 Andrew Case
|
2d2228b06e
|
Fix signature
|
2025-03-15 21:25:39 +00:00 |
|
|
Andrew Case
|
fbb4003a32
|
Fix broken truncation from Vol3 bytes to string conversion
|
2025-03-15 20:59:14 +00:00 |
|
|
ikelosandGitHub
|
5bd7a4f4c2
|
Merge pull request #1710 from volatilityfoundation/update_deprecated_api_usage
Update nearly all callers of now deprecated Linux kernel APIs
|
2025-03-15 20:44:08 +00:00 |
|
|
Andrew Case
|
458e8eb692
|
retrigger checks
|
2025-03-15 20:41:09 +00:00 |
|
|
Andrew Case
|
f73717a39d
|
retrigger checks
|
2025-03-15 20:36:34 +00:00 |
|
|
Mike Auty
|
9550db82a9
|
Bump the ruff action
|
2025-03-15 20:31:01 +00:00 |
|
|
Andrew Case
|
9da147df1b
|
simplify check
|
2025-03-15 19:10:00 +00:00 |
|
|
Andrew Case
|
e79f03691a
|
Add name to interface and validate it in processing loop
|
2025-03-15 19:01:52 +00:00 |
|
|
|
0f5dd10aa9
|
Apply suggestions from code review
Co-authored-by: ikelos <ikelos@users.noreply.github.com>
|
2025-03-15 13:23:01 -05:00 |
|
|
Andrew Case
|
674cc045d2
|
Update to using str dictionary key. Add requirements for each gatherer in modxview. Validate names are unique while sanity checking.
|
2025-03-15 17:22:31 +00:00 |
|
|
Andrew Case
|
53e32e36f6
|
Add versioning on gatherers, make check non-specific to kernel gatherer, add requirements to ModuleGatherers
|
2025-03-14 22:34:06 +00:00 |
|
|
ikelosandGitHub
|
023fdfd293
|
Merge pull request #1708 from volatilityfoundation/fix_windows_strings
Properly reconstruct strings from memory buffers and allow for plugin…
|
2025-03-14 21:53:01 +00:00 |
|
|
Andrew Case
|
b2ec21fcf2
|
Simplify last_address handling
|
2025-03-14 21:15:03 +00:00 |
|
|
Andrew Case
|
a0f3cba6f6
|
Fix stale comments
|
2025-03-14 21:08:15 +00:00 |
|
|
Andrew Case
|
bb0a17004f
|
Add return_truncated for plugin-specified handling of truncated strings
|
2025-03-14 20:59:15 +00:00 |
|
|
Andrew Case
|
f38ddaf715
|
Fix string scanning code
|
2025-03-14 20:53:02 +00:00 |
|
|
Andrew Case
|
f5ae7928a3
|
Black fix
|
2025-03-14 20:45:14 +00:00 |
|
|
Andrew Case
|
2e93b8ed09
|
Prevent CodeQL from losing its mind. Properly checking for instances of the interface
|
2025-03-14 20:43:12 +00:00 |
|
|
Andrew Case
|
cf8bb3dfbc
|
Adjust run_modules_scanners to avoid special handling of hidden modules, adjust modxview to new API, add classes and version requirements on module gathering interface
|
2025-03-14 20:27:25 +00:00 |
|
|
ikelosandGitHub
|
e0ff0018a6
|
Merge pull request #1709 from volatilityfoundation/feature/ipython
Feature: Add support for IPython in volshell
|
2025-03-14 19:32:45 +00:00 |
|
|
David McDonald
|
196bf8187d
|
Volshell: Address comments from code review
- Add failure message when readline or rlcompleter can't be imported
- Fix unclosed file handle in context manager
|
2025-03-14 12:22:15 -05:00 |
|
|
Andrew Case
|
4225adce56
|
Convert to .mapping and let Python had all encodings
|
2025-03-14 16:32:54 +00:00 |
|
|
Andrew Case
|
36b3c28859
|
Update encodings
|
2025-03-14 03:12:06 +00:00 |
|
|
Andrew Case
|
7ab62365fb
|
Vastly improve string reading while keeping intended behaviour
|
2025-03-14 03:05:11 +00:00 |
|
|
Andrew Case
|
4606495ded
|
Bump dep versions
|
2025-03-14 02:09:08 +00:00 |
|
|
Andrew Case
|
c318e7c326
|
Make configurable to sources
|
2025-03-14 01:52:16 +00:00 |
|
|
ikelosandGitHub
|
d82200f9f7
|
Merge pull request #1711 from volatilityfoundation/fix_bad_symbol_parsing
Update symbol splitting to handle symbols without attached module name
|
2025-03-13 23:11:13 +00:00 |
|
|
Andrew Case
|
39d39292f0
|
Update symbol splitting to handle symbols without attached module name
|
2025-03-13 22:55:47 +00:00 |
|
|
Andrew Case
|
d76288f994
|
Update nearly all callers of now deprecated Linux kernel APIs
|
2025-03-13 22:53:51 +00:00 |
|
|
David McDonald
|
c3123e8839
|
Volshell: Handle script running in ipython shell
|
2025-03-13 17:17:17 -05:00 |
|
|
David McDonald
|
fa2a93ade4
|
Volshell: Fix import logic around readline + rlcomplete
|
2025-03-13 17:09:56 -05:00 |
|
|
David McDonald
|
6f9f5c34b9
|
Feature: Add support for IPython in volshell
|
2025-03-13 16:37:31 -05:00 |
|
|
Andrew Case
|
48a5736a57
|
Properly reconstruct strings from memory buffers and allow for plugin-specified encodings
|
2025-03-13 21:09:38 +00:00 |
|
|
ikelosandGitHub
|
e2d48b8018
|
Merge pull request #1701 from volatilityfoundation/1476-all-calls-to-get_name-on-registry-keys-need-auditing
1476 all calls to get name on registry keys need auditing
|
2025-03-11 22:53:13 +00:00 |
|
|
Dave Lassalle
|
95aee9a664
|
#1476 - introduce RegistryException for simpler exception handling
|
2025-03-11 16:04:06 -05:00 |
|
|
ikelosandGitHub
|
aff84858ca
|
Merge pull request #1706 from volatilityfoundation/1446-pstreepy-has-broken-types-and-pid-handling
#1446 - pid is objects.Pointer, not int
|
2025-03-11 20:49:40 +00:00 |
|
|
Dave Lassalle
|
d9c9e11127
|
#1446 - uses ints instead of objects.Pointer
|
2025-03-11 13:41:01 -05:00 |
|
|
ikelosandGitHub
|
27142bec4c
|
Merge pull request #1702 from volatilityfoundation/1645-change-registry-processing-to-not-walk-the-process-list-in-the-registry-layer
#1645 - duplicate list_processes code
|
2025-03-11 16:30:24 +00:00 |
|
|
Dave Lassalle
|
7f7295cdb7
|
#1476 - remove unfinished prefetch plugin
|
2025-03-11 09:52:24 -05:00 |
|
|
Dave Lassalle
|
d32f3e76d4
|
#1645 - remove quoutes around type
|
2025-03-11 09:47:47 -05:00 |
|
|
|
ac74de694a
|
Update volatility3/framework/layers/registry.py
Co-authored-by: ikelos <ikelos@users.noreply.github.com>
|
2025-03-11 09:46:10 -05:00 |
|
|
Dave Lassalle
|
d148d8f9d8
|
#1446 - black fixes
|
2025-03-11 09:31:54 -05:00 |
|
|
Dave Lassalle
|
cbab1d1f49
|
#1446 - pid is objects.Pointer, not int
|
2025-03-11 09:30:38 -05:00 |
|
|
ikelosandGitHub
|
1639ae2396
|
Merge pull request #1704 from volatilityfoundation/remove_module_creation_at_offset_zero
No longer allocate session modules in support of the GUI objects at o…
|
2025-03-10 23:30:36 +00:00 |
|
|
ikelosandGitHub
|
398578aff6
|
Merge pull request #1703 from volatilityfoundation/update_gui_pool_types
Allow desktops and window stations to come from the paged or non-page…
|
2025-03-10 22:39:56 +00:00 |
|
|
Andrew Case
|
740ce520d6
|
retrigger checks
|
2025-03-10 22:13:09 +00:00 |
|
|
Andrew Case
|
c1b4866ba7
|
retrigger checks
|
2025-03-10 21:36:54 +00:00 |
|
|
Andrew Case
|
f17907200d
|
No longer allocate session modules in support of the GUI objects at offset 0. Instantiate objects at the absolute address explicility.
|
2025-03-10 21:26:58 +00:00 |
|
|
Andrew Case
|
7d5d379144
|
Allow desktops and window stations to come from the paged or non-paged pool
|
2025-03-10 21:24:55 +00:00 |
|
|
Dave Lassalle
|
4b74de4104
|
#1645 - duplicate list_processes code
|
2025-03-10 15:32:13 -05:00 |
|