WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity
6,233 Commits 80 Branches 17 Tags
1eb87178b8ec9f6f196590f2f024db2c702c8d31
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
ikelosandGitHub 1eb87178b8 Merge pull request #1854 from cpuu/develop 
Update Linux tutorial: remove outdated info and add plugin examples
 2025-07-07 19:49:20 +01:00
ikelosandGitHub 29e210bd33 Merge pull request #1837 from SolitudePy/svcdiff_malware 
Malware categorization: windows.svcdiff
 2025-07-07 19:12:40 +01:00
ikelosandGitHub 385192acd0 Merge pull request #1863 from volatilityfoundation/malfind_warning 
Change warning to debug to not break plugin output and to conform to …
 2025-07-01 00:59:18 +01:00
ikelosandGitHub 997f2a4f4c Merge pull request #1856 from SolitudePy/sockstat_remove_unix 
Plugins: remove unused unix argument in linux.sockstat
 2025-06-29 16:24:05 +01:00
ikelosandGitHub a2ebe6006e Merge pull request #1852 from SolitudePy/syscalls_malware_plugin 
Malware categorization: categorize EDR evading plugins with in/direct_syscall
 2025-06-29 16:20:06 +01:00
ikelosandGitHub 9440075e52 Merge pull request #1851 from SolitudePy/ldr_modules_malware 
Plugins: categorize ldrmodules as a malware plugin
 2025-06-29 16:18:01 +01:00
ikelosandGitHub 308a4668b7 Merge pull request #1829 from SolitudePy/regexscan 
Regexscan fixes
 2025-06-22 23:10:38 +01:00
ikelosandGitHub f5feee842d Merge pull request #1841 from SolitudePy/check_creds_malware 
Malware categorization: linux.check_creds
 2025-06-12 08:05:01 +01:00
ikelosandGitHub 470c53c5f7 Merge branch 'develop' into check_creds_malware 2025-06-11 22:21:59 +01:00
ikelosandGitHub 63019c0988 Merge pull request #1833 from SolitudePy/psxview_malware 
Malware categorization: windows.psxview
 2025-06-11 22:18:32 +01:00
ikelosandGitHub 76db04c494 Merge pull request #1807 from volatilityfoundation/bugfix/windows_thrdscan_tuple_unpacking 
Windows Thrdscan: Fix broken tuple unpacking
 2025-06-11 14:06:43 +01:00
ikelosandGitHub 58f441186c Merge pull request #1850 from SolitudePy/malware_plugins_category 
Malware categorization: linux.tty_check, linux.netfilter, linux.modxview
 2025-06-10 21:20:12 +01:00
ikelosandGitHub 43ed10a4f8 Merge pull request #1846 from SolitudePy/linux_malware_plugins 
Malware categorization: linux.malfind & linux.keyboard_notifiers
 2025-06-10 21:07:42 +01:00
ikelosandGitHub 58e41d754a Merge pull request #1845 from SolitudePy/categorize_linux_malware 
Malware categorization: linux.check_afinfo & linux.hidden_modules
 2025-06-10 21:05:41 +01:00
ikelosandGitHub 9596893f1b Merge pull request #1844 from SolitudePy/check_syscall_malware 
Malware categorization: linux.check_syscall
 2025-06-10 21:02:34 +01:00
ikelosandGitHub e06910c763 Merge pull request #1843 from SolitudePy/check_modules_malware 
Malware categorization: linux.check_modules
 2025-06-10 21:00:02 +01:00
ikelosandGitHub c62d77e4e2 Merge pull request #1842 from SolitudePy/check_idt_malware 
Malware categorization: linux.check_idt
 2025-06-10 20:58:04 +01:00
ikelosandGitHub f2f83f5ce1 Merge pull request #1838 from SolitudePy/unhooked_syscalls_malware 
Malware categorization: windows.unhooked_system_calls
 2025-06-10 20:54:33 +01:00
ikelosandGitHub ebd6c8719a Merge pull request #1840 from SolitudePy/drivermodule_malware 
Malware categorization: windows.drivermodule
 2025-06-07 18:09:57 +01:00
ikelosandGitHub 2fbb872c9a Merge pull request #1834 from SolitudePy/skel_key_malware 
Malware categorization: windows.skeleton_key_check
 2025-06-07 15:12:37 +01:00
ikelosandGitHub 84c33916df Merge pull request #1835 from SolitudePy/suspicious_threads_malware 
Malware categorization: windows.suspicious_threads
 2025-06-07 15:10:02 +01:00
ikelosandGitHub 9c84152eea Merge pull request #1832 from SolitudePy/processghosting_malware 
Malware categorization: windows.processghosting
 2025-06-07 15:07:36 +01:00
ikelosandGitHub 2bd9a0e710 Merge pull request #1831 from SolitudePy/hollowprocesses_malware 
Malware categorization: windows.hollowprocesses
 2025-06-07 15:05:59 +01:00
ikelosandGitHub 3f9794b3dc Merge pull request #1830 from SolitudePy/malfind_malware 
Malware categorization: windows.malfind
 2025-06-07 15:04:23 +01:00
ikelosandGitHub 1571e65ad8 Merge pull request #1821 from eve-mem/deprecation_warning_for_PluginRequirement 
Add a deprecation warning for PluginRequirement
 2025-05-29 19:48:50 +01:00
ikelosandGitHub 9fd734762b Merge pull request #1823 from j-t-1/malfind 
Tweak comments
 2025-05-29 19:48:37 +01:00
ikelosandGitHub 8e9e2d6f08 Merge pull request #1822 from eve-mem/linux_perf_events_VersionRequirement 
Linux: update PerfEvents plugin to use VersionRequirement for pslist
 2025-05-29 09:47:05 +01:00
ikelosandGitHub 1206b69abd Update volatility3/framework/plugins/windows/malfind.py 2025-05-29 09:45:26 +01:00
ikelosandGitHub c9e25a3f86 Merge pull request #1815 from ddogfoodd/fix-typos 
fix: typos
 2025-05-26 10:00:50 +01:00
ikelosandGitHub a8f9c9449d Merge pull request #1813 from geekscrapy/enablenocase 
Make nocase accessible in yarascan.YaraScan yara_string
 2025-05-19 14:14:13 +01:00
ikelosandGitHub b3c53fde26 Merge pull request #1812 from JakePeralta7/develop 
Minor fix to Hashdump.get_user_keys()
 2025-05-19 12:42:46 +01:00
ikelosandGitHub b414ee3ba2 Merge pull request #1794 from volatilityfoundation/feature/volshell-breakpoints 
Volshell breakpointing
 2025-05-19 12:41:26 +01:00
ikelosandGitHub b3e770dd0c Merge pull request #1811 from j-t-1/the 
Remove extra word in comment
 2025-05-18 20:20:36 +01:00
ikelosandGitHub a413c44b00 Merge pull request #1810 from j-t-1/align 
Align SeCreateTokenPrivilege with the other privileges
 2025-05-16 22:29:00 +01:00
ikelosandGitHub 1a71b03b8d Merge pull request #1791 from volatilityfoundation/feature/code-coverage 
Add in coverage recording to the test process
 2025-05-11 13:55:45 +01:00
ikelosandGitHub 28a72b8dd8 Merge pull request #1802 from eve-mem/linux_lsof_smear_comment 
Linux: Add comment for  explaining the behaviour with smear
 2025-05-10 15:10:25 +01:00
ikelosandGitHub ff6de6eab4 Merge pull request #1795 from Abyss-W4tcher/dentry_names_forward_slashes 
Linux: prevent "forward slashes only" dentry names
 2025-05-08 23:12:11 +01:00
ikelosandGitHub 686057d806 Merge pull request #1800 from SolitudePy/develop 
add functions to etwpatch
 2025-05-07 22:03:37 +01:00
ikelosandGitHub 57b28e5fa2 Merge pull request #1798 from volatilityfoundation/issues/fix-exe-build 
Reformat and install volatility package deps before build
 2025-05-06 23:06:43 +01:00
ikelosandGitHub 142add17a5 Merge pull request #1799 from volatilityfoundation/stable 
Stable
 2025-05-06 22:41:52 +01:00
ikelosandGitHub 606fecf5f8 Update volatility3/framework/plugins/windows/vadyarascan.py 2025-05-06 22:41:33 +01:00
ikelosandGitHub c0c7119c38 Update volatility3/framework/plugins/windows/thrdscan.py 2025-05-06 22:41:27 +01:00
ikelosandGitHub 718f8ca2b5 Update volatility3/framework/plugins/linux/vmayarascan.py 2025-05-06 22:41:21 +01:00
ikelosandGitHub 65d3ff63bc Merge branch 'develop' into stable 2025-05-06 22:37:47 +01:00
ikelosandGitHub a7d64ad39d Merge pull request #1796 from volatilityfoundation/release/v2.26.0 
Release/v2.26.0
 2025-05-06 21:27:58 +01:00
ikelosandGitHub bb65fa31a6 Merge branch 'stable' into release/v2.26.0 2025-05-06 21:09:27 +01:00
ikelosandGitHub 51f0a3081d Merge pull request #1786 from volatilityfoundation/dgmcdona/handles_interface 
Windows Handles: Refactor plugin
 2025-05-01 17:49:58 +01:00
ikelosandGitHub e22e82dcc2 Merge pull request #1787 from JakePeralta7/develop 
Detect ETW Patching
 2025-04-29 12:42:24 +01:00
ikelosandGitHub 0c08b94547 Merge pull request #1793 from eve-mem/issue_1685 
cli: add debug log of plugin version when the plugin is successfully constructed
 2025-04-28 09:10:57 +01:00
ikelosandGitHub 8807e35cab Merge pull request #1792 from volatilityfoundation/issues/update-codeql 
Update codeql action from v2 to v3
 2025-04-27 18:29:41 +01:00
ikelosandGitHub c6e8c0d4e8 Merge pull request #1783 from volatilityfoundation/bugfix/shimcache_tracebacks 
Windows Shimcachemem: Fix tracebacks
 2025-04-26 21:33:39 +01:00
ikelosandGitHub 577747f22c Merge pull request #1789 from eve-mem/linux_issue_1603 
Linux: update extensions used by kallsyms plugin to use utility.pointer_to_string fix issue #1603
 2025-04-26 20:30:34 +01:00
ikelosandGitHub 63f7cbd447 Merge pull request #1779 from j-t-1/svcdiff 
Amend SvcDiff comments at top of file
 2025-04-17 21:10:31 +01:00
ikelosandGitHub fa73298e0f Merge pull request #1579 from volatilityfoundation/feature/coding-style 
Feature/coding style
 2025-04-16 10:19:26 +01:00
ikelosandGitHub 65a02d961e Merge pull request #1764 from volatilityfoundation/issues/make-quickstart-quicker 
Documentation: Improve the readme to make quickstart the first thing …
 2025-04-16 10:18:22 +01:00
ikelosandGitHub 6eb95ca4dc Merge pull request #1778 from Abyss-W4tcher/qemu_layer_incomplete_requirements 
Make QEMU layer call parent's requirements
 2025-04-15 23:50:44 +01:00
ikelosandGitHub 2a16bf19d1 Merge pull request #1777 from volatilityfoundation/fix_thrdscan_tracebacks 
ThrdScan: Fix tracebacks + filtering
 2025-04-15 20:08:42 +01:00
ikelosandGitHub 923ea92cf3 Merge pull request #1772 from volatilityfoundation/fix_symlink_scanning 
Poolscanners: Fix symlink pool types
 2025-04-15 18:06:17 +01:00
ikelosandGitHub 8dae65ee3c Merge pull request #1769 from volatilityfoundation/inodepages/memory_usage 
Linux pagecache.Files: Memory Usage
 2025-04-15 17:18:00 +01:00
ikelosandGitHub df03d2220a Merge pull request #1771 from volatilityfoundation/framework/process_traversal_bugfix 
Bugfix: Linux/Windows process traversal
 2025-04-14 23:43:04 +01:00
ikelosandGitHub 745e148aba Merge pull request #1770 from volatilityfoundation/shimcachemem/bugfixes 
ShimcacheMem: Various bugfixes
 2025-04-14 18:24:52 +01:00
ikelosandGitHub 4e0beda020 Merge pull request #1768 from volatilityfoundation/extensions/process_layer_caching 
Extensions: Add cache decorators as appropriate
 2025-04-14 17:31:54 +01:00
ikelosandGitHub 1b31357665 Merge pull request #1766 from volatilityfoundation/thrdscan/filtering_and_tracebacks 
Windows ThrdScan: Thread filtering, type-hints and tracebacks
 2025-04-13 15:55:43 +01:00
ikelosandGitHub e00f0961c2 Merge pull request #1767 from volatilityfoundation/bugfix/layer_deletion_exception_msg 
Layers: Fix exception message
 2025-04-10 09:51:26 +01:00
ikelosandMike Auty 1ab8ddcb7f Merge pull request #1765 from Abyss-W4tcher/minimum_alignment_adjustment 
[Parity/modules] Adjust module alignment for scanners
 2025-04-09 20:38:50 +01:00
ikelosandGitHub 58c8de6bf7 Merge pull request #1765 from Abyss-W4tcher/minimum_alignment_adjustment 
[Parity/modules] Adjust module alignment for scanners
 2025-04-09 20:35:19 +01:00
ikelosandGitHub ac8a1101ce Update README.md 2025-04-08 20:18:10 +01:00
ikelosandGitHub 842d0e7703 Merge pull request #1763 from volatilityfoundation/inodepages/dump_files_output 
InodePages: Add output column and render when dumped
 2025-04-08 16:07:41 +01:00
ikelosandGitHub 01dd867542 Merge pull request #1760 from volatilityfoundation/bugfix/volshell_dt_traceback 
Fix traceback in volshell's `dt()`
 2025-04-08 08:09:37 +01:00
ikelosandGitHub b3d1ce319c Merge pull request #1758 from volatilityfoundation/bugfix/mftscan_memory_usage 
Windows MFTScan: Memory usage performance fixes
 2025-04-07 14:53:29 +01:00
ikelosandGitHub 6ddb0fef29 Merge pull request #1748 from eve-mem/volshell_display_types_pointer_upgrade_2025 
Volshell: Display types pointer upgrade
 2025-04-03 17:21:30 +01:00
ikelosandGitHub 0fb721e219 Merge pull request #1757 from volatilityfoundation/fix_tests 
Tests: Fix Userassist and MFTScan testdata
 2025-04-02 21:04:46 +01:00
ikelosandGitHub bb2f28a39e Update volatility3/cli/volshell/generic.py 2025-04-01 22:29:48 +01:00
ikelosandGitHub 377697cc43 Merge pull request #1622 from volatilityfoundation/feature/data-renderer 
Feature/data renderer
 2025-04-01 22:16:28 +01:00
ikelosandGitHub e91dfb2673 Merge pull request #1755 from volatilityfoundation/update_and_fix_bugs_check_afinfo 
Fix several bugs in check_afinfo. Update through latest kernels. Matc…
 2025-04-01 22:07:26 +01:00
ikelosandGitHub 2ca5fd5fe5 Update volatility3/framework/plugins/linux/check_afinfo.py 
Fix up ruff error.
 2025-04-01 11:22:55 +01:00
ikelosGitHubCopilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
 		9c58cfc2a8 Potential fix for code scanning alert no. 416: Implicit string concatenation in a list 
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
 2025-04-01 11:20:48 +01:00
ikelosandGitHub c0aea41168 Merge pull request #1750 from volatilityfoundation/import_checker 
Testing: Check + fix 'import from' statements
 2025-03-29 21:40:22 +00:00
ikelosandGitHub 61e743036c Merge pull request #1753 from volatilityfoundation/feature/use-less-memory-2 
Don't completely remove the chainmap, but change one dict to a namedm…
 2025-03-29 15:20:45 +00:00
ikelosandGitHub e1613d6ced Merge pull request #1752 from volatilityfoundation/revert-1736-feature/use-less-memory 
Revert "Feature/use less memory"
 2025-03-29 12:59:03 +00:00
ikelosandGitHub 07f7a2e2be Revert "Feature/use less memory" 2025-03-29 12:48:47 +00:00
ikelosandGitHub 2ff83404bc Merge pull request #1736 from volatilityfoundation/feature/use-less-memory 
Feature/use less memory
 2025-03-29 12:33:51 +00:00
ikelosandGitHub a79c58bcce Merge pull request #1743 from volatilityfoundation/requirement_checks_github_action 
Testing: Verify `VersionRequirement`s
 2025-03-28 22:30:44 +00:00
ikelosandGitHub eec87d2512 Merge pull request #1749 from eve-mem/volshell_fix_1714 
Volshell: handle case where paged out member would cause backtrace for dt output.
 2025-03-28 19:49:47 +00:00
ikelosandGitHub 49d0404031 Merge pull request #1747 from volatilityfoundation/issues/update-api-changes-log 
Update the various MINOR version bumps to the current version
 2025-03-28 16:37:40 +00:00
ikelosandGitHub f844f80d2a Update API_CHANGES.md 
Fix typo highlighted by @eve-mem
 2025-03-28 14:29:35 +00:00
ikelosandGitHub d77d69cffa Merge pull request #1746 from volatilityfoundation/fix_hidden_modules 
Fix hidden_modules to actually list hidden modules...
 2025-03-28 01:48:12 +00:00
ikelosandGitHub e8e8e76e79 Merge pull request #1740 from volatilityfoundation/lkm_extraction 
Add module extraction API. Add plugin to directly extract modules. Ho…
 2025-03-28 00:55:57 +00:00
ikelosandGitHub f33e9daa48 Merge pull request #1707 from volatilityfoundation/1471-registry-plugins-spread-across-directories-needs-standardization 
1471 registry plugins spread across directories needs standardization
 2025-03-27 16:36:58 +00:00
ikelosGitHubCopilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
 		70e101ff90 Potential fix for code scanning alert no. 407: First argument to super() is not enclosing class 
Think this is more correct

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
 2025-03-27 14:13:25 +00:00
ikelosandGitHub 8de46033d7 Merge pull request #1737 from Abyss-W4tcher/additional_windows_testing 
Windows: Additional testing
 2025-03-26 20:30:15 +00:00
ikelosandGitHub f74082ec36 Merge pull request #1742 from volatilityfoundation/1741-consoles-requirements 
Consoles: Fix requirement versions
 2025-03-26 14:50:15 +00:00
ikelosandGitHub 4fd0f20ff9 Merge pull request #1739 from volatilityfoundation/fix_thrdscan_checks 
Fix checks in thrdscan that broke tests
 2025-03-26 00:55:32 +00:00
ikelosandGitHub 2ebda44482 Merge pull request #1738 from volatilityfoundation/framework/missing_version_requirements 
Framework: Missing `VersionRequirement`s
 2025-03-25 23:16:25 +00:00
ikelosGitHubDonghyun Kim
 		f0b6b0405f Update CODING_STYLE.md 
Hehehe, good catch, thanks!  5:D

Co-authored-by: Donghyun Kim <digitalisx99@gmail.com>
 2025-03-25 17:27:31 +00:00
ikelosGitHubDonghyun Kim
 		5c2d646829 Update CODING_STYLE.md 
Co-authored-by: Donghyun Kim <digitalisx99@gmail.com>
 2025-03-25 17:27:06 +00:00
ikelosGitHubDonghyun Kim
 		d753e8ecb6 Update CODING_STYLE.md 
Thanks, my fingers don't work as well as they used to, so I appreciate you picking up typos like this!

Co-authored-by: Donghyun Kim <digitalisx99@gmail.com>
 2025-03-25 17:25:55 +00:00
ikelosandGitHub b881fa1fac Merge pull request #1731 from volatilityfoundation/process_ghosting_update_with_delete_on_close 
Add delete on close detection to process ghosting. Update plugin to c…
 2025-03-25 09:15:23 +00:00
ikelosandGitHub d0e32e593a Merge pull request #1735 from volatilityfoundation/issue_1732_pe_symbols 
Fix issue when pe_symbols limited to searching one process. Remove ne…
 2025-03-25 09:13:52 +00:00
ikelosandGitHub 4ac8599d17 Merge pull request #1730 from volatilityfoundation/threads_useful_columns 
Add win32 start address listing. Add paths for both thread starting a…
 2025-03-25 09:12:57 +00:00