WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 01:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
1,160 Commits 80 Branches 17 Tags
2f3f291e53b5cef7d1279fbf9eec5ef66fd0f2e6
Commit Graph
1160 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mike Auty 2f3f291e53 Fix up missing parameter in symbol_space. 2018-07-19 09:54:56 +01:00
Mike Auty 2f28dfa6c9 Support finding symbols by ranges. 2018-07-19 09:51:51 +01:00
Mike Auty 083fd43890 Ensure get_module_symbols_by_absolute_location only returns modules at the appropriate offset. 2018-07-19 09:22:57 +01:00
Mike Auty 3ba628da7a Add in NotAvailableValue for specific uses. 2018-07-18 22:44:27 +01:00
Mike Auty 106a0cb6fd Rework the array_of_pointers utility function. 
It now makes use of the original array's symbol table to get the pointer
template, such that the size of the pointer is correct according to the
original table.  Resolves "pointer.size" attribute errors (firing inside
a property and thus throwing off unusual exceptions).
 2018-07-18 22:35:13 +01:00
Mike Auty 5c41e05876 Improve Module construction. 
The hash/size determination takes time, so make the hash generated on
use (so far, only on dedupe) and cache it, since it shouldn't change.

We also cache the Module construction, so that if it's done in a loop
(like pslist), it won't keep recaculating for the same module.
 2018-07-18 21:46:56 +01:00
Mike Auty cc5b470602 Remove the caching to see if it's causing the exceptions. 2018-07-18 21:08:50 +01:00
Mike Auty ce05510413 Additional fixes for module collections. 2018-07-18 14:35:54 +01:00
Mike Auty 91e94440fe Add in hashing for module differentiation and additional collection features. 2018-07-18 00:42:48 +01:00
Mike Auty 5906c76b1b Fix omission where protect_values became a class method. 2018-07-17 21:15:41 +01:00
Mike Auty 5fbf923186 Fix documentation and try to guess the size where possible. 2018-07-17 21:15:09 +01:00
Mike Auty 8fd1196de7 Fix minor typo. 2018-06-25 00:22:00 +01:00
Mike Auty 0ebf11dcfa Add typing information (and basic linting/formatting). 2018-06-25 00:18:02 +01:00
Mike Auty 9c06c25fae Add in support for module sizes. 2018-06-25 00:16:17 +01:00
Mike Auty c012842bd6 Refactor the name to be more accurate. 2018-06-21 00:27:38 +01:00
Mike Auty aedcf40fc2 Add support for separate symbol_tables and name in Modules. 2018-06-21 00:25:55 +01:00
Mike Auty d68d62e47d Fix methodclass conversion for linux pslist. 2018-06-20 22:19:24 +01:00
Mike Auty ffa54c45eb Fix linux invalid keyword argument bug. 2018-06-20 22:15:42 +01:00
Michael Lighandikelos ab6a9fa43b add typing, catch more specific exceptions, raise pefile dependency issues, use classmethod 2018-06-19 09:59:28 +01:00
Michael Lighandikelos e4fbc82ab3 verinfo still needs the primary and nt_symbols requirements 2018-06-19 09:59:28 +01:00
Michael Lighandikelos c43c53a7d7 initial draft of verinfo 2018-06-19 09:59:28 +01:00
Mike Auty 70abef1f46 Rework how we handle import errors. 2018-06-19 09:58:09 +01:00
Mike Auty 4ca705a05c Ensure the lack of yara doesn't kill volatility completely. 2018-06-17 20:39:29 +01:00
Mike Auty f28ee6077e Update for the new classmethod model. 2018-06-17 11:16:27 +01:00
Mike Auty a1caf8d149 Add in initial VAD yarascan code. 2018-06-17 11:16:27 +01:00
Mike Auty 9c2ba66c53 Add in initial version of yarascan plugin. 2018-06-17 11:16:27 +01:00
Mike Auty d9ed86bcc5 Ensure we return the correct values for dir(). 2018-06-16 14:29:51 +01:00
Mike Auty c0ec52822b Add some typing fixes. 2018-06-16 14:19:36 +01:00
Mike Auty 60df83ef15 Convert modules/moddump to classmethod. 2018-06-16 14:03:22 +01:00
Mike Auty ecb9d5cf05 Convert vadinfo calls to classmethods. 2018-06-16 13:38:48 +01:00
Mike Auty c4c6d30d42 Rejig where the pslist plugin exists. 2018-06-16 13:38:48 +01:00
Mike Auty ac8401991c Convert all remaining plugins to use the new classmethod pslist. 2018-06-16 13:38:48 +01:00
Mike Auty 6ca34e6607 Start converting plugins to use classmethod pslist. 2018-06-16 13:38:48 +01:00
Mike Auty aea59ffa34 Make the change for the core pslist (breaks lots of plugins). 2018-06-16 13:38:48 +01:00
Mike Auty 86c5302c99 _missing_ was a python-3.6 feature. 2018-06-16 12:36:00 +01:00
Mike Auty ddeacd3524 Fix up my mistaken advice. 2018-06-16 09:56:10 +01:00
Dave Lassalleandikelos a0edd1e38e root_cell_offset changes seem to have fixed maxaddr problems 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos 09475d5992 set default value for key since we combined exception handling 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos c68d02d565 combine exception handling to reduce code duplication 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos f2029d5657 add comment about registry key case sensitivity and re-work root_cell_offset 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos b85c143af9 yield UnreadableValues when key not found, and set default RootCell on exception 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos 201fc5780a don't use BaseBlock.Length for maxaddr 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos 0c3866ef77 make registry path comparison case insensitive 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos 5467c1c5e3 prevent from halting on an unknown registry value type 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos 218b1fd37c use masked length to extract data 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos 481ea01149 catch the KeyError so we can iterate over all hives for a key path 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos 6cfd3b6499 fix typo in debug statement 2018-06-16 09:54:45 +01:00
Mike Auty 33e146533e Fix minor typo in malfind. 2018-06-15 23:04:01 +01:00
Michael Lighandikelos 7338cdbf8a BaseDllName should be an UnreadableValue() if it cannot be accessed 2018-06-13 15:10:58 +01:00
Michael Lighandikelos 3eeb48cc0e add the moddump plugin for windows 2018-06-13 15:10:58 +01:00