WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-07 02:07:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,344 Commits 80 Branches 17 Tags
288a017178a163d1efc93daecc5a570e052d4b90
Commit Graph
367 Commits
Author SHA1 Message Date
Mike Auty 288a017178 CLI: fix up the previous broken commit 2020-08-22 11:55:23 +01:00
Mike Auty 8e420cbe62 Core: Multiple typing fixes across the tree 2020-08-16 22:22:24 +01:00
Mike Auty 03d69204f3 Documentation: Add in using volatility as a library 2020-08-10 22:17:40 +01:00
Mike Auty 556c880c90 Codebase: Ensure all conversions to bytes handle unicode 
All conversions using `latin-1` have been converted to
`raw_unicode_escape` which is like `latin-1`, but handles unicode
characters appropriately (with a `\u` prefix).

Since this is like `latin-1` it should have no impact on things that ran
previously, but those that would fail with a unicode error now will
present an encoded unicode string.  There may be situations where the
binary representation of unicode would be better (timeliner file
output?), but those can be changed when/if it's determined necessary.

Fixes #274.
 2020-08-03 16:53:48 +01:00
Mike Auty ff32383f82 Yapf: Minor reformats for recent plugins 2020-08-03 16:33:10 +01:00
mtresslerandikelos 2e6dc851d3 removed extra whitespace 2020-08-03 16:30:09 +01:00
Matt Tresslerandikelos 0452f69f82 created keyboard_notifiers 2020-08-03 16:30:09 +01:00
Mike Auty f5f9ee7292 Linux: Fix plugin case and re-run yapf 2020-07-31 00:28:21 +01:00
Matt Tresslerandikelos 34ff856a79 Updated imports to reflect new location of utility class; plugins are no longer outputing anything so commiting for Andrew to take a look at 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos 355c25fefb added parameter type to generate_kernel_handler_info 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos ddec0d482d added kernel string to linux constants file; changed automagic methods so that they reconstruct the kernel object within the method for consistancy with other methods 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos b9f5450ac3 added docs to automagic methods, fixed missing return types, changed parameters to be more specific 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos 44911bf54a Fixed tty_check not finding the ttyhook module 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos ec8e9161bf created tty_check.py; edited automagic/linux.py to add kernel tracking abilities 2020-07-30 23:24:23 +01:00
Andrew Case dec13f5082 Linux - stash the Linux kernel virtual address 2020-07-28 13:16:40 -05:00
Andrew Caseandikelos 75d4390255 Remove extra debug prints 2020-07-28 17:00:20 +01:00
Mike Auty 8481406488 Linux: Support stashing the KASLR 2020-07-28 17:00:20 +01:00
Mike Auty a4b50d183d Mac: Stash the verified ASLR shift and improve logging 2020-07-28 17:00:20 +01:00
Andrew Caseandikelos f6a1b28424 First attempt and better DTB and ASLR validation. Debugging statements left in. 2020-07-28 17:00:20 +01:00
Mike Auty a980374eb8 Automagic: Fix issue in recent refactor 2020-07-28 11:15:16 +01:00
Mike Auty 61563350b3 Linux/Mac: Refactor *nix Utilities classes 2020-07-28 11:15:16 +01:00
Mike Auty 79d44edd37 Automagic: Don't hide errors from manual stacker setting 2020-07-16 11:17:29 +01:00
Mike Auty 4cccbc2f69 Automagic: Fix os_chooser method 
Two issues found:
* the plugin hierarchy always start volatility.plugins, so we need
to go to index 2.
* the layers weren't loaded at the time the stacker list was generated
so all other stackers failed.
 2020-07-02 19:33:32 +01:00
Mike Auty 55dd1c6c2c Automagic: Fix bad default parameter 2020-07-02 19:33:32 +01:00
Mike Auty 16c2ddb837 Automagic: Change stackers to including an exclusion list 2020-07-02 19:33:32 +01:00
Mike Auty 33d1c696e5 Automagic: Allow stackers to be configurable 2020-07-02 19:33:32 +01:00
Mike Auty 944bf2174f Automagic: Split out the stacker code 2020-07-01 20:30:31 +01:00
Mike Auty cf988944b9 Linux: Correct the ASLR for pre-masking (KASLR is still incorrect) 2020-06-23 16:56:40 +01:00
Hanno Heinrichsandikelos deb2b78312 Clear symbol cache after ASLR computation on Linux. 2020-06-23 16:45:22 +01:00
Hanno Heinrichsandikelos 30226d2bdd Fix find_aslr() function invocation for Linux. 2020-06-23 16:10:05 +01:00
Mike Auty ede5ba07aa Symbols: Apply symbol_masking option to IntermediateSymbolTables 2020-06-10 19:39:20 +01:00
Mike Auty 085ccc47e0 SymbolTableRequirement: Do a merry dance around ASLR shifts in automagic 2020-06-10 19:39:20 +01:00
Mike Auty 573590878a SymbolTable: Rework symbol_shift so it's part of the config 2020-06-10 19:39:20 +01:00
Mike Auty a6cd344e22 Automagic: Refactor ASLR finding for all symbol_finder using OSes 2020-06-10 19:39:20 +01:00
Mike Auty 863b9915c9 Automagic: Refactor mac aslr_finding 2020-06-10 19:39:20 +01:00
Mike Auty 204657648a Linux: Narrow in on a particular symbol table 2020-06-10 19:39:20 +01:00
Mike Auty 2748ce32d8 Initial attempts at cloning a symbol table 2020-06-10 19:39:20 +01:00
Mike Auty 94426ad313 Automagic: Ensure all layers can be reconstructed 2020-05-10 19:30:58 +01:00
Mike Auty 0c43beb42d Core: Apply yapf across all files again. 2020-05-05 22:14:33 +01:00
Mike Auty 4587de356d Fix issue with cleaning the symbol cache 2020-05-02 01:16:06 +01:00
Mike Auty 8935e4dd19 Fix up linuxutils to use symbol_tables rather than hard coded values 2020-04-10 22:12:03 +01:00
Andrew Caseandikelos b42dfd614a Add API for mapping kernel addresses to kernel symbols or a specific kext 2020-04-08 18:17:34 +01:00
Andrew Caseandikelos 7d6d74bc91 Update order of arguments 2020-03-12 19:47:15 +00:00
Andrew Caseandikelos 722700d2dc Add docstrings 2020-03-12 19:47:15 +00:00
Andrew Caseandikelos 7b21e83b07 Mac - convert socket gathering to class method and clean up associated code 2020-03-12 19:47:15 +00:00
Mike Auty 77be83edc4 Layers: Change mapping signature to return domain length 2020-03-04 20:29:42 +00:00
Mike Auty a2ac55ba0b Wintel: Reorder the DTB tests 
Reorder the DTB tests, since 64-bits have more to match and are likely
more common these days.  We've had an instance where a 32-bit DTB was
detected because of a self-referential pointer over a 64-bit DTB leading
to an inaccessible image.

This fixes issue #193.
 2020-03-04 20:28:52 +00:00
Mike Auty 920b85743b Revert "Automagic: Add excessive debugging to symbol cache" 
This reverts commit db8ba4029c.
 2020-01-30 01:58:07 +00:00
Mike Auty db8ba4029c Automagic: Add excessive debugging to symbol cache 2020-01-30 01:34:30 +00:00
Mike Auty d36545d4c0 Automagic: Fix mac typing signature issues 2019-11-27 11:30:14 +00:00