25 16:46:43 +01:00
Mike Auty
b90fd6bbb2
Automagic: Only traverse down intel layers
2021-08-24 21:59:18 +01:00
Mike Auty
27c5dfdffd
Plugins: Add in architectures for ModuleRequirement
...
Fixes #553
2021-08-24 21:47:47 +01:00
ikelos and GitHub
7bf3ac4a41
Merge pull request #551 from volatilityfoundation/feature/windows-kernel-module
...
Windows: Update to kernel ModuleRequirement for ease of config
2021-08-22 12:28:47 +01:00
Mike Auty
97da37d968
Windows: Update to kernel module for ease of config
2021-08-20 00:53:03 +01:00
Mike Auty
ab075ac667
Windows: Fix pstree physical/virtual offsets
2021-08-20 00:52:43 +01:00
Mike Auty
0aa59111df
Generic: YaraScanner fail on no rules
2021-08-19 23:06:55 +01:00
Mike Auty
260f879334
Core: Fix caching of pointer objects
2021-08-19 15:32:48 +01:00
Mike Auty
98db5e46d4
Windows: Remove hardcoded parameter in poolscanner
2021-08-19 11:12:05 +01:00
Mike Auty
db2ec8cfb2
Core: Ensure module configuration is recordable
2021-08-16 16:59:11 +01:00
x
ef27d07183
Add missing patch that fixes KERB_ECRYPT structure size
2021-08-13 15:06:48 +00:00
x
70750d2b92
Remove unused variable from plugin
2021-08-12 22:52:08 +00:00
ikelos and GitHub
5f276df35c
Merge pull request #484 from volatilityfoundation/skeleton_key_check_plugin
...
Skeleton key check plugin
2021-08-12 23:39:39 +01:00
x
d86b9b34e4
Fix return types, change confusing use of continue, switch to get_absolute_symbol_address
2021-08-12 15:47:16 +00:00
Mike Auty
19b2a06964
Layers: Coalesce intel mapping responses
2021-08-11 22:02:08 +01:00
ikelos and GitHub
595f377f19
Merge pull request #538 from volatilityfoundation/feature/better-modules-support2
...
Feature/better modules support
2021-08-11 21:09:24 +01:00
Mike Auty
86771d15d5
Core: Don't get to hasty with the API version
2021-08-11 21:08:33 +01:00
Mike Auty
2cfb65380a
Core: Include API changes file
2021-08-11 21:06:43 +01:00
Mike Auty
8745931dea
Windows: Add coalesce support to memmap
2021-08-05 17:28:36 +01:00
Mike Auty
1611a72eb9
Windows: Fix memmap not to create empty files
2021-08-05 16:21:48 +01:00
Mike Auty
058de2d9a8
Windows: Mute crypto warnings from lgtm
2021-08-04 22:25:13 +01:00
ikelos and GitHub
ee70c1c6ab
Merge pull request #540 from volatilityfoundation/feature/pdbconv-vs19
...
Feature/pdbconv vs19
2021-08-02 11:02:12 +01:00
Mike Auty
0343c8f81e
Windows: Pdbsan typing and doc fixes
2021-07-30 21:20:33 +01:00
Mike Auty
30eec0cb76
Windows: Ensure the kernel contains an actual kvo
2021-07-30 00:17:26 +01:00
Mike Auty
e793956e02
Windows: Update netscan offsets for win10-17763-x64 ( #478 )
2021-07-29 00:17:22 +01:00
Mike Auty
fda1512273
Windows: Fix pdbconv handling of unknown types
2021-07-29 00:05:36 +01:00
ikelos and GitHub
d1173b07ee
Merge pull request #545 from volatilityfoundation/skip_invalid_socket_references
...
Skip invalid sockets in netstat enumeration, based on @fgomulka testing
2021-07-27 22:23:47 +01:00
ikelos and GitHub
0c925a49a8
Merge pull request #544 from volatilityfoundation/improve_mac_vnode_handling
...
Cleanup vnode processing and smear protection based on @fgomulka testing
2021-07-27 22:23:07 +01:00
Andrew Case
c9232ab7b5
Skip invalid sockets in netstat enumeration, based on @fgomulka testing
2021-07-27 20:04:24 +00:00
Andrew Case
c1bf63db83
Adding missing change for pointer_to_string exception catching
2021-07-27 19:59:28 +00:00
Andrew Case
63b4c60d3b
Cleanup vnode processing and smear protection based on @fgomulka testing
2021-07-27 19:51:55 +00:00
ikelos and GitHub
01a63ff331
Merge pull request #499 from gcmoreira/kmsg-plugin
...
Linux kernel ring buffer reader plugin
2021-07-26 21:48:18 +01:00
Mike Auty
deaa86f625
Windows: Ensure we emit LF_STRUCTURE_VS19 types
2021-07-24 23:01:11 +01:00
Mike Auty
9358700553
Windows: Refactor PDB code and support VS19 new types
2021-07-24 22:39:02 +01:00
Mike Auty
6fdf6e9e9f
Windows: Convert pslist as an example
2021-07-22 22:46:39 +01:00
Mike Auty
cd2f40bc34
Mac: Update all plugins to ModuleRequirement
2021-07-22 22:42:06 +01:00
Mike Auty
1480aca453
Linux: Update all plugins to ModuleRequirement
2021-07-22 22:40:09 +01:00
Mike Auty
abbd516f99
Layers: Add minimum framework requirements
2021-07-22 22:37:58 +01:00
Mike Auty
31dc6f34c9
Automagic: Make symbol_shift automagic change
2021-07-22 22:37:58 +01:00
Mike Auty
213eeda268
Core: Add module collection support
2021-07-22 22:37:58 +01:00
Mike Auty
d2420899c5
Layers: Fix minor pointless typo
2021-07-22 22:37:45 +01:00
Mike Auty
c993c35152
Core: Further python 3.6 fixes
2021-07-22 22:23:32 +01:00
Mike Auty
66c96644ac
Core: Minor flynt and typing fixes
2021-07-22 21:36:37 +01:00
Mike Auty
787f61d5a7
Documentation: Update minimum python version.
2021-07-22 21:30:08 +01:00
Mike Auty
767eea614b
Windows: Add extra checks to pdbscan
2021-07-19 12:31:13 +01:00
Mike Auty
59ab92e99d
Development: Update development scripts with f-strings
2021-07-18 23:20:27 +01:00
Mike Auty
0d48261201
Core: Change all 3.5 type hints to variable annotations
2021-07-18 16:49:37 +01:00
Mike Auty