WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 05:07:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,025 Commits 80 Branches 17 Tags
263c87611b51f1cb9710c2ec71d1f41eb98e9c77
Commit Graph
5025 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
David McDonald 263c87611b Windows Registry: Handle exceptions in read calls 
These calls to `.read()` can raise an `InvalidAddressException`. Instead
of propagating this exception to the caller, this adds debug logging,
and pads the data will null bytes.

Also updates the docstring for `decode_data()` to indicate that it can
raise `TypeError` and `ValueError`.
 2024-12-31 10:43:27 -06:00
David McDonald f3294ef5f1 Windows Registry: Handle possible exception in get_node 
Encountered a `SwappedInvalidAddressException` within the call to `cast`
due to an underlying call to `read`.
 2024-12-30 14:29:20 -06:00
David McDonald 3eeb10be29 Windows Registry: Handle uncaught exceptions 
A number of calls to `get_key` across multiple plugins are not made
within a `try/except` block that handles
`registry.RegistryFormatException` - the calls are either unprotected or
only check for `KeyError`. This adds the required `try/except` blocks,
or updates the existing ones as needed.
 2024-12-30 14:29:20 -06:00
David McDonald e9d9345cef Windows Cachedump: Handle uncaught InvalidAddressException 2024-12-30 09:37:40 -06:00
ikelosandGitHub 3211fc1e6c Merge pull request #1495 from j-t-1/rsplit 
Use rsplit instead of split
 2024-12-30 12:24:40 +00:00
j-t-1andGitHub 28ff910d62 Use rsplit instead of split 
Since we want to split rightmost only.
 2024-12-30 10:58:38 +00:00
ikelosandGitHub eccaa5758c Merge pull request #1494 from j-t-1/enumerate 
Use enumerate for readability
 2024-12-30 00:27:27 +00:00
ikelosandGitHub cea6f109d7 Merge pull request #1464 from volatilityfoundation/windows_suspended_threads 
Add the suspended threads plugin from DEF CON 2024
 2024-12-30 00:26:21 +00:00
ikelosandGitHub cbd03d2c94 Merge pull request #1492 from volatilityfoundation/netstat_bug_fixes 
Significantly improve the smear/error handling in the netstat plugin
 2024-12-30 00:22:25 +00:00
ikelosandGitHub dddfffa17a Merge pull request #1491 from volatilityfoundation/issue_1470_vads 
Do not analyze processes without VADs #1470
 2024-12-30 00:12:04 +00:00
ikelosandGitHub d7338cfe11 Merge pull request #1486 from j-t-1/space 
Remove superfluous spaces in intermed.py
 2024-12-30 00:07:01 +00:00
ikelosandGitHub 3507384e8c Merge pull request #1489 from volatilityfoundation/issue_1483_driver_smear 
Prevent infinite loops in device enumeration extensions #1483
 2024-12-30 00:06:10 +00:00
ikelosandGitHub 74b4d18d5f Merge pull request #1485 from j-t-1/extensions 
Make ETHREAD year check dynamic
 2024-12-30 00:02:47 +00:00
j-t-1andGitHub 52a643d5b7 Use enumerate for readability 2024-12-29 20:29:03 +00:00
Andrew Case 65f602965b Address feedback 2024-12-29 02:47:48 +00:00
Andrew Case 61d6a92f8f Significantly improve the smear/error handling in the netstat plugin 2024-12-29 02:25:17 +00:00
Andrew Case 33855cf920 Significantly improve the smear/error handling in the netstat plugin 2024-12-29 02:20:02 +00:00
Andrew Case e64af61efa Do not analyze processes without VADs #1470 2024-12-29 02:13:18 +00:00
Andrew Case bf7f1ca91e Prevent infinite loops in device enumeration extensions #1483 2024-12-28 22:43:56 +00:00
Andrew Case 1bd031b9a8 Prevent infinite loops in device enumeration extensions #1483 2024-12-28 22:42:25 +00:00
j-t-1andGitHub 37873f9e15 Remove superfluous spaces in intermed.py 2024-12-28 16:58:24 +00:00
j-t-1andGitHub 834b7d0f07 Make ETHREAD year check dynamic 
Change upper bound year check of ETHREAD to be a decade from now. Makes consistent with EPROCESS.
 2024-12-28 14:58:12 +00:00
ikelosandGitHub b1a42d9510 Merge pull request #1467 from j-t-1/BasicTypes 
Use BasicTypes variable
 2024-12-26 22:11:45 +00:00
j-t-1andGitHub 4c430d2ec4 Use BasicTypes variable 
This removes a "float", which should be excluded.
 2024-12-26 07:27:45 +00:00
ikelosandGitHub a07c5d3063 Merge pull request #1354 from Abyss-W4tcher/fbdev_plugin 
New Linux plugin: fbdev graphics API
 2024-12-25 19:21:38 +00:00
ikelosandGitHub 93b09fd974 Merge pull request #1466 from j-t-1/configuration 
Tweak configuration.py
 2024-12-25 19:17:26 +00:00
j-t-1andGitHub 79fe1c50df Tweak configuration.py 
Create a tuple directly and replace random.choice by random.choices.
 2024-12-24 19:42:05 +00:00
Abyss Watcher ea2757c06c minor version bump 2024-12-24 11:45:23 +01:00
Abyss Watcher 0bb09191aa file output failure results in UnreadableValue 2024-12-23 21:28:58 +01:00
ikelosandGitHub 1f91fd4d69 Merge pull request #1460 from volatilityfoundation/issues/issue1436 
Generic: Fix up potential issue with isfinfo
 2024-12-23 17:05:47 +00:00
ikelosandGitHub b630cfaeec Merge pull request #1462 from volatilityfoundation/issues/issue1442 
Layers: Fix vmware layer without a suitable meta
 2024-12-23 17:05:11 +00:00
ikelosandGitHub 9b27f5eeca Merge pull request #1461 from volatilityfoundation/issues/issue1441 
Layers: Fix MSF page len on a possibly uninitialized variable
 2024-12-23 17:03:28 +00:00
ikelosandGitHub 8e851c44f9 Merge pull request #1454 from j-t-1/simple 
Reformat how to write a simple plugin
 2024-12-23 16:43:55 +00:00
j-t-1andGitHub df37f0a909 Reformat how to write a simple plugin 2024-12-23 15:34:17 +00:00
j-t-1andGitHub 9d4dd010a7 Reformat how to write a simple plugin 2024-12-23 15:28:40 +00:00
Abyss Watcher 8d213284e6 handle NotAvailableValue in filename 2024-12-22 14:23:04 +01:00
Abyss Watcher 1fef570022 restrict output to PNG, unify file handling 2024-12-22 14:15:45 +01:00
Abyss Watcher 7caf8c572a PIL import graceful exit 2024-12-22 14:03:26 +01:00
ikelosandGitHub e7e4d76d95 Merge pull request #1463 from j-t-1/svclist 
Add a required framework version
 2024-12-21 23:28:02 +00:00
Mike Auty ea273fe878 Volshell: Fix up shuffled imports 2024-12-21 23:23:37 +00:00
ikelosandGitHub 2bebc00ba4 Merge pull request #1390 from j-t-1/Volshell 
Remove redundant part of if statement
 2024-12-21 23:20:01 +00:00
j-t-1andGitHub b9fa217d79 Add a required framework version 
Added _required_framework_version and set it to the same value (2, 0, 0) as its plugin requirement of svcscan. Also tweaked one comment.
 2024-12-21 18:48:12 +00:00
Andrew Case d31ac276ed Add the suspended threads plugin from DEF CON 2024 2024-12-21 12:22:33 -06:00
Andrew Case a84d361113 Add the suspended threads plugin from DEF CON 2024 2024-12-21 12:18:23 -06:00
Abyss Watcher f6a54c5c48 ruff fix 2024-12-21 13:31:29 +01:00
Abyss-W4tcherandGitHub 335bdba36c Merge branch 'develop' into fbdev_plugin 2024-12-21 13:26:23 +01:00
Abyss Watcher 88eb2aa886 switch pillow to pyproject.toml 2024-12-21 13:22:04 +01:00
j-t-1andGitHub 104cf0f6a1 Merge branch 'volatilityfoundation:develop' into Volshell 2024-12-21 06:16:28 +00:00
j-t-1andGitHub bed03dfbc7 Refactor check of BasicType 
The intention is either a BasicType or a list where each element is only a BasicType (and not a list).
 2024-12-21 06:15:35 +00:00
j-t-1andGitHub cc8fbd5b68 Tweak a comment 2024-12-20 17:34:52 +00:00