Mike Auty
2d3cceda46
ResourceAccessor: Warn and retry without validation on certificate failure
2019-11-20 20:04:14 +00:00
Mike Auty
cb41c5e960
Pdbconv: Switch pdb downloading to resource accessing
2019-11-20 20:04:14 +00:00
Mike Auty
9334add1fc
ResourceAccessor: Fix downloading progress indicator.
2019-11-20 20:04:14 +00:00
Mike Auty
22fd48516e
ResourceAccessor: Improve typing information
2019-11-20 20:04:14 +00:00
Mike Auty
d7b996ff85
ResourceAccessor: Only list the handlers once.
2019-11-20 20:04:14 +00:00
Mike Auty
249c3ec223
Svcscan: Ensure or later checks are done in order.
...
Relates to issue 139.
2019-11-18 20:57:34 +00:00
Mike Auty
dc5420df55
Stackers: Give the vmware stacker an ordering.
2019-11-16 12:58:38 +00:00
Mike Auty
dcf5b1f68c
Stackers: Update the stack orders to try quick header check layers first
2019-11-16 12:53:56 +00:00
Mike Auty
1f0e81a898
layers: Stackers are sorted by stack_order not layer priorities.
2019-11-16 12:53:56 +00:00
Mike Auty
19d46563ae
layers: Fix up the maths around scanning chunks
2019-11-13 21:44:13 +00:00
Mike Auty
ca8099e7d7
layers: Improve scanning of layered chunks
...
Previously, for segmented layers, no chunk larger than a full segment
was scanned. Now, we combine contiguous segments up to
scanner.chunk_size (or until a non-present segment) in order to scan it.
This may be slightly slower (by concatting the data together) but gives
results of hits across page boundaries (the point of the scanning
capability), whereas previously each page was scanned individually.
2019-11-13 21:44:13 +00:00
Mike Auty
0f9c6a7362
vmware layer: Fix up a typo.
2019-11-13 19:58:14 +00:00
Mike Auty
b99ace86fb
Tidy up exceptions to be more accurate.
2019-11-13 19:58:14 +00:00
Mike Auty
40fcdf9469
exceptions: SymbolErrors now contain specific information
2019-11-13 19:27:00 +00:00
Mike Auty
ce3f4fb134
CLI: Initial attempt to standardize exception output
2019-11-13 19:27:00 +00:00
doomedraven and ikelos
4543b0af33
Update vaddump.py
2019-11-13 18:54:19 +00:00
doomedraven and ikelos
97f670ec79
simplify vad dump to be used by other plugins
2019-11-13 18:54:19 +00:00
Mike Auty
648cded5e1
Objects: Fix incorrect Bitfield maths
...
Turns out that #133 exposed a mistake in how we were using the end_bit
field (and it should have been picked up in review, my bad).
Essentially we were masking based on the length of the end_bit after
*already* shifting by the start_bit. We should mask then shift, not the
other way around.
May well fix issue #135 (pdb generation will have been affected by
this).
2019-11-13 16:48:14 +00:00
Mike Auty
d0a5d4ba3f
layers: Ensure the new registry check doesn't throw an exception.
2019-11-12 09:09:51 +00:00
Mike Auty
face38436e
layers: Fix up uses of is_valid.
2019-11-12 09:09:51 +00:00
xabiugarte and ikelos
5b04492463
Fix on 'end_bit' computation
2019-11-11 17:03:04 +00:00
Mike Auty
989f08eff2
Revert "EPROCESS: Fix is_valid check missing cast."
...
This reverts commit 60eda0a52b#110 , only done worse.
2019-11-09 16:06:30 +00:00
Mike Auty
60eda0a52b
EPROCESS: Fix is_valid check missing cast.
2019-11-09 15:56:19 +00:00
Mike Auty
23b14b772a
Poolscanner: Fix error in index checking.
2019-11-09 00:17:07 +00:00
Mike Auty
373442ac24
pdbscan: Fix up permission error creating directories
2019-11-04 10:57:30 +00:00
Mike Auty
ee31ece006
Fix a logging on add_process_layer exceptions.
...
There were a number of issues with commit 3df5e995
2019-11-03 23:15:38 +00:00
Mike Auty
73aa73f30e
Ensure we test None using is rather than ==.
2019-11-03 22:46:20 +00:00
Mike Auty
9d453ff916
Elf64: Ensure volatility objects aren't stored as part of the layer.
2019-11-03 20:37:12 +00:00
Mike Auty
bb04c3b882
Improvements to logging and support for virtualbox.
2019-11-03 20:37:12 +00:00
Mike Auty
6f73310d88
Add in initial Elf64 support.
2019-11-03 20:37:12 +00:00
Mike Auty
dd3e09f1e2
frameworkinfo: Make this a core plugin, not an optional extra.
2019-10-31 22:14:43 +00:00
Mike Auty
4457bcaee0
vadyarascan: Ensure we scan the right layer
...
This patch ensures we scan the vad segments within the correct layer
(the process layer, not the kernel layer) and lists the pid in the
output.
2019-10-31 19:15:02 +00:00
xabiugarte and ikelos
bdee51fef0
Check progress_callback is not None before call
...
Followed the same approach as in
volatility/framework/symbols/windows/pdbconv.py
2019-10-23 09:56:55 +01:00
Mike Auty
ce2b83fc34
Add in support for sizing LF_ARGLISTs. Fixes issue #99 .
2019-10-23 00:09:45 +01:00
Mike Auty
27a291cf61
Remove the erronious print statement, which should be a vollog message if needed.
2019-10-18 08:39:56 -04:00
Mike Auty
0be9061989
Tidy up commit e0097ac.
2019-10-18 08:38:17 -04:00
atcuno
545376d725
Mac - update trustedbsd
2019-10-17 15:30:13 -04:00
atcuno
3df5e9957e
Windows - add missing add_process_layer exception handling in a few plugins
2019-10-17 11:47:19 -04:00
atcuno
e0097ac9c1
Windows - protect handles from smear
2019-10-17 11:03:48 -04:00
atcuno
2cad54ea6b
Windows - prevent LIST_ENTRY enumeration code from returning objects on invalid/not mapped pages
2019-10-17 10:27:14 -04:00
atcuno
2e329d1106
Windows - add exception handling around is_valid in callbacks
2019-10-17 10:22:06 -04:00
Mike Auty
97e41e21e4
Volatility 3 1.0.0-beta.1 release
2019-10-13 11:28:09 +01:00
Mike Auty
48f2c78a7d
Update versioning to support appropriate version checks.
2019-10-13 11:12:28 +01:00
Mike Auty
2229c50de8
Remove executable bit from data files.
2019-10-13 10:09:10 +01:00
Mike Auty
9b0a910d7e
Update typing and documentation on renderers.
2019-10-07 10:35:17 +01:00
Mike Auty
71e082f25f
Ensure the layers are loaded on layer stacker run, not just when a layer is stacked.
2019-10-07 01:52:58 +01:00
Mike Auty
d3f1a396da
Handle JSON errors when caching banners.
2019-10-04 22:50:25 +01:00
Mike Auty
3784c9aff6
Fix up missing/inaccurate plugin description strings.
2019-10-03 01:05:57 +01:00
Mike Auty
3b656e337a
Update windows extensions to ensure they're documented.
2019-10-02 20:25:54 +01:00
Mike Auty
10a379b0ee
Make 'import as' consistent and ensure proper plugin dependencies.
2019-10-02 01:25:03 +01:00
Mike Auty