WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-31 20:29:46 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,064 Commits 80 Branches 17 Tags
41cbfbfa340ef8949d20e1717aa5baaee02ef984
Commit Graph
4064 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Iyassou Shimels 41cbfbfa34 add license 2024-02-03 11:58:25 +03:00
Iyassou Shimels ab8ed049a4 Windows: add TrueCrypt plugin 2024-02-03 11:32:00 +03:00
ikelosandGitHub 18dd23a6b1 Merge pull request #1076 from ckusek15/windows-pstree 
Windows: Add additional command line argument info to windows pstree
 2024-02-01 11:16:24 +00:00
ikelosandGitHub 9b281c478b Merge pull request #1071 from hsarkey/hsarkey/windows-malfind 
Windows: Added '--refined' option to windows malfind plugin
 2024-02-01 09:18:41 +00:00
ikelosandGitHub e436328e88 Merge pull request #1092 from volatilityfoundation/stable 
Stable
 2024-01-31 21:43:57 +00:00
Mike Auty f95be04305 Documentation: Bump the copyright here to 2024 2024-01-31 21:36:21 +00:00
ikelosandGitHub d2f7b416de Merge pull request #1091 from volatilityfoundation/release/v2.5.2 
Documentation: Update copyright in README.md for 2024
v2.5.2 		2024-01-31 21:21:20 +00:00
Mike Auty ba488c78cd Documentation: Bump the copyright here to 2024 2024-01-31 21:13:00 +00:00
Mike Auty 86b0fd431a Core: Apply black 24.1.0 across the whole codebase 2024-01-31 21:09:48 +00:00
Mike Auty 7de7dfdabf Documentation: Update copyright in README.md for 2024 2024-01-31 21:05:00 +00:00
Mike Auty 6d093a4e43 Documentation: Update copyright in README.md for 2024 2024-01-31 21:04:16 +00:00
hsarkey 470c750d82 Updated to use dictionary for refined criteria and BaseAbsentValue for when criteria is not met 2024-01-31 16:00:29 -05:00
ikelosandGitHub 2b15f3fd87 Merge pull request #1069 from dgmcdona/dgmcdona/windows_svcscan 
Windows: SvcScan Binary Info
 2024-01-30 16:49:18 +00:00
David McDonald 43e8e01daf Removes unnecessary pass and deindents return stmt 2024-01-30 09:26:17 -06:00
David McDonald 4192e8a711 Fix condition in OsDistinguisher 2024-01-29 00:38:06 -06:00
David McDonald 42c2a86a37 Add logging for when a Services key cannot be retrieved 2024-01-29 00:38:06 -06:00
David McDonald c517a44cde Add type hints/casts to _get_service_key method 2024-01-29 00:38:06 -06:00
David McDonald f5c1bf0f1f Remove argument that matches default 2024-01-29 00:38:06 -06:00
David McDonald 5541378afe Create unique config path 2024-01-29 00:38:06 -06:00
David McDonald 4b400b6df6 Refactor out code duplication in OS version checks 2024-01-29 00:38:06 -06:00
David McDonald 86d6b4f724 Bump plugin version 2024-01-29 00:38:06 -06:00
David McDonald 77b0110635 Windows: Fixes svc symbols and OS version detection 
There were some changes made to the service structures between certain
versions of Windows that caused the PID/binary path to fail to parse
across quite a few samples. This adds the appropriate version detection
logic and updated symbol files to ensure that services are parsed
correctly across Windows versions.
 2024-01-29 00:38:06 -06:00
David McDonald 837d3b7b9f Windows: Add parsing of service binary/dll 
Parses the binary or dll associated with each service from the Windows
SYSTEM hive and includes it in the output for each service.
 2024-01-29 00:38:06 -06:00
Mike Auty 497d291ef4 Windows: Fix black on dumpfiles 2024-01-29 00:07:40 +00:00
ikelosandGitHub b211dc17b0 Merge pull request #1083 from brandon-barnacle/bbarnacle/windows-dumpfiles 
Windows: Add regex filtering to dumpfiles
 2024-01-28 23:58:16 +00:00
Mike Auty 4dc6f637b0 Core: Apply black 24.1.0 to the whole codebase 2024-01-28 23:50:45 +00:00
Brandon Barnacle ae5375a622 PR comment changes 
Change the --regex flag to --filter. Add a check so that --filter
cannot be used with --physaddr or --virtaddr. Change
self.config["filter"] check to check if file_re has been set.
 2024-01-26 11:21:16 -05:00
Calvin Kusek a50ebb6014 Windows: Display additional process info for windows.pstree 2024-01-18 22:25:54 -05:00
hsarkey ef36cb5a6c Updated windows.malfind to have a "Notes" column to indicate if a process meets 
"refined" criteria, which includes common headers like MZ,PE or function
prologues. Fixed black formatting issue.
 2024-01-17 17:51:27 -05:00
hsarkey e6e138f12d Updated windows.malfind to have a "Notes" column which will indicate if a process 
meets a "refined criteria", meaning it has a common header type (MZ, PE, or a
function prologue).
 2024-01-17 17:24:26 -05:00
hsarkey 4e89040dad Updated changes to the windows.malfind plugin. Eliminated --refined as a command line option and instead 
added an additional column called "Notes" to provide info on common headers.
 2024-01-17 16:52:16 -05:00
Mike Auty 4b86b9ea89 Plugins: Remove unnecessary variable from windows.mftscan 2024-01-17 20:40:27 +00:00
Mike Auty 01ffcd9634 Core: Fixing None equality test in MapleTree implementation 2024-01-17 20:37:26 +00:00
Mike Auty 614d4d6f2b Layers: Fix cloudstorage unnecessary import 2024-01-17 20:35:54 +00:00
bbarnacle 52dcfb45f4 Windows: Add regex filtering to dumpfiles 
In volatility2, the windows.dumpfiles plugin allows you to filter the dumped files
using a regular expression. This PR adds the same functionality to volatility3.

The regular expression is passed in using --regex=REGEX and all files matching
REGEX will be dumped. The --ignore-case flag can be passed to make the search
case-insensitive. The search is case-sensitive by default. The matching
volatility2 functionality can be found here:
https://github.com/volatilityfoundation/volatility/blob/a438e768194a9e05eb4d9ee
9338b881c0fa25937/volatility/plugins/dumpfiles.py#L844

Manual testing was performed on windows memory images across different windows
versions to verify the expected output.
 2024-01-11 13:24:05 -05:00
ikelosandGitHub 66a4fc92bb Merge pull request #1075 from gcmoreira/linux_kmsg_older_kernels_support 
Linux: Add support for kernels earlier than version 3.11 in `linux.kmsg.Kmsg` plugin
 2024-01-02 19:08:03 +00:00
Gustavo Moreira 66b408d6e8 Fix minor docstring typos 2024-01-02 11:37:10 -03:00
Gustavo Moreira 8e58815c11 Bump plugin's patch version 2024-01-02 11:25:35 -03:00
Gustavo Moreira 02a389a61b Improve docstrings 2024-01-02 11:17:18 -03:00
Gustavo Moreira e4c44698f8 Reduce imports 2024-01-02 11:14:43 -03:00
Gustavo Moreira 0d934d4991 Fix error and comment 2023-12-26 16:13:47 -03:00
Gustavo Moreira 3848fc69a6 Add support for kernels earlier than version 3.11. 
* Add support for older ring buffer kernel implementation:
  - 3.5 < kernels
  - 3.5 <= kernels < 3.11
 * Enabled support for wrapped-around ring buffers in all four kernel implementations.
 * Bugfix: wrapped around buffer issue with 3.11 <= kernel < 5.10.
 2023-12-25 21:32:14 -03:00
hsarkey 409ce95980 Windows: Added '--refined' option to windows malfind plugin 
Also updated malfind to include "\x55\x48" and "\x55\x89" as part of the refined_criteria list.
 2023-12-21 15:49:00 -06:00
ikelosandGitHub fdf93f502f Merge pull request #1062 from vobst/handle-duplicate-enum-value 
tolerate duplicate enum values, keep first name that was seen
 2023-12-20 19:42:50 +00:00
ikelosandGitHub a4b927f478 Merge pull request #1068 from vobst/remove-kernel_cap_struct-requirement 
remove kernel_cap_struct requirement
 2023-12-20 11:26:18 +00:00
Valentin Obst aa624b0339 remove kernel_cap_struct requirement 2023-12-19 10:25:26 +01:00
Valentin Obst bd96357e33 tolerate duplicate enum values, keep first name that was seen 2023-12-19 09:32:25 +01:00
ikelosandGitHub 18e5d7a7f2 Merge pull request #1061 from eve-mem/linux_kmsg_issue_1055 
Linux: Update kmsg issue 1055
 2023-12-18 18:59:30 +00:00
ikelosandGitHub 4ac261c7bf Merge pull request #1057 from eve-mem/linux_fix_pstree 
Linux: Update pslist to fix pstree
 2023-12-14 11:10:49 +00:00
EveandGitHub e2f7e7ec54 Merge branch 'volatilityfoundation:develop' into linux_fix_pstree 2023-12-14 09:52:28 +00:00