WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 03:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,111 Commits 80 Branches 17 Tags
34a732a4f09f123746753c5b77661d44c92aeb2b
Commit Graph
3111 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Donghyun Kim 34a732a4f0 Fix Object Typo Error 2022-03-07 14:00:03 +09:00
Donghyun Kim a1023e51f5 Fix Renderes, Scanners, MFT Symbol Typo Error 2022-03-07 13:54:35 +09:00
Donghyun Kim 639f87a0a4 Remove Tab 2022-03-05 16:29:40 +09:00
Donghyun Kim f060562b27 Rebase 2022-03-05 16:29:09 +09:00
Donghyun Kim ad1ef807e7 Context Typo Error, MFT Symbol JSON Prettier 2022-03-05 16:27:07 +09:00
Donghyun KimandGitHub 6cb2b2bf84 Merge branch 'volatilityfoundation:develop' into develop 2022-03-05 15:43:38 +09:00
Mike Auty 670401eac7 Windows: Test unicode strings for length 0 
In some tests we were checking whether asking for the string value threw
an InvalidAddressException through an error as to whether we should look
elsewhere for the data.  As of commit 265b2825 we now treat 0-length
strings as valid (as per #652), meaning we need to check for length 0
as well as invalid pointers.

If this crops up often, we may need to revisit the decision to make sure
its in keeping with how windows treats zero length strings, but for now
we only did it once for registry keys.

Closes #665
 2022-03-03 20:35:39 +00:00
Donghyun Kim 49308eb18d Restore PR 2022-03-03 02:03:31 +09:00
Donghyun Kim dae8860577 Restore PR 2022-03-03 02:02:43 +09:00
Donghyun Kim 58782fcfe1 Typo Error Fix - Context module object Args code comment 2022-03-03 02:00:32 +09:00
Donghyun Kim 9868aeb906 Add Error Raise point 2022-02-28 14:12:25 +09:00
Donghyun Kim f156d237a4 Add 'ImportError' handling of the capstone module on malfind plugin. 2022-02-28 13:36:54 +09:00
ikelosandGitHub 9f8f6b2899 Merge pull request #658 from volatilityfoundation/feature/workaround-python-46654 
Layers: Fix opening UNC paths on windows
 2022-02-26 13:26:48 +00:00
ikelosandGitHub 03b2efa58f Merge pull request #659 from volatilityfoundation/issues/issue652-2 
Objects: Don't try to read 0 bytes when unmarshalling
 2022-02-26 13:26:09 +00:00
Mike Auty 1b09f20b5c Windows: Raise PE extraction size and make it a constant 2022-02-26 13:21:34 +00:00
Mike Auty 78b3553b2a Objects: Implement minor code optimization by @paulkermann 2022-02-25 16:33:54 +00:00
Mike Auty 265b282569 Objects: Don't try to read 0 bytes when unmarshalling 2022-02-23 22:53:54 +00:00
ikelosandGitHub 9a0ba988ab Merge pull request #609 from volatilityfoundation/issues/issue599 
Automagic: Warn when multiple symbol files match a banner
 2022-02-23 21:44:28 +00:00
Mike Auty 579a0b8735 Layers: More documentation and don't break correct URLs 2022-02-23 00:08:10 +00:00
Mike Auty 58697479bb Layers: Fix opening UNC paths on windows 2022-02-23 00:00:07 +00:00
ikelosandGitHub aa198f2709 Merge pull request #657 from paulkermann/bugfix/get_guid_from_mz 
Fix read whole module
 2022-02-22 01:09:13 +00:00
Paul Kermann f2e3df27f4 fix read whole module 2022-02-21 14:57:31 +02:00
ikelosandGitHub c024c2eecb Merge pull request #644 from paulkermann/bugfix/object_info 
Object information ChainMap invalid order
 2022-02-20 23:22:56 +00:00
ikelosandGitHub 4a1c701ff4 Merge pull request #651 from volatilityfoundation/feature/volshell-kernel-requirement 
Volshell: Update to use KernelRequirement
 2022-02-20 22:59:28 +00:00
Paul Kermann bfc4c50e67 related 2022-02-20 14:49:06 +02:00
ikelosandGitHub a2b0bdfe25 Merge pull request #653 from paulkermann/feature/fast_pdb_scanning 
Improve slow pdb scanning
 2022-02-17 14:13:31 +00:00
Paul Kermann 3036875136 run optimized scan before slow scan 2022-02-17 16:10:44 +02:00
Paul Kermann da7dd32271 Improve slow pdb scanning 2022-02-17 15:31:48 +02:00
Mike Auty e6c3c94a10 Volshell: Update docs slightly 2022-02-17 01:46:54 +00:00
Mike Auty 9fb59e4714 Volshell: Further improvements for mac/linux 2022-02-17 01:43:50 +00:00
Mike Auty 094a3c0a47 Volshell: Update to use KernelRequirement 2022-02-17 00:21:59 +00:00
ikelosandGitHub 96d4aafd6c Merge pull request #647 from volatilityfoundation/issues/issue646 
Fix infinite loop in mftscan and timeliner body file updates
 2022-02-14 20:35:24 +00:00
ikelosandGitHub f5ecdbe28d Merge pull request #645 from pudii/issues/issue313 
Implement LDRmodules plugin
 2022-02-14 01:12:21 +00:00
Mike Auty 22a7328e4c Windows: Prevent infinite loop in mftscan 2022-02-13 20:45:42 +00:00
pudii 12c3f34037 Add comments and fix minor code issues 2022-02-13 18:29:35 +01:00
Mike Auty 9cabf5362b Timeliner: Write out directly to the body file 
Since the body file doesn't need sorting, we can output it immediately,
and this also means that partial results can be recorded even in the run
is terminted before it compeletes.

Goes someway to improving #646
 2022-02-13 00:19:32 +00:00
pudii cf11de174a Implement LDRmodules plugin 2022-02-11 18:19:53 +01:00
Paul Kermann edbbc0159f bug fix 2022-02-10 10:31:18 +02:00
Mike Auty 05b4eb22fa Core: Bump the development version to 2.0.2 2022-02-09 20:19:17 +00:00
Mike Auty 497eaea512 Core: Slight speed-up for all single struct.unpack calls 2022-02-09 20:07:13 +00:00
ikelosandGitHub 3e742bf1f7 Merge pull request #643 from ilay122/bugfix/mz_parsing 
fix pdb mz parsing
 2022-02-09 19:46:09 +00:00
trashcan122 ce166b9263 fix pdb mz parsing 2022-02-09 16:30:40 +02:00
ikelosandGitHub dbf6245b85 Merge pull request #641 from paulkermann/bugfix/pdb-scanning-offset-bug 
Fixed pdb scanning bug
 2022-02-09 09:04:11 +00:00
Paul Kermann a67121f1c1 Added data_offset to pattern matching result, fixes pdb scanning bug 2022-02-09 10:40:37 +02:00
ikelosandGitHub 52f325ed54 Merge pull request #633 from Digitalisx/develop 
Correcting typo for Windows constants code comment.
 2022-01-31 11:38:12 +00:00
Donghyun KimandGitHub 7c238f93a0 Update __init__.py 
Correcting typos for Windows Constants
 2022-01-31 20:15:39 +09:00
ikelosandGitHub b84e478371 Merge pull request #623 from volatilityfoundation/issues/issue542 
Plugins: Timeliner improve support for body files
 2022-01-18 21:01:46 +00:00
ikelosandGitHub 0de8448f89 Merge pull request #622 from volatilityfoundation/issues/issue616 
Plugins: yara python module check improvement
 2022-01-18 21:00:33 +00:00
Mike Auty 0f90f7f6ca Plugins: Remove unused timeliner parameter 2022-01-18 20:58:48 +00:00
ikelosandGitHub 290e9fdb39 Merge pull request #628 from kevthehermit/plugin/sessions 
add timeliner output to windows.sessions
 2022-01-18 20:53:07 +00:00