WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-22 14:32:21 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,288 Commits 80 Branches 17 Tags
34ff856a7900a82e971cb4061a9c60b5ee863a75
Commit Graph
326 Commits
Author SHA1 Message Date
Matt Tresslerandikelos 34ff856a79 Updated imports to reflect new location of utility class; plugins are no longer outputing anything so commiting for Andrew to take a look at 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos ddec0d482d added kernel string to linux constants file; changed automagic methods so that they reconstruct the kernel object within the method for consistancy with other methods 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos b9f5450ac3 added docs to automagic methods, fixed missing return types, changed parameters to be more specific 2020-07-30 23:24:23 +01:00
mtresslerandikelos d61034bca8 Removed unnecessary code from tty_check.py 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos 314b6aa2c6 added some documentation 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos 44911bf54a Fixed tty_check not finding the ttyhook module 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos 512cc8b451 fixed some formatting for tty_check.py 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos ec8e9161bf created tty_check.py; edited automagic/linux.py to add kernel tracking abilities 2020-07-30 23:24:23 +01:00
Mike Auty bbaf4f22d6 Plugins: Remove unnecessary dependency for yarascan 2020-07-29 20:18:03 +01:00
Mike Auty 3eb463475b Core: Refactor versioning and associated requirements 2020-07-29 20:18:03 +01:00
Mike Auty 2c39489790 Yarascan: Move most of yarascanning into a versionable plugin 
This refactors common yara tasks, so we can use the plugin versioning to
keep track of changes to the YaraScanner class.
 2020-07-29 20:18:03 +01:00
Mike Auty 54b62709d1 Hashdump: Reformat and convert to proper byte handling 2020-07-28 20:49:27 +01:00
Jack Wengerandikelos 465a7ca6ad Added documentation and logging 2020-07-28 17:59:57 +01:00
Jack Wengerandikelos 72bc40ee69 added hashdump 2020-07-28 17:59:57 +01:00
Mike Auty 13e36ec58a Core: Rerun yapf across the codebase. 2020-07-28 16:57:48 +01:00
Mike Auty 61563350b3 Linux/Mac: Refactor *nix Utilities classes 2020-07-28 11:15:16 +01:00
Mike Auty 667329e2fd Mac: Fix pslist pid_filter function 2020-07-23 02:02:01 +01:00
Mike Auty 9295f41586 Plugins: Convert existing plugins over to use a list for PIDs 2020-07-23 02:02:01 +01:00
Mike Auty 31600254b9 Codebase: Apply yapf across the codebase. 2020-07-23 01:31:41 +01:00
mtresslerandikelos 79cf041283 Update check_modules.py 
Removed unnecessary header info. A symbol table without the module_kset struct will now raise a TypeError
 2020-07-21 23:00:52 +01:00
Matt Tresslerandikelos 82a6b23669 Completed linux_check_modules. Added kobject extension as needed for check_module plugin 2020-07-21 23:00:52 +01:00
Mike Auty a173f12fce Plugins: Normalize InvalidAddress exception handling 2020-07-18 16:38:49 +01:00
Mike Auty 43ae291815 Plugins: Add back in the checks because the filter might trip them 2020-07-18 16:38:49 +01:00
Mike Auty 73ad2bcd4e Plugins: Since procs have been instantiated, checks aren't needed 2020-07-18 16:38:49 +01:00
Mike Auty d15b23aa19 Plugins: Fix pslist_method inconsistencies 2020-07-18 16:38:49 +01:00
Mike Auty 7673dd8d2d Mac: Consolidate methods of listing processes 
This also updates all other plugins that rely on process listing
and theoretically allows them to choose their preferred method of
process listing.  At the moment, the default (first in the method list)
is chosen.  An optional pslist_method StringRequirement can be added to
each plugin, but using the list in the requirements could break if the
pslist plugin is too old (ie, using the list would happen before the
PluginRequirement gets checked).

If this is a feature we want, it should be easy to add to all but
netstat, which does not parameterize the list of processes.
 2020-07-18 16:38:49 +01:00
Andrew Caseandikelos 0ccb1f82e6 Change copyright year and plugin doc strings 2020-07-18 16:38:49 +01:00
Andrew Caseandikelos 4799e8551e Add process listing through examination of the process group hash table 2020-07-18 16:38:49 +01:00
Mike Auty fb467332c6 Plugins: Yapf reformat linux check_creds plugin 2020-07-18 15:36:30 +01:00
mtresslerandikelos 8f1b338996 Update check_creds.py 
changed behavior of plugin with it is run with a bad symbol table. Instead of a vollog.error, a TypeError exception is raised with information as to why it was raised.
Also removed unnecessary header info.
 2020-07-18 15:29:30 +01:00
mtresslerandikelos 8071ebbebb End of file cut off 2020-07-18 15:29:30 +01:00
Matt Tresslerandikelos 55d1d48fac Created linux_check_creds plugin 2020-07-18 15:29:30 +01:00
Janandikelos e5d51eb9b7 adds dynamic length of pool header alignments 2020-07-17 18:07:23 +01:00
Mike Auty af1b8c03e7 Renderer: Rename StrLike to MultiTypeData 2020-07-16 19:44:18 +01:00
Dave Lassalleandikelos 42a97dd10c Registry: handle ints, multi strings, and binary data with StrLike 2020-07-16 19:44:18 +01:00
Mike Auty ecddc40781 Printkey: Bump the required framework version due to the API changes. 2020-07-16 19:44:18 +01:00
Mike Auty a5fc7323ec Registry: Don't make assumptions about the default 2020-07-16 19:44:18 +01:00
Mike Auty 5571f19b09 Registry: Move StringLike from conversion to StrLike format_hint. 2020-07-16 19:44:18 +01:00
Mike Auty 626712324a FrameworkInfo: List LayerStackers 2020-07-16 11:17:51 +01:00
Mike Auty 1b774bc69d Yarascan: Bump plugin to include rule name (issue/PR #253) 
In order to try to version control the scanner, a version number was
added to the yarascan plugin along with a method for calling the
scanner.
 2020-07-13 10:52:04 +01:00
Mike Auty 07ddbb60f7 Linux: Don't forget the pslist pid parameter 2020-07-11 10:32:15 +01:00
Andrew Case 2427a7c988 Linux - add an explicit version to lsmod 2020-07-10 15:41:25 -05:00
Michael Lighandikelos 87ff6dd87c refs #200 raise ValueError if an object doesn't have a name 2020-07-01 20:51:22 +01:00
Mike Auty 888b432667 Mac: Fix an error decoding bad UTF-8 values 
Closes #228.
 2020-06-28 01:07:16 +01:00
Mike Auty 0ffe318cb0 Project: Update copyright headers for files added in 2020. 2020-06-10 21:13:37 +01:00
Mike Auty d3ba947a56 Mac: Fix case names of certain plugins 
Closes #201.
 2020-06-10 21:02:16 +01:00
Mike Auty c134cf6eca Timeliner: Improve the option name 2020-06-10 20:33:04 +01:00
Mike Auty 1fe9cbd51d timeliner: Add the bodyfile output requirement switch to the plugin 2020-06-10 20:33:04 +01:00
Mike Auty 32fb2364a1 Timeliner: Ensure blank lines aren't printed. 2020-06-10 20:33:04 +01:00
Mike Auty fc27efc252 Add in body-file output support. 2020-06-10 20:33:04 +01:00