WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-09 19:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,859 Commits 80 Branches 17 Tags
3b2aae40d2c7470af8c48bc5cbb2a8b1b79ef6d2
Commit Graph
2859 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mike Auty 3b2aae40d2 Automagic: Support remote banner versioning and chaining 2021-08-11 21:22:03 +01:00
Mike Auty 79b3be4cf6 Automagic: Add in remote banner cache first attempt 2021-08-11 21:22:03 +01:00
Mike Auty 4016b096c2 Core: Add in offline constant 2021-08-11 21:22:00 +01:00
ikelosandGitHub 595f377f19 Merge pull request #538 from volatilityfoundation/feature/better-modules-support2 
Feature/better modules support
 2021-08-11 21:09:24 +01:00
Mike Auty 86771d15d5 Core: Don't get to hasty with the API version 2021-08-11 21:08:33 +01:00
Mike Auty 2cfb65380a Core: Include API changes file 2021-08-11 21:06:43 +01:00
Mike Auty 8745931dea Windows: Add coalesce support to memmap 2021-08-05 17:28:36 +01:00
Mike Auty 1611a72eb9 Windows: Fix memmap not to create empty files 2021-08-05 16:21:48 +01:00
Mike Auty 058de2d9a8 Windows: Mute crypto warnings from lgtm 2021-08-04 22:25:13 +01:00
ikelosandGitHub ee70c1c6ab Merge pull request #540 from volatilityfoundation/feature/pdbconv-vs19 
Feature/pdbconv vs19
 2021-08-02 11:02:12 +01:00
Mike Auty 0343c8f81e Windows: Pdbsan typing and doc fixes 2021-07-30 21:20:33 +01:00
Mike Auty 30eec0cb76 Windows: Ensure the kernel contains an actual kvo 2021-07-30 00:17:26 +01:00
Mike Auty e793956e02 Windows: Update netscan offsets for win10-17763-x64 (#478) 2021-07-29 00:17:22 +01:00
Mike Auty fda1512273 Windows: Fix pdbconv handling of unknown types 2021-07-29 00:05:36 +01:00
ikelosandGitHub d1173b07ee Merge pull request #545 from volatilityfoundation/skip_invalid_socket_references 
Skip invalid sockets in netstat enumeration, based on @fgomulka testing
 2021-07-27 22:23:47 +01:00
ikelosandGitHub 0c925a49a8 Merge pull request #544 from volatilityfoundation/improve_mac_vnode_handling 
Cleanup vnode processing and smear protection based on @fgomulka testing
 2021-07-27 22:23:07 +01:00
Andrew Case c9232ab7b5 Skip invalid sockets in netstat enumeration, based on @fgomulka testing 2021-07-27 20:04:24 +00:00
Andrew Case c1bf63db83 Adding missing change for pointer_to_string exception catching 2021-07-27 19:59:28 +00:00
Andrew Case 63b4c60d3b Cleanup vnode processing and smear protection based on @fgomulka testing 2021-07-27 19:51:55 +00:00
ikelosandGitHub 01a63ff331 Merge pull request #499 from gcmoreira/kmsg-plugin 
Linux kernel ring buffer reader plugin
 2021-07-26 21:48:18 +01:00
Mike Auty deaa86f625 Windows: Ensure we emit LF_STRUCTURE_VS19 types 2021-07-24 23:01:11 +01:00
Mike Auty 9358700553 Windows: Refactor PDB code and support VS19 new types 2021-07-24 22:39:02 +01:00
Mike Auty 6fdf6e9e9f Windows: Convert pslist as an example 2021-07-22 22:46:39 +01:00
Mike Auty cd2f40bc34 Mac: Update all plugins to ModuleRequirement 2021-07-22 22:42:06 +01:00
Mike Auty 1480aca453 Linux: Update all plugins to ModuleRequirement 2021-07-22 22:40:09 +01:00
Mike Auty abbd516f99 Layers: Add minimum framework requirements 2021-07-22 22:37:58 +01:00
Mike Auty 31dc6f34c9 Automagic: Make symbol_shift automagic change 2021-07-22 22:37:58 +01:00
Mike Auty 213eeda268 Core: Add module collection support 2021-07-22 22:37:58 +01:00
Mike Auty d2420899c5 Layers: Fix minor pointless typo 2021-07-22 22:37:45 +01:00
Mike Auty c993c35152 Core: Further python 3.6 fixes 2021-07-22 22:23:32 +01:00
Mike Auty 66c96644ac Core: Minor flynt and typing fixes 2021-07-22 21:36:37 +01:00
Mike Auty 787f61d5a7 Documentation: Update minimum python version. 2021-07-22 21:30:08 +01:00
Mike Auty 767eea614b Windows: Add extra checks to pdbscan 2021-07-19 12:31:13 +01:00
Mike Auty 59ab92e99d Development: Update development scripts with f-strings 2021-07-18 23:20:27 +01:00
Mike Auty 0d48261201 Core: Change all 3.5 type hints to variable annotations 2021-07-18 16:49:37 +01:00
Mike Auty 9f52a15734 Core: Convert to format strings across the whole base 2021-07-18 15:53:58 +01:00
ikelosandGitHub 99e959a15a Merge pull request #535 from gohar94/patch-2 
Windows: Fix up pdb.json for LF_UDT_MOD_SRC_LINE
 2021-07-14 16:54:17 +01:00
ikelosandGitHub d4c20648e0 Merge pull request #534 from volatilityfoundation/issues/issue_528_regvaluetypes 
issue #528 - change how registry enum members are accessed
 2021-07-14 16:52:07 +01:00
ikelosandGitHub df48d3a8d3 Merge pull request #533 from volatilityfoundation/issues/issue_457_registry_mapping_sids 
Issues/issue 457 registry mapping sids
 2021-07-14 16:51:12 +01:00
ikelosandGitHub f65199845d Merge pull request #523 from gcmoreira/issue-522-private-attr-name-mangled 
Fix issue #522: private attribute names mangle
 2021-07-14 16:25:01 +01:00
Mike Auty 3ca5461f95 Windows: Ensure suitable progress callback 2021-07-14 15:47:28 +01:00
Gustavo Moreira a795a7e2d5 Using double underscore in the find() will also include edge cases like when the calling class contains an underscore i.e. THE_CLASS 2021-07-14 20:45:43 +10:00
Gohar Irfan ChaudhryandGitHub e0f08cdead Windows: Fix up pdb.json for LF_UDT_MOD_SRC_LINE 
The module field in `LF_UDT_MOD_SRC_LINE` should be `unsigned short` instead of `string` as per:
```
typedef struct lfUdtModSrcLine {
    unsigned short leaf;        // LF_UDT_MOD_SRC_LINE
    CV_typ_t       type;        // UDT's type index
    CV_ItemId      src;         // index into string table where source file name is saved
    unsigned long  line;        // line number
    unsigned short imod;        // module that contributes this UDT definition 
} lfUdtModSrcLine;
```
([source](https://github.com/microsoft/microsoft-pdb/blob/082c5290e5aff028ae84e43affa8be717aa7af73/include/cvinfo.h#L1707))

This also changes the size of the struct from 16 to 14.
 2021-07-13 10:00:32 -07:00
superponible d613b384d2 #457 - raise log level and use f-strings 2021-07-12 21:55:30 -05:00
superponible 446510ab5f issue 528 - change how registry enum members are accessed 2021-07-12 11:40:30 -05:00
superponible a7cc978ac6 #457 - filter hives for getsids and getservicesids 2021-07-12 11:24:14 -05:00
superponible 8c7b6b29d1 #457 - include hive name in debug message 2021-07-12 11:24:14 -05:00
superponible 88a8cde9ac #457 - add debugging for registry mapping 2021-07-12 11:24:14 -05:00
Mike Auty 7f6378fd5d Automagic: Changing stacking order for linux/mac 
The linux/mac stackers are more accurate (based on banners) than the
windows stacker (based on offsets).  As such in cases where both would
match, we should go for the more accurate match first (linux/mac) over
windows.  In most cases this will make no difference because of the
exclusion lists, so only one stacker will run, but in cases such as
volshell where all stackers are run, this may help with certain edge
cases.
 2021-07-12 12:27:53 +01:00
Mike Auty e28910f670 Windows: Ensure we set the kernel_virtual_offset before other reqs 
It appears in issue #524 that the step to fulfil symbol requirements
can throw an exception (which then prevents the kernel_virtual_offset
(which is optional) from being set appropriately.

This sets the kvo first and adds a check to where it's set.  It doesn't
get to the root of why an exception is thrown, but should ensure it's
easier to spot if it goes wrong.

Fixes #524.
 2021-07-12 12:09:07 +01:00