Mike Auty
a90f16cb23
Merge branch 'release/v2.0.0' into develop
2021-01-20 21:56:13 +00:00
Mike Auty
5235f43416
Plugins: Fix list_files with suitable required version.
2021-01-20 21:55:32 +00:00
ikelos and GitHub
a92866bca0
Merge pull request #364 from volatilityfoundation/mac_lsmod_smear_proof
...
implement a smear proof mac lsmod
2021-01-19 22:57:30 +00:00
Andrew Case
f13f5e438d
Address comments
2021-01-19 14:27:24 -06:00
Jan
df89f1ceb9
adds symbols for win10 10586 x86
2021-01-14 19:49:49 +01:00
Mike Auty
2ebc1da155
Merge branch 'release/v2.0.0' into develop
2021-01-13 00:55:48 +00:00
Mike Auty
89a3d441ff
Layerwriter: Ensure we autochoose by default
2021-01-13 00:54:50 +00:00
iMHLv2 and Mike Auty
2a180c135e
refs #368 fix handles on 32-bit windows 8 and 10 - finding SAR is not necessary on these versions
2021-01-13 00:29:01 +00:00
ikelos and GitHub
1bfaf960ef
Merge pull request #421 from volatilityfoundation/issue_368_windows_handles_x86_win8
...
refs #368 fix handles on 32-bit windows 8 and 10 - finding SAR is not necessary on these platforms
2021-01-13 00:27:12 +00:00
ikelos and GitHub
f3b593696a
Merge pull request #419 from japhlange/netlist
...
netstat: fixes two off-by-one errors in port bitmap parsing
2021-01-10 16:30:02 +00:00
Jan
e92920f6e6
another off-by-one error when parsing bitmaps
2021-01-10 17:23:00 +01:00
Jan
63ba549bca
fixes off-by-one error in port bitmap parsing
2021-01-10 17:08:14 +01:00
ikelos and GitHub
782e59694a
Merge pull request #397 from japhlange/netlist
...
Netstat for x64 Windows
2021-01-07 10:09:37 +00:00
Jan
f0f5f1978d
renamed to more consistent plugin name
2021-01-07 11:00:58 +01:00
Mike Auty
bb5a63246e
Merge branch 'release/v2.0.0' into develop
2021-01-06 21:21:37 +00:00
ikelos and GitHub
1ea9a493a8
Merge pull request #415 from volatilityfoundation/windows_info_add_Is64Bits_and_IsPAE
...
add Is64Bit and IsPAE properties to the windows.info plugin
2021-01-06 21:10:26 +00:00
Mike Auty
8de5991812
Timerliner: Improve timeliner caching
...
This duplicates config values if the requirement are identical, which
speeds up the automagic considerably. Note that this means even the
requirement descriptions must match, but for safey that probably makes
sense.
2021-01-06 21:08:26 +00:00
iMHLv2
d7d176d040
add Is64Bit and IsPAE properties to the windows.info plugin
2021-01-06 11:36:56 -06:00
iMHLv2
2c3b6668d5
refs #368 fix handles on 32-bit windows 8 and 10 - finding SAR is not necessary on these versions
2021-01-06 10:10:51 -06:00
Mike Auty
f75e77997d
Layerwriter: Remove erroneous debugging statements
2021-01-03 10:38:49 +00:00
Jan
71e48cc672
complex objects are not passed as arguments directly anymore, but rather by offset
2020-12-28 21:51:28 +01:00
Jan
f731ceba3a
optimizations as raised by #397
2020-12-28 21:22:50 +01:00
Mike Auty
1c2a9921ff
Windows: Partial fix for #368 error messages
2020-12-27 15:21:18 +00:00
Jan
2e70a9cb45
addresses issues raised in pr #399
2020-12-22 17:11:55 +01:00
Jan
bcc79d4cb9
better documentation and support for more x64 Windows versions
2020-12-19 17:13:53 +01:00
Mike Auty
d63aef566f
Codebase: Yapf the codebase again
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
747fe8609f
update copywrite to 2020
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
17e629a4c4
converted process_file_object into a classmethod
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
d98337cc09
added debug statements to dump_file_producer when none is returned
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
4f37a28185
dump_file_producer is now a classmethod and returns a FileInterface Object
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
49acf44302
dumpfiles.py is now consistent with master and runs correctly
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
8e1a599203
changed PluginRequirement to VersionRequirement
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
442f877e9a
refs #197 initial commit of windows.dumpfiles
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
20f4fbf157
add --virtaddr and --physaddr options so users can supply virtual or physical addresses (or both)
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
3ac89577cc
refs #197 initial commit of windows.dumpfiles
2020-12-10 15:37:40 +00:00
Jan
972d3d7076
netlist for 16299 and 17134
2020-12-08 20:04:03 +01:00
Jan and ikelos
3dea2b4187
adds os_distinguisher for 18363
2020-12-08 10:34:07 +00:00
Jan and ikelos
b3ffddcff0
fixes wrong offset in 18363 x64
2020-12-08 10:34:07 +00:00
Jan and ikelos
774528206c
adds new vol3 netscan profiles and fixes rare bug
2020-12-08 10:34:07 +00:00
cecio and ikelos
c9c37a9b35
OS check reworked as suggested by @iMHLv2 and @ikelos
2020-12-02 14:23:12 +00:00
cecio and ikelos
1cf625fc89
fix: the bounce from physical to virtual process is required only for OS < Win10.
...
Added the check in the "dump" option
2020-12-02 14:23:12 +00:00
AsafEitani and ikelos
4ec006e606
Fix 'maxsize variable doing nothing' bug
...
In one of the earlier commits the varible was erased from being passed to vaddump - that corrects it.
2020-11-18 19:56:30 +00:00
Mike Auty
30de81795c
Windows: Update requirements to pslist 2.0.0
2020-11-16 09:41:42 +00:00
Mike Auty
4a8b4d1706
Plugins: Bump remaining plugins to framework require 2.0.0
2020-11-15 16:53:03 +00:00
Mike Auty
49aeaf2a49
Plugins: Resolve remaining LGTM recommendations
2020-11-09 00:03:07 +00:00
Mike Auty
0a655d76a8
Core: Fix LGTM recommendations
...
This is mostly unused imports and unused variables.
2020-11-04 22:41:39 +00:00
Mike Auty
7c75018fc4
Core: Fix Warnings from LGTM
2020-11-04 21:02:36 +00:00
Mike Auty
a9c742b3a2
Codebase: Fix == None (from lgtm audit)
2020-11-04 14:32:42 +00:00
Mike Auty
1d8081e409
Plugins: Fix exception thrown in handles
...
Fixes #368
2020-11-01 14:50:48 +00:00
Mike Auty
47ff37b07b
Plugins: Make layerwiter more configurable
...
This adds support for dumping multiple layers at once, listing available
layers and selects the highest non-mapped layer. Mapping is specified
in the metadata and currently is only applied to intel layers.
2020-10-31 23:30:22 +00:00
Mike Auty