Mike Auty
3153cd7e30
Remove the chainmap and multiple dictionaries to reduce memory consumption
2025-03-24 19:21:51 +00:00
Mike Auty
f0153817c5
Add in slots to object model
2025-03-24 00:58:28 +00:00
ikelos and GitHub
0ddec14cf9
Merge pull request #1724 from volatilityfoundation/dgmcdona/windows_timers_raw_dpc_offset
...
Windows: Fix raw Dpc offset calculation
2025-03-20 20:28:18 +00:00
David McDonald
d097d6abeb
Timers: convert general Exception to InvalidAddressException
2025-03-20 15:18:08 -05:00
David McDonald
c4589a51d5
Timers: Adds debug log statement to catch-all exception
2025-03-20 15:13:26 -05:00
David McDonald
1e175b5d3b
Objects: rework new get_raw_value() method
...
Per code review recommendations, splits the `_unmarshall` classmethod
into two components, one of which retrieves the raw value, and the other
that returns the masked pointer. The `get_raw_value` method now calls
the `_get_raw_value` classmethod using its instance information.
2025-03-20 15:11:37 -05:00
David McDonald
144fd3139a
Framework: Minor version bump
...
Made an additive change to `Pointer` by adding the `get_raw_value()`
method, so bumping the minor version here. The `get_raw_dpc()` method
was removed from the `KTIMER` extension class, which is currently
unversioned.
2025-03-20 14:38:19 -05:00
David McDonald
a8ea3aae01
Extensions: Removes the get_raw_dpc method from KTIMER
...
This removes the `get_raw_dpc` method from the `KTIMER` extension class.
This method was inaccurate in that it actually returns the masked
pointer value instead of the full 64-bit value encoded in that member,
which is required in order to correctly decode the 'real' pointer.
The invocation of `get_raw_dpc()` was replaced with
`self.Dpc.get_raw_value()`, which was added in the previous commit.
2025-03-20 14:32:04 -05:00
David McDonald
7b9fb91672
Objects: create get_raw_value() method for Pointer
...
This creates a `get_raw_value()` method for the `Pointer` class that
allows users to access the raw (unmasked) value of a pointer. This was
required in order to decode the encoded `Dpc` pointer that is part of
the `_KTIMER` Windows type. Addition of this type was favored over a
cast to `unsigned long` or `unsigned long long` due to the potential for
future instability of this type due to compiler changes.
See https://github.com/volatilityfoundation/volatility3/issues/1041 for
further discussion around the conversion of `log unsigned int` to
`unsigned long` in `clang`.
See https://github.com/volatilityfoundation/volatility3/pull/1177#discussion_r1650049299
for the original discussion around how to access this pointer in the
`Timers` plugin.
2025-03-20 14:23:24 -05:00
ikelos and GitHub
369f37ec43
Merge pull request #1727 from volatilityfoundation/kallsyms_fixes_round2
...
Hopefully final round of kallsym fixes
2025-03-20 18:26:23 +00:00
Andrew Case
548657c309
Change None check to remove False booleans
2025-03-20 15:02:22 +00:00
ikelos and GitHub
69f3707eb3
Merge pull request #1726 from volatilityfoundation/add_lkm_load_parameters
...
Add the recovery and reporting of LKM load parameters
2025-03-20 00:28:55 +00:00
Andrew Case
508cbd3a17
Fix function name
2025-03-19 23:51:29 +00:00
Andrew Case
741a4ea809
Hopefully final round of kallsym fixes
2025-03-19 23:49:45 +00:00
Andrew Case
bfe50889b0
Add the recovery and reporting of LKM load parameters
2025-03-19 17:32:09 -05:00
David McDonald
2795c7cdd2
Windows: Fix raw Dpc offset calculation
...
The original code was still returning this as a pointer that ended up
dereferenced in later steps. However, this pointer value actually needs
to be cast to an `unsigned long long` and decoded first.
2025-03-19 15:45:26 -05:00
ikelos and GitHub
bd5fb7d611
Merge pull request #1719 from volatilityfoundation/linux_unifiy_module_gathering_output
...
Create versioned parent class for all plugins that enumerate Linux ke…
2025-03-18 08:18:15 +00:00
Andrew Case
06a4c56395
Update for new accessing method
2025-03-17 20:15:18 -05:00
Andrew Case
0667a40836
Removed unused import
2025-03-17 19:06:02 -05:00
Andrew Case
93be148534
Change how the inheritance is performed
2025-03-17 19:04:02 -05:00
Andrew Case
00c4a13567
remove errant space
2025-03-17 18:58:55 -05:00
Andrew Case
f906bde338
change lmsod call
2025-03-17 18:56:54 -05:00
Andrew Case
971f06996b
bump version on kallsyms
2025-03-17 18:56:49 -05:00
Andrew Case
7146b45fa7
Create versioned parent class for all plugins that enumerate Linux kernel modules. Convert plugins to new method.
2025-03-17 18:56:05 -05:00
ikelos and GitHub
93e2072509
Merge pull request #1723 from volatilityfoundation/fix_extension_checks
...
Add needed checks to prevent backtraces in ELF parsing
2025-03-17 23:53:01 +00:00
ikelos and GitHub
03bc1c79ed
Merge pull request #1722 from volatilityfoundation/kallsyms_fixes_and_remove_deprecated_calls
...
Fix bugs in kallsyms and the related pscallstack found in testing and…
2025-03-17 23:52:51 +00:00
Andrew Case
07b74fd8e3
Add typing to functions in modules class
2025-03-17 18:28:13 -05:00
Andrew Case
e48d2972a6
Add needed checks to prevent backtraces in ELF parsing
2025-03-17 17:46:25 -05:00
Andrew Case
1eacddc79c
Add needed checks to prevent backtraces in ELF parsing
2025-03-17 17:45:13 -05:00
Andrew Case
b8a427c130
Fix bugs in kallsyms and the related pscallstack found in testing and switch calls to deprecated functions
2025-03-17 17:08:27 -05:00
ikelos and GitHub
ed3bcf1f5f
Merge pull request #1721 from volatilityfoundation/fix_iomem
...
Prevent backtrace on smeared iomem entry
2025-03-17 21:29:17 +00:00
ikelos and GitHub
7bdeddf050
Merge pull request #1720 from volatilityfoundation/fix_check_syscall
...
Prevent backtrace on corrupt system call table entry
2025-03-17 21:28:31 +00:00
ikelos and GitHub
a1229f902e
Merge pull request #1718 from volatilityfoundation/first_elf_fixes
...
Fix first set of ELF parsing unhandled smear protection
2025-03-17 21:13:34 +00:00
ikelos and GitHub
3a6415ab83
Merge pull request #1717 from volatilityfoundation/update_netfilter_v2
...
Update netfilter to current rookit detection API and update displayed…
2025-03-17 21:12:05 +00:00
Andrew Case
ee35fa1ef9
Prevent backtrace on smeared iomem entry
2025-03-17 19:10:23 +00:00
Andrew Case
f697287784
Prevent backtrace on corrupt system call table entry
2025-03-17 19:09:05 +00:00
Andrew Case
4b403d50ef
Fix first set of ELF parsing unhandled smear protection
2025-03-17 15:29:28 +00:00
Andrew Case
18abe9c508
Fix first set of ELF parsing unhandled smear protection
2025-03-17 15:25:43 +00:00
Andrew Case
04cd65ef2b
Update netfilter to current rookit detection API and update displayed columns to current standards
2025-03-17 15:23:44 +00:00
ikelos and GitHub
ffd38c5bff
Merge pull request #1716 from volatilityfoundation/add_windows_plugin
...
Add the windows plugin and associated extensions updates
2025-03-16 22:17:37 +00:00
Andrew Case
dae430ff58
Address feedback
2025-03-16 22:19:41 +00:00
Andrew Case
4e1ddadb40
Fix version requirements
2025-03-16 17:53:55 +00:00
Andrew Case
7e5a34ae49
Black and Ruff fixes
2025-03-16 17:17:46 +00:00
Andrew Case
c8869d87cd
Version the GUI extensions. Correctly check windows procedure
2025-03-16 17:15:43 +00:00
ikelos and GitHub
894f43c254
Merge pull request #1715 from volatilityfoundation/fix_windows_strings_bytes
...
Fix broken truncation from Vol3 bytes to string conversion
2025-03-16 16:54:46 +00:00
Andrew Case
d22d513716
Re-type the correct function
2025-03-16 16:40:53 +00:00
Andrew Case
bad34a112a
Add the windows plugin and associated extensions updates
2025-03-15 22:58:07 +00:00
Andrew Case
2d2228b06e
Fix signature
2025-03-15 21:25:39 +00:00
Andrew Case
fbb4003a32
Fix broken truncation from Vol3 bytes to string conversion
2025-03-15 20:59:14 +00:00
ikelos and GitHub
5bd7a4f4c2
Merge pull request #1710 from volatilityfoundation/update_deprecated_api_usage
...
Update nearly all callers of now deprecated Linux kernel APIs
2025-03-15 20:44:08 +00:00
Mike Auty