Gustavo Moreira
2efb4e7d28
Merge branch 'develop' into linux_boottime_support
2024-11-05 19:56:15 +11:00
Gustavo Moreira
a05397e8b6
Linux: Boottime API: Minor. Fix docstring typo
2024-10-30 15:57:00 +11:00
Gustavo Moreira
e197fbaf5f
Linux: Boottime API: Refactor __sub__ to operate through __add__() and negate() for improved clarity and reuse
2024-10-30 15:39:40 +11:00
Gustavo Moreira
7abe92cf2f
Linux: Boottime API: Minor. Move negate() up
2024-10-30 15:36:46 +11:00
Gustavo Moreira
42d918c05d
Linux: Boottime API: Refactor Timespec Methods.
...
Move TimespecVol3 methods to an abstract class Timespec64Abstract, which is now inherited by Timespec64 and Timespec64Concrete.
2024-10-30 15:21:13 +11:00
Gustavo Moreira
bee2a398eb
Linux: Minor: Add comment/header on each set of constants
2024-10-29 15:13:26 +11:00
Gustavo Moreira
bb6dc9a595
Merge branch 'develop' into linux_boottime_support
2024-10-29 14:41:51 +11:00
Gustavo Moreira
57ffd5b939
Linux: Boottime API: Refactor TimespecVol3::negate() to return a new object instead of modifying the original. It also normalizes its values, aligning with the behavior of the other addition and subtraction operators
2024-10-29 14:24:16 +11:00
Gustavo Moreira
c4274c942c
Linux: Fix exception message in TimespecVol3::__sub__()
2024-10-29 13:49:58 +11:00
Gustavo Moreira
4895af47bd
Linux: Boottime timeliner: Rollback timeliner event type changes and use the created time for the boot time plugin
2024-10-29 13:46:19 +11:00
ikelos and GitHub
a1961401d5
Merge pull request #1320 from dgmcdona/dgmcdona/linux_pagecache_missing_iter_implementation
...
Linux: Extensions - removes abc.Iterable definition
2024-10-25 00:35:24 +01:00
David McDonald
4c2d2f98da
Removes collections.abc.Iterable superclass
...
Per @gcmoreira this is the correct fix vs the one previously proposed,
since self.vol.member_name cannot be used as the member name to
iterate this type.
2024-10-24 15:39:15 -05:00
David McDonald
388a3e6458
Linux: Adds missing abc.Iterable implementation
...
`hlist_head` is missing an implementation for
`collections.abc.Iterable`, resulting in a crash at runtime. This fixes
the issue by providing the required `__iter__` implementation for
`hlist_head`.
2024-10-24 14:39:22 -05:00
ikelos and GitHub
62aa9c1e12
Merge pull request #1318 from Abyss-W4tcher/use_volshell_additional_locals
...
Allow to import external locals in volshell environment
2024-10-24 00:05:32 +01:00
Abyss Watcher
7f2d8eabb7
set correct locals priority
2024-10-23 21:39:57 +02:00
Abyss Watcher
708d933021
use additional_locals in run method
2024-10-23 21:23:14 +02:00
ikelos and GitHub
1500d2ecf6
Merge pull request #1314 from gcmoreira/linux_add_hlist_head_object_extension_fix_1313
...
Linux adds hlist_head object extension
2024-10-22 23:21:04 +01:00
Gustavo Moreira
db8667f88a
Linux - Fix hlist_head object extension by dropping the iterator since it can't determine the correct member_name
2024-10-23 08:55:44 +11:00
Mike Auty
65daab6cfa
Linux: Fix minor coding style transgression
2024-10-22 21:47:13 +01:00
ikelos and GitHub
3e6ea7bb0e
Merge pull request #1290 from dgmcdona/dgmcdona/windows-unloadedmodules-traceback
...
Windows: unloadedmodules bugfix
2024-10-22 21:38:31 +01:00
ikelos and GitHub
b0a30c0652
Merge pull request #1238 from gcmoreira/linux_fix_mnt_namespace_issue_1187
...
Linux: Add support for the mount namespace in kernels 6.8+
2024-10-22 21:22:50 +01:00
ikelos and GitHub
51ac7600f5
Merge pull request #1315 from Abyss-W4tcher/rust_type_confusion_warning
...
dwarf2json rust type confusion sanity check
2024-10-22 21:20:22 +01:00
ikelos and GitHub
028502d772
Merge pull request #1288 from gcmoreira/linux_ptrace
...
Add Linux ptrace plugin
2024-10-22 21:11:44 +01:00
Gustavo Moreira
1651ecb1d7
linux: boottime api: Fix explicit returns mixed with implicit (fall through) returns
2024-10-18 13:58:27 +11:00
Gustavo Moreira
d25df2357a
Linux: pslist: Add the boottime plugin
2024-10-18 12:59:23 +11:00
Gustavo Moreira
69512dc991
Linux: pslist: Add creation time column and timeline support to the linux.pslist plugin
2024-10-18 12:58:02 +11:00
Gustavo Moreira
f822468407
linux: Implement boot time support in the Volatility 3 core framework
2024-10-18 12:40:02 +11:00
Gustavo Moreira
18f7f035ee
linux: fix datetime import and remove unused ones
2024-10-18 12:29:09 +11:00
Abyss Watcher
e739d96a33
dwarf2json rust type confusion sanity check
2024-10-14 14:03:38 +02:00
Gustavo Moreira
f00c4c3c39
Allows to create objects when using the same symbol table
2024-10-14 16:35:43 +11:00
Gustavo Moreira
15a51cf1ec
Linux - Add hlist_head object extension. Fix #1313
2024-10-14 16:13:56 +11:00
ikelos and GitHub
7b0cb4facd
Merge pull request #1304 from volatilityfoundation/feature/column-select-cli-only
...
Support hiding columns in the CLI
2024-10-13 22:32:14 +01:00
ikelos and GitHub
d1d45ca22f
Merge pull request #1311 from gcmoreira/linux_threads_support_from_6.7
...
Linux - Add support for task threads in kernels >= 6.7
2024-10-13 22:31:33 +01:00
Gustavo Moreira
e3521147d6
Linux - Add support for task threads in kernels >= 6.7
2024-10-13 09:26:37 +11:00
ikelos and GitHub
a10fb5b4b6
Merge pull request #1308 from dgmcdona/dgmcdona/linux-netfilter-fix
...
Linux: Netfilter - fix traceback on missing module name
2024-10-11 18:28:34 +01:00
David McDonald
fb4dd924ce
Linux: Netfilter - fix traceback on missing module name
...
When the module name can't be found, `None` ends up in this field,
causing a traceback when rendering. This fixes it by replacing `None`
with `renderers.NotAvailableValue()`.
This occurred in the context of a netfilter hook from a hidden module.
2024-10-11 10:15:43 -05:00
Mike Auty
e817e72bc2
Support hiding columns in the CLI
2024-10-08 22:52:44 +01:00
Gustavo Moreira
620dd4e67d
Linux: ptrace: version patch number back to zero
2024-10-08 21:55:21 +11:00
Gustavo Moreira
6b5bef4133
Linux: ptrace: bumping version patch number to re-run the black linter with #1301
2024-10-08 21:27:29 +11:00
ikelos and GitHub
4ffaad5a15
Merge pull request #1301 from gcmoreira/fix_black_stable_version
...
Fix black stable version issue with Python 3.8
2024-10-08 09:42:58 +01:00
Gustavo Moreira
384042202e
fix black stable version issue with Python 3.8
2024-10-08 18:37:32 +11:00
Gustavo Moreira
aa95913940
Linux: ptrace: improve header names and variables
2024-10-08 16:03:36 +11:00
Gustavo Moreira
3c4b9996ce
Linux: ptrace: move tracee TIDs to multiple rows
2024-10-08 16:00:35 +11:00
Gustavo Moreira
eb2d4b1765
Linux: ptrace: add ptrace functions to the task_struct object extension
2024-10-08 15:54:48 +11:00
Gustavo Moreira
f92dfdd33b
Linux: ptrace: remove patch number in plugin requirement
2024-10-08 15:53:07 +11:00
ikelos and GitHub
d1c5fc2ac1
Merge pull request #1299 from volatilityfoundation/1298-printkey-output-confusing-when-key-not-found
...
#1298 - include hive name in key path
2024-10-07 23:19:14 +01:00
ikelos and GitHub
64d55bf1a7
Merge pull request #1209 from dgmcdona/dgmcdona/windows-amcache
...
Windows: Adds Amcache plugin
2024-10-07 23:15:04 +01:00
ikelos and GitHub
5ff06fe1ef
Merge pull request #1272 from volatilityfoundation/816-port-cmdscan-and-console-plugins-from-vol2-to-vol3-please
...
#816 cmdscan and console
2024-10-07 23:13:19 +01:00
ikelos and GitHub
1409f472db
Merge pull request #1297 from volatilityfoundation/1296-sort-volshell-methods-alphabetically
...
refs #1296 sort volshell methods alphabetically in hh() output
2024-10-07 23:07:46 +01:00
ikelos and GitHub
eb74437dbe
Merge pull request #1263 from gcmoreira/linux_lsof_refactoring_fixes_and_improvements
...
Linux: Add support for threads in both lsof and sockstat plugins.
2024-10-07 23:04:24 +01:00
Gustavo Moreira