4738efefa3
Update volatility3/framework/plugins/windows/etwpatch.py
...
Co-authored-by: ikelos <ikelos@users.noreply.github.com >
2025-04-29 13:11:58 +03:00
cc1df7b461
Update volatility3/framework/plugins/windows/etwpatch.py
...
Co-authored-by: ikelos <ikelos@users.noreply.github.com >
2025-04-29 13:11:47 +03:00
39b35a3a80
Update volatility3/framework/plugins/windows/etwpatch.py
...
Co-authored-by: ikelos <ikelos@users.noreply.github.com >
2025-04-29 13:11:35 +03:00
Elad Levi
281a237e03
black and ruff fixes
2025-04-28 16:03:45 +00:00
Elad Levi
c5a4b34bfa
Fixed plugin docs
2025-04-28 15:18:53 +00:00
Elad Levi
817bd5ce7f
additional fixes
2025-04-28 15:07:03 +00:00
Elad Levi
c938678272
Fixed according to atcuno comments
2025-04-28 14:21:24 +00:00
Elad Levi
d449104d8b
removed unnecessary imports
2025-04-28 13:26:14 +00:00
Elad Levi
02634d0e30
oops
2025-04-28 12:54:46 +00:00
Elad Levi
533f96ec03
Added extended usage of pe_symbols
2025-04-28 12:53:46 +00:00
Elad Levi and GitHub
a167ddc04d
Update etwpatch.py
2025-04-24 20:51:02 +03:00
Elad Levi and GitHub
31184afe85
Update etwpatch.py
2025-04-24 20:48:59 +03:00
Elad Levi and GitHub
6ac76b27ff
Update etwpatch.py
2025-04-24 20:47:08 +03:00
Elad Levi and GitHub
e25e23d8cf
Create etwpatch.py
2025-04-24 20:46:19 +03:00
ikelos and GitHub
63f7cbd447
Merge pull request #1779 from j-t-1/svcdiff
...
Amend SvcDiff comments at top of file
2025-04-17 21:10:31 +01:00
j-t-1 and GitHub
ff5d736f94
Amend SvcDiff comments at top of file
...
Previously contained information about Skeleton_Key_Check, change this to be about SvcDiff.
2025-04-17 20:35:38 +01:00
ikelos and GitHub
fa73298e0f
Merge pull request #1579 from volatilityfoundation/feature/coding-style
...
Feature/coding style
2025-04-16 10:19:26 +01:00
ikelos and GitHub
65a02d961e
Merge pull request #1764 from volatilityfoundation/issues/make-quickstart-quicker
...
Documentation: Improve the readme to make quickstart the first thing …
2025-04-16 10:18:22 +01:00
ikelos and GitHub
6eb95ca4dc
Merge pull request #1778 from Abyss-W4tcher/qemu_layer_incomplete_requirements
...
Make QEMU layer call parent's requirements
2025-04-15 23:50:44 +01:00
Abyss Watcher
4c6188766c
black
2025-04-15 23:05:00 +02:00
Abyss Watcher
330e19f159
call parent get_requirements()
2025-04-15 23:04:49 +02:00
ikelos and GitHub
923ea92cf3
Merge pull request #1772 from volatilityfoundation/fix_symlink_scanning
...
Poolscanners: Fix symlink pool types
2025-04-15 18:06:17 +01:00
ikelos and GitHub
8dae65ee3c
Merge pull request #1769 from volatilityfoundation/inodepages/memory_usage
...
Linux pagecache.Files: Memory Usage
2025-04-15 17:18:00 +01:00
David McDonald
2199375dd5
Tests: Add symlinkscan specific test
2025-04-15 10:49:43 -05:00
David McDonald
32e9cee6dd
Tests: Add Symlinkscan generic test
...
This should be enough to prevent serious regressions that break all
output.
2025-04-15 10:49:43 -05:00
David McDonald
d745a62d7f
PoolScanner: Patch version bump
...
Bumping the patch version due to bugfix.
2025-04-15 10:21:52 -05:00
David McDonald
02fbb3ce49
Poolscanners: Fix symlink pool types
...
Fixes regression introduced in #1632
Symbolic links are allocated in the paged pools, not non-paged. This was
causing us to miss symlinks across both pre and post win8 samples.
2025-04-15 10:14:58 -05:00
David McDonald
d29be5cbde
Linux MountInfo: Remove unneeded cast
2025-04-14 18:38:47 -05:00
David McDonald
a236c0dd40
linux.pagecache.Files: Trim unneeded cast
...
Removes casts to `int` performed before checking set membership, since
the computed `__hash__` value will be the same for both the Python
primitive and the volatility `objects.Pointer`.
2025-04-14 18:30:19 -05:00
David McDonald
9ceec51b76
Pagecache: Add comments explaining cast
...
Adds a couple of comments explaining why we're doing a lossy conversion
to Python `int` (saving memory).
2025-04-14 18:25:17 -05:00
David McDonald
c641690c53
Pagecache: revert cast to int
...
`dentry.vol.offset` is already a basic Python `int`.
2025-04-14 18:25:17 -05:00
David McDonald
3b723f8be3
Linux pagecache.Files: Memory Usage
...
Converts `objects.Pointer` to `int` before storing them in the set. This
should have a substantial impact on memory, similar to those in #1758
2025-04-14 18:25:17 -05:00
ikelos and GitHub
df03d2220a
Merge pull request #1771 from volatilityfoundation/framework/process_traversal_bugfix
...
Bugfix: Linux/Windows process traversal
2025-04-14 23:43:04 +01:00
David McDonald
2e206fe698
Add keywords to parameters
2025-04-14 17:17:02 -05:00
David McDonald
91e23e0c71
Bumps patch version for pslist plugins
2025-04-14 17:15:28 -05:00
David McDonald
8f9bebdc86
Linux PsList: Fix process list traversal
...
Fixes linux process listing by traversing the list backwards as well as
forwards while tracking seen process offsets to avoid duplicates.
2025-04-14 17:12:46 -05:00
David McDonald
17f9d218c9
Windows PsList: Fix list traversal logic
...
The traversal of `ActiveProcessLinks` from `PsActiveProcessHead` was
only being done in the forward direction; if for some reason
`PsActiveProcessHead` hasn't been updated to point at the 'current' list
head, entries in the backwards traversal direction will be missed.
2025-04-14 17:12:08 -05:00
ikelos and GitHub
745e148aba
Merge pull request #1770 from volatilityfoundation/shimcachemem/bugfixes
...
ShimcacheMem: Various bugfixes
2025-04-14 18:24:52 +01:00
David McDonald
62bd41980b
Shimcache: Use self.Path.vol.count instead of hardcoded value
2025-04-14 11:43:57 -05:00
David McDonald
1d4893156e
Shimcache Extension: Fix logic error in exec_flag
...
Adds needed return statements in `exec_flag` method in order to avoid
`InvalidAddressException` when reading from invalid memory after an
`is_valid` check has already been performed.
2025-04-14 11:43:57 -05:00
David McDonald
079d2801f5
ShimcacheMem: Fix offset tracking
...
This fixes a bug in the plugin logic that causes valid entries to be
excluded in the following scenario:
- An entry is discovered but deemed invalid due to unreadable
size/timestamps.
- The offset gets placed into the `seen` tracking set anyway
- Another entry (this time, with valid filesize/timestamps) with the
same physical offset is encountered, but is skipped because this
offset is already in the `seen` tracking set.
This updates the logic to only add the offset to the tracker if the
shimcache entry is valid.
2025-04-14 11:43:57 -05:00
David McDonald
b80c52873b
ShimcacheMem: Use address_to_string
...
Uses the new `address_to_string` utility function to read filepaths, in
case a filepath crosses a boundary to a swapped page.
2025-04-14 11:43:57 -05:00
David McDonald
87cc571fbb
ShimcacheMem: Fix symbol table
...
These SHIM_CACHE_ENTRY offsets aren't correct - should be identical to
those in the other XP symbol tables.
2025-04-14 11:43:57 -05:00
ikelos and GitHub
4e0beda020
Merge pull request #1768 from volatilityfoundation/extensions/process_layer_caching
...
Extensions: Add cache decorators as appropriate
2025-04-14 17:31:54 +01:00
David McDonald
03e750648f
Windows Extensions: remove lru_cache decorators
...
These don't offer enough upside to be worthwhile compared to the
decorators applied to the `add_process_layer` methods.
2025-04-14 09:20:32 -05:00
ikelos and GitHub
1b31357665
Merge pull request #1766 from volatilityfoundation/thrdscan/filtering_and_tracebacks
...
Windows ThrdScan: Thread filtering, type-hints and tracebacks
2025-04-13 15:55:43 +01:00
David McDonald
c48ad901b0
Extensions: Add cache decorators as appropriate
...
I noticed that many plugins were creating duplicate per-process
translation layers - for instance, `windows.envars.Envars` was ending up
with > 30 process layers per process due to repeated calls to
`get_peb()`, which calls `add_process_space()` internally.
This adds `@functools.lru_cache` to the `get_peb()` and `get_peb32()`
methods on the `EPROCESS` extension, since these should only need to be
created once.
Also adds `@functools.lru_cache` to `add_process_space` to enable
reusing the same process address space, provided the same arguments are
passed to the `add_process_space()` method.
2025-04-10 14:57:46 -05:00
David McDonald
b82458e365
Windows Thrdscan: Convert from PATCH to MINOR version bump
2025-04-10 09:51:32 -05:00
David McDonald
6237950991
Windows: Revert unneeded version bumps
2025-04-10 09:50:49 -05:00
ikelos and GitHub
e00f0961c2
Merge pull request #1767 from volatilityfoundation/bugfix/layer_deletion_exception_msg
...
Layers: Fix exception message
2025-04-10 09:51:26 +01:00
