Mike Auty
42ef21fd29
Documentation: Clarify linux ISF generation
2021-07-11 22:37:41 +01:00
ikelos and GitHub
4d9b2517c6
Merge pull request #498 from volatilityfoundation/windows_crashdump_fixes_jxwenger
...
complete windows crash dump support
2021-07-11 00:07:27 +01:00
iMHLv2
f1079e7e9b
fix up required framework version for crashinfo
2021-07-10 08:32:40 -05:00
ikelos and GitHub
af090bf29e
Merge pull request #519 from fgomulka/tty-check-pointer-issue
...
Create a list_head to fix tty_check bug
2021-06-23 20:22:27 +01:00
Frank Gomulka
dbae5d353d
Create a list_head to fix tty_check bug
...
This commit casts `tty_driver` to a `list_head` to fix an
AttributeError in the linux tty_check plugin
2021-06-22 10:43:31 -04:00
Mike Auty
b6165b439f
Mac: Fix minor typo in previous fix
2021-06-07 01:44:21 +01:00
Mike Auty
772083ac75
Mac: Fix unguarded read in automagic #515
2021-06-06 11:50:23 +01:00
Mike Auty
ed1320491c
Poolscan: Further python 3.6 efficiencies
2021-06-04 22:19:12 +01:00
ikelos and GitHub
7aff6f6d8b
Merge pull request #513 from bonafont/develop
...
Fixed CM_KEY_VALUE get_decode method
2021-06-04 22:16:16 +01:00
Anthony Fey
a11c94a82b
Fixed CM_KEY_VALUE get_decode method
2021-06-04 18:52:00 +02:00
ikelos and GitHub
c3107986fc
Merge pull request #401 from volatilityfoundation/issues/issue400
...
Objects: Avoid reconstructing pointed objects
2021-06-02 20:30:42 +01:00
iMHLv2
7d9c66c407
run yapf on the newly added files
2021-06-01 14:27:20 -05:00
iMHLv2
7b73f8d545
fix the copyright date for extensions/crash.py
2021-06-01 14:21:11 -05:00
iMHLv2
d2db22c310
use typing for the layer variable passed to _generator
2021-06-01 14:20:59 -05:00
iMHLv2
d285519ecb
don't assume primary.memory_layer is a crash layer...instead, cycle through the layers until finding the crash layer
2021-06-01 14:17:31 -05:00
iMHLv2
a0adbde994
eliminate confusing single letter variable
2021-06-01 13:55:37 -05:00
iMHLv2
b15e69e11d
ensure the crashinfo plugin gets a crash layer
2021-06-01 13:55:21 -05:00
ikelos and GitHub
7ef7dd88f0
Merge pull request #510 from volatilityfoundation/revert-507-issues/issue505
...
Revert "Windows: Increase self-referential check"
2021-05-26 23:45:00 +01:00
ikelos and GitHub
3bb23b29e3
Revert "Windows: Increase self-referential check"
2021-05-26 23:43:35 +01:00
Mike Auty
0214fa35a1
Core: Increment minimum python version to 3.6
2021-05-26 23:23:27 +01:00
Mike Auty
9e7e82f026
Development: Minor mac extract_kernel updates
2021-05-26 22:14:00 +01:00
ikelos and GitHub
77d0debdac
Merge pull request #507 from volatilityfoundation/issues/issue505
...
Windows: Increase self-referential check
2021-05-26 22:12:33 +01:00
ikelos and GitHub
069a3da751
Merge pull request #504 from doomedraven/patch-1
...
ability to reverse filtering see long description
2021-05-23 16:58:35 +01:00
doomedraven and GitHub
dd6ad75b22
Update pslist.py
2021-05-23 17:10:52 +02:00
Mike Auty
abafa58f1a
Windows: Increase self-referential check
2021-05-23 15:49:28 +01:00
doomedraven and GitHub
ed9c2dd979
ability to reverse filtering see long description
...
Hello, this is very useful to optimize some scans, like in case of sandboxing, imagine:
1 round it scans only all processes that was captured by sandbox aka pid_list
2. round it scans all the rest processes ignoring pid_list from round 1
if you have a better idea how to improve/implement this, let me know, we use our custom function, but i think it might be useful for the rest
2021-05-18 22:37:34 +02:00
Mike Auty
4cb71366c7
Windows: Improve netstat errors
2021-05-16 17:08:56 +01:00
Mike Auty
f873ced04e
Windows: Improve hashdumping plugin errors
2021-05-16 17:01:52 +01:00
Mike Auty
2705614306
Windows: Remove debugging statements from pdbutil
2021-05-13 21:49:25 +01:00
ikelos and GitHub
8f7b0f2c47
Merge pull request #475 from f-block/develop
...
Temporary workaround for changes in transition PTE
2021-05-12 20:22:09 +01:00
iMHLv2
7152ca0ffc
refactor load_segments() to fix 32-bit bitmap crashdumps
2021-05-11 15:59:42 -05:00
ikelos and GitHub
21b33b677c
Merge pull request #496 from volatilityfoundation/feature/faster-pdb-scanning
...
Windows: Improve PDB scanning
2021-05-10 20:24:52 +01:00
Mike Auty
7d408ce0f3
Windows: Make IPI handling of PDBs optional
2021-04-26 01:16:38 +01:00
ikelos and GitHub
a165b1b1cf
Merge pull request #487 from volatilityfoundation/feature/better-windows-identification
...
Automagic: Add a slow scan for kernel identification
2021-04-22 18:00:56 +01:00
Mike Auty
007717590e
Merge branch 'issues/issue495' into develop
2021-04-22 17:21:05 +01:00
Mike Auty
e241ac0ac0
Windows: Fixes missing os import
...
Fixes #495
2021-04-22 17:18:52 +01:00
Mike Auty
c5c726ab28
Windows: Improve PDB scanning
2021-04-21 00:02:36 +01:00
ikelos and GitHub
280c912121
Merge pull request #492 from cstation/fix/qemu-conf
...
Fix reading JSON configration of QEMU-images
2021-04-14 19:47:45 +01:00
cstation
aa26601b34
Fix reading JSON configration of QEMU-images
2021-04-14 20:39:03 +02:00
Mike Auty
88ff4f1d06
Windows: Fix up double import in pdbconv
2021-04-07 22:30:45 +01:00
ikelos and GitHub
9d2c17b79d
Merge pull request #483 from volatilityfoundation/prevent_pslist_backtrace
...
Prevent pslist from backtracing on invalid process. Include a warnin…
2021-04-07 18:19:03 +01:00
Andrew Case
ce3b0fcc0b
Change debug to info for invalid process warning message
2021-04-07 12:04:50 -05:00
Mike Auty
191da08fb3
Automagic: Add a slow scan for kernel identification
2021-04-04 17:46:37 +01:00
Mike Auty
a1c5f5e5e5
Automagic: Improve secondary 64-bit self-ref finder
2021-04-03 13:33:20 +01:00
Mike Auty
087b172148
Automagic: Add secondary 64-bit self-referential value
2021-04-03 13:07:43 +01:00
iMHLv2
00db33e0fe
print human readable dump type in crashinfo, along with bitmap header size, bitmap size, and page count
2021-03-31 09:52:12 -05:00
iMHLv2
fb54a2cade
report segments in the crash layer with LOGLEVEL_VVVV
2021-03-30 21:23:46 -05:00
iMHLv2
3ebbddbd8d
don't save objects in self
...
they contain a reference to the context, so if we ever pickle that, then it'll cause a massive recursion loop and fail
2021-03-30 21:12:32 -05:00
iMHLv2
f5e5fd0060
apply fixes and improvements for crash layer (see description)
...
1) Remove empty newlines before the license
2) Remove unused imports
3) Add support for 32-bit Bitmap crash dumps
4) Move _SUMMARY_DUMP to crash_common.json and fix the swapped Pages and BitmapSize offsets
5) Fix other errors in crash64.json (swapped SystemTime vs SystemUpTime, PsActiveProcessHead should be unsigned long long, several incorrect offsets for other members
6) Switched to new volatility3 namespace
7) Reverted required_framework_version to (1, 0, 0)
8) Fixed crashinfo plugin from unpacking the wrong number of values from layer.mapping(). Actually, the plugin no longer displays runs - it shows metadata instead.
9) Address Ikelos' comments in PR #452
2021-03-30 17:25:32 -05:00
iMHLv2
f4dee3c5f0
sync with fa1c03d of jxwegner/volatility3
2021-03-30 15:27:09 -05:00
Mike Auty