WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-31 12:19:42 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,832 Commits 80 Branches 17 Tags
241cf832f9b3676fbcf4e724c646dbfe46c24eb2
Commit Graph
3832 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Gustavo Moreira 241cf832f9 Plugin parameters removed. Instead, it now shows each capability set in their textual representation. The dictionary was replaced by a dataclass. 
Last but not leas, CAP_FULL moved to constants.
 2023-07-10 00:07:40 +02:00
Gustavo Moreira f0bd978716 Fix typo 2023-05-20 12:17:09 +02:00
Gustavo Moreira 4f5ca6116c Add black recommendations 2023-05-17 16:07:56 +01:00
Gustavo Moreira d5d318d3cf Fix wrong constants module 2023-05-17 15:26:24 +01:00
Gustavo Moreira 3d9efc3b34 Added linux capabilities plugin 2023-05-17 14:14:33 +01:00
Mike Auty 8e56cb39d1 Docs: Fix the documentation dependencies 2023-05-10 22:07:38 +01:00
Mike Auty 3f1797f7e5 Core: Change readthedocs build platform 
Fixes #953
 2023-05-10 21:57:59 +01:00
Mike Auty e28b42731e Core: Change readthedocs python version 
Attempting to fix #953
 2023-05-10 21:55:23 +01:00
ikelosandGitHub 2149231bb7 Merge pull request #949 from cpuu/mac-tutorial 
Add tutorial for macOS Analysis
 2023-05-10 11:11:21 +01:00
ikelosandGitHub 534f9be127 Merge pull request #928 from eve-mem/linux_maple_tree 
Add basic support for Linux maple tree struct
 2023-05-10 11:06:44 +01:00
ikelosandGitHub e4db77d20a Merge pull request #942 from gcmoreira/mountinfo_fixes 
Mountinfo fixes
 2023-05-10 11:03:32 +01:00
Gustavo Moreira 7516346b64 Adjust framework versioning 2023-05-10 10:55:19 +02:00
Eve b3c348820f Linux: apply black v23.3.0 formating to volatility3/framework/symbols/linux/__init__.py 2023-05-10 09:18:05 +01:00
Eve 834372a6f8 Linux: apply black v23.3.0 formating to volatility3/framework/symbols/linux/extensions/__init__.py 2023-05-10 09:12:03 +01:00
Eve 7f9afccf6f Linux: apply black formating to maple tree parsing 2023-05-10 08:49:46 +01:00
Gustavo Moreira 89ed65cc56 Improve filter warning implementation 2023-05-09 09:59:21 +02:00
Gustavo Moreira 6c5db21ae7 Undo mnt_ns_id cast to str 2023-05-09 09:22:02 +02:00
Gustavo Moreira d367b973a5 Renamed get_vmlinux_from_volobj() to get_module_from_volobj_type() 2023-05-09 09:05:37 +02:00
Eve a2906ad270 Linux: Update comments and var names for maple tree depth warnings 2023-05-09 07:07:39 +01:00
Eve 8594824459 Linux: Ensure that objects made when parsing maple tree use the native_layer_name 2023-05-09 06:47:07 +01:00
Gustavo Moreira de28b5ab70 Rollback explicit context 2023-05-08 19:59:53 +02:00
Gustavo Moreira 7d65c20cc0 Fix f-string 2023-05-08 14:59:58 +02:00
Gustavo Moreira 200099f8b3 Improve support for socket filters in kernels < 4.1.52 2023-05-08 14:58:51 +02:00
Gustavo Moreira ced6ff346c Apply 'Black' suggestions 2023-05-08 11:54:48 +02:00
cpuuandGitHub 6b2ae6bd65 Update getting-started-mac-tutorial.rst 2023-05-08 17:44:17 +09:00
cpuuandGitHub e86ff963e2 Update getting-started-mac-tutorial.rst 2023-05-08 17:43:24 +09:00
cpuuandGitHub ea09c47328 Update getting-started-mac-tutorial.rst 2023-05-08 17:32:14 +09:00
ikelosandGitHub 778df1a550 Merge pull request #948 from paulkermann/feature/modules_name_flag 
Added modules name flag
 2023-05-08 08:47:05 +01:00
Paul Kermann c40b3a043f CR fixes 2023-05-08 05:07:19 +03:00
Gustavo Moreira a09f77897b sockstat improvements: 
+ Fixes issues with netlink sockets for older kernels, supporting now kernels < 3.7.10
+ Fixes issue with network namespace id for older kernels.
 2023-05-06 14:21:58 +02:00
Gustavo Moreira 2d922a8cd6 Improves the way the mount points and the namespaces are filtered. 
Previously, it was filtering by mount namespaces id. Even that approach was working as expected, it's not viable for older kernels were there was not a mount namespace ID. With this changes we filtered the mount points individually by the mount ID which is unique system wide, no mather the namespace to which it belongs to.
 2023-05-06 14:18:33 +02:00
Gustavo Moreira 7063e60944 mountinfo improvements: 
+ Fixes issue with repeated path suffixes.
+ Adds support for older kernels (<3.3.8) and
+ Adds a function which simplify the way the framework internally can gets a context and a vmlinux.
This is obtaining the context and symbol space from the same vol object instead of drag a context everywhere.
This changes also affects other plugins such as elfs, malfind and proc.maps.
It also adds doc strings to some of the existent functions.
 2023-05-06 14:12:09 +02:00
cpuu 093fc9ab79 Add tutorial for macOS Analysis 
Add tutorial for macOS Analysis
 2023-05-05 23:39:33 +09:00
Paul Kermann 8952c6c985 formatting 2023-05-04 15:18:37 +03:00
Paul Kermann 9249758dde formatting 2023-05-04 15:15:23 +03:00
Paul Kermann 1ad8c950da Added modules name flag 2023-05-04 13:47:57 +03:00
ikelosandGitHub 8788390424 Merge pull request #947 from cpuu/bug-fix 
Bug fix (2.4.2 / URIRequirement)
 2023-05-04 10:00:44 +01:00
cpuuandGitHub c9e0b6695f Update index.rst 2023-05-04 12:52:16 +09:00
cpuuandGitHub 14f449367d Delete getting-started-macos-tutorial.rst 2023-05-04 12:52:00 +09:00
cpuuandGitHub 159e5a2fbd Fix requirements.URLRequirement to requirements.URIRequirement 
[Refactor] Fix requirements.URLRequirement to requirements.URIRequirement in single_location assignment
 2023-05-04 11:59:30 +09:00
cpuuandGitHub da6f2cf850 Merge branch 'volatilityfoundation:develop' into develop 2023-05-04 10:56:34 +09:00
ikelosandGitHub b6af37af2d Merge pull request #938 from volatilityfoundation/issues/issue937 
Improve handling of swap files
 2023-05-03 00:45:50 +01:00
ikelosandGitHub 73cd54cf8a Merge pull request #945 from digitalisx/fix/code-comment 
Add: help comment for windows plugins (`windows.crashinfo`, `windows.ldrmodules`, `windows.statistics`).
 2023-05-03 00:45:23 +01:00
Donghyun Kim c06836e45d Lint: black issue for windows.ldrmodules 2023-05-02 05:58:57 +09:00
Donghyun Kim 79cd3fe2fe Lint: black issue for windows.statistics 2023-05-02 05:57:56 +09:00
Donghyun Kim 77081d3f68 Add: code comment for plugins 2023-05-02 05:51:24 +09:00
Mike Auty 317f565685 Core: Renable the import protection for volatility3.framework.plugins 
In commit 21d916b (about 10 months ago) the logic for the warning about
volatility3.framework importing was disabled.  This re-enables it.

Also updates to support pyinstaller 5.10 function stack depth.

Closes #944
 2023-04-30 09:02:40 +01:00
Gustavo Moreira b2d33c2cb0 Check if 'mnt_namespace' has the 'ns' member before using it 2023-04-26 00:36:58 +10:00
Gustavo Moreira 33f54f8cf7 Replace LinuxUtilities._do_get_path() with the new mountinfo _do_get_path() avoiding duplicate code. It also fixes issue #930 2023-04-26 00:33:35 +10:00
Mike Auty a5e6c550e3 Automagic: Handle file swap locations and throw a warning if they don't exist 2023-04-16 13:30:55 +01:00