Andrew Case
3435bb8ae7
Add plugins missing from original commit
2024-10-27 15:26:40 -05:00
Andrew Case
606753902c
Add David's patch for iterating hlists
2024-10-24 15:15:22 -05:00
Andrew Case
7fc868453c
Add useful implementation of yara scanning to Linux
2024-10-24 15:15:22 -05:00
Andrew Case
1c1eb6615e
Add plugin to detect perf events based malwawre
2024-10-24 15:15:22 -05:00
Andrew Case
833b7c5ab4
Bring in Gus' work and other fixes
2024-10-24 15:15:22 -05:00
Andrew Case
45fcf22a40
Update deps
2024-10-24 15:15:22 -05:00
MHL and Andrew Case
3a4696f6f6
Plugins: Yarascan + Vadyarascan Context #1287
...
This is a port of https://github.com/volatilityfoundation/volatility3/pull/1287
2024-10-24 15:15:22 -05:00
Andrew Case
ebda55c225
Address feedback
2024-10-24 15:15:22 -05:00
Andrew Case
2e38e5ed1b
Address feedback
2024-10-24 15:15:22 -05:00
Dave Lassalle and Andrew Case
1a54b0f7da
fix resident data bug for duplicate mft record numbers
2024-10-24 15:15:22 -05:00
Andrew Case
89291ab35d
Fix formatting with black
2024-10-24 15:15:22 -05:00
Andrew Case
a00408ef1b
Rework for proper ADS recovery. Memory OOM issues
2024-10-24 15:15:22 -05:00
atcuno and Andrew Case
ebb6a7317a
Address feedback
2024-10-24 15:15:22 -05:00
atcuno and Andrew Case
14ab1de907
Address feedback
2024-10-24 15:15:22 -05:00
Andrew Case
d7f13a70bf
Formatting fixes
2024-10-24 15:15:22 -05:00
Andrew Case
695f877220
Split layer gathering and add KeyError checks
2024-10-24 15:15:22 -05:00
Andrew Case
faf5471fc1
Address feedback
2024-10-24 15:15:22 -05:00
atcuno and Andrew Case
6888e695a5
Format fixes
2024-10-24 15:15:22 -05:00
atcuno and Andrew Case
6225ec4c45
Format fixes
2024-10-24 15:15:22 -05:00
atcuno and Andrew Case
223fdc6dd9
placeholder
2024-10-24 15:15:22 -05:00
ikelos and GitHub
62aa9c1e12
Merge pull request #1318 from Abyss-W4tcher/use_volshell_additional_locals
...
Allow to import external locals in volshell environment
2024-10-24 00:05:32 +01:00
Abyss Watcher
7f2d8eabb7
set correct locals priority
2024-10-23 21:39:57 +02:00
Abyss Watcher
708d933021
use additional_locals in run method
2024-10-23 21:23:14 +02:00
ikelos and GitHub
1500d2ecf6
Merge pull request #1314 from gcmoreira/linux_add_hlist_head_object_extension_fix_1313
...
Linux adds hlist_head object extension
2024-10-22 23:21:04 +01:00
Gustavo Moreira
db8667f88a
Linux - Fix hlist_head object extension by dropping the iterator since it can't determine the correct member_name
2024-10-23 08:55:44 +11:00
Mike Auty
65daab6cfa
Linux: Fix minor coding style transgression
2024-10-22 21:47:13 +01:00
ikelos and GitHub
3e6ea7bb0e
Merge pull request #1290 from dgmcdona/dgmcdona/windows-unloadedmodules-traceback
...
Windows: unloadedmodules bugfix
2024-10-22 21:38:31 +01:00
ikelos and GitHub
b0a30c0652
Merge pull request #1238 from gcmoreira/linux_fix_mnt_namespace_issue_1187
...
Linux: Add support for the mount namespace in kernels 6.8+
2024-10-22 21:22:50 +01:00
ikelos and GitHub
51ac7600f5
Merge pull request #1315 from Abyss-W4tcher/rust_type_confusion_warning
...
dwarf2json rust type confusion sanity check
2024-10-22 21:20:22 +01:00
ikelos and GitHub
028502d772
Merge pull request #1288 from gcmoreira/linux_ptrace
...
Add Linux ptrace plugin
2024-10-22 21:11:44 +01:00
Abyss Watcher
e739d96a33
dwarf2json rust type confusion sanity check
2024-10-14 14:03:38 +02:00
Gustavo Moreira
f00c4c3c39
Allows to create objects when using the same symbol table
2024-10-14 16:35:43 +11:00
Gustavo Moreira
15a51cf1ec
Linux - Add hlist_head object extension. Fix #1313
2024-10-14 16:13:56 +11:00
ikelos and GitHub
7b0cb4facd
Merge pull request #1304 from volatilityfoundation/feature/column-select-cli-only
...
Support hiding columns in the CLI
2024-10-13 22:32:14 +01:00
ikelos and GitHub
d1d45ca22f
Merge pull request #1311 from gcmoreira/linux_threads_support_from_6.7
...
Linux - Add support for task threads in kernels >= 6.7
2024-10-13 22:31:33 +01:00
Gustavo Moreira
e3521147d6
Linux - Add support for task threads in kernels >= 6.7
2024-10-13 09:26:37 +11:00
ikelos and GitHub
a10fb5b4b6
Merge pull request #1308 from dgmcdona/dgmcdona/linux-netfilter-fix
...
Linux: Netfilter - fix traceback on missing module name
2024-10-11 18:28:34 +01:00
David McDonald
fb4dd924ce
Linux: Netfilter - fix traceback on missing module name
...
When the module name can't be found, `None` ends up in this field,
causing a traceback when rendering. This fixes it by replacing `None`
with `renderers.NotAvailableValue()`.
This occurred in the context of a netfilter hook from a hidden module.
2024-10-11 10:15:43 -05:00
Mike Auty
e817e72bc2
Support hiding columns in the CLI
2024-10-08 22:52:44 +01:00
Gustavo Moreira
620dd4e67d
Linux: ptrace: version patch number back to zero
2024-10-08 21:55:21 +11:00
Gustavo Moreira
6b5bef4133
Linux: ptrace: bumping version patch number to re-run the black linter with #1301
2024-10-08 21:27:29 +11:00
ikelos and GitHub
4ffaad5a15
Merge pull request #1301 from gcmoreira/fix_black_stable_version
...
Fix black stable version issue with Python 3.8
2024-10-08 09:42:58 +01:00
Gustavo Moreira
384042202e
fix black stable version issue with Python 3.8
2024-10-08 18:37:32 +11:00
Gustavo Moreira
aa95913940
Linux: ptrace: improve header names and variables
2024-10-08 16:03:36 +11:00
Gustavo Moreira
3c4b9996ce
Linux: ptrace: move tracee TIDs to multiple rows
2024-10-08 16:00:35 +11:00
Gustavo Moreira
eb2d4b1765
Linux: ptrace: add ptrace functions to the task_struct object extension
2024-10-08 15:54:48 +11:00
Gustavo Moreira
f92dfdd33b
Linux: ptrace: remove patch number in plugin requirement
2024-10-08 15:53:07 +11:00
ikelos and GitHub
d1c5fc2ac1
Merge pull request #1299 from volatilityfoundation/1298-printkey-output-confusing-when-key-not-found
...
#1298 - include hive name in key path
2024-10-07 23:19:14 +01:00
ikelos and GitHub
64d55bf1a7
Merge pull request #1209 from dgmcdona/dgmcdona/windows-amcache
...
Windows: Adds Amcache plugin
2024-10-07 23:15:04 +01:00
ikelos and GitHub
5ff06fe1ef
Merge pull request #1272 from volatilityfoundation/816-port-cmdscan-and-console-plugins-from-vol2-to-vol3-please
...
#816 cmdscan and console
2024-10-07 23:13:19 +01:00
Andrew Case