WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-30 19:59:46 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,893 Commits 80 Branches 17 Tags
47ddf5d0e5142d6deeb071225ebb2d8bc366d381
Commit Graph
3893 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mike Auty 47ddf5d0e5 Core: Bump the version after 2.5.0 release branch 2023-09-06 20:34:13 +01:00
ikelosandGitHub b5b9c8ac41 Merge pull request #1003 from volatilityfoundation/issues/issue1002 
Core: Fix missing packages in setup.py
 2023-09-06 00:54:04 +01:00
ikelosandGitHub 5e8dfc0af2 Merge branch 'develop' into issues/issue1002 2023-09-06 00:50:32 +01:00
Mike Auty 803c56e3c4 Core: include the volatility3 package and all volatility3 subpackages 2023-09-05 23:51:17 +01:00
Mike Auty 9d2fd40517 Revert "Core: Include only volatility3 in distributions packages" 
This reverts commit b4c6b661f0.
 2023-09-05 23:07:57 +01:00
Mike Auty 05df365936 Core: Fix missing packages in setup.py 
Fixes #1002.
 2023-09-05 18:23:54 +01:00
Mike Auty da203f7d68 Documentation: Improve library documentation 
Fixes #993.
 2023-09-03 22:07:20 +01:00
ikelosandGitHub 3ff4f015c4 Merge pull request #899 from cstation/feature/linux_elf_dump 
Dump ELFs to file
 2023-09-03 21:59:36 +01:00
ikelosandGitHub c8a85e11b2 Merge pull request #995 from xabrouck/dirty 
Check IoC of dirty bit in PTEs from executable VMAs.
 2023-09-03 21:56:25 +01:00
ikelosandGitHub c72129203b Merge pull request #996 from eve-mem/Linux-Change-get_process_memory_sections-to-use-get_vma_iter 
Linux: fix bug where get_process_memory_sections fails with 6.1+ kernels
 2023-09-03 21:41:43 +01:00
Mike Auty b4c6b661f0 Core: Include only volatility3 in distributions packages 
Fixes #951
 2023-09-03 21:13:37 +01:00
xabrouck 6f7f1284ad Fix bug with PAGE_SHIFT that wasn't shifted, also greatly increases performance 
Use black
Better logging
 2023-08-18 11:37:04 +02:00
EveandGitHub 804d68d94d Linux: fix bug where get_process_memory_sections fails with 6.1+ kernels 2023-08-17 13:38:23 +01:00
Mike Auty 581c493f4f Add in action to make old tickets stale. 2023-08-16 21:35:11 +01:00
xabrouck 7c82da4f50 check IoC of dirty bit in PTEs from executable VMAs. 
this can for example detect code injected using ptrace().
this can also detect injected code that was reset to the original code (malware uninstalled before memory dump happened).
 2023-08-14 11:53:14 +02:00
Mike Auty 5d4c70d517 Documentation: Fix requirements -> get_requirements #993 2023-08-03 15:16:36 +01:00
ikelosandGitHub b050b108e4 Merge pull request #988 from xabrouck/avml-fix2 
fix bug in snappy lib loading and make it work on macOS.
 2023-07-27 14:08:35 +01:00
xabrouck a226b90b4d previous commit would break linux snappy support 2023-07-27 09:37:57 +02:00
xabrouck d872abaf30 fix bug in snappy lib loading and make it work on macOS. 2023-07-27 09:28:53 +02:00
cstationandGitHub d53714fac8 Fix linting 2023-07-22 17:03:57 +00:00
cstationandGitHub fca4c5db4b Merge branch 'develop' into feature/linux_elf_dump 2023-07-22 17:00:12 +00:00
cstation 8373b5ed5a Push ELF export limit to a constant 2023-07-22 18:56:51 +02:00
ikelosandGitHub 6f71781405 Merge pull request #984 from gcmoreira/linux_capabilities_fixes 
Linux capabilities fixes
 2023-07-20 11:02:56 +01:00
Gustavo Moreira 90da6298e0 Added further details to the kernel_cap_struct::cap comments 2023-07-20 00:29:52 +02:00
Gustavo Moreira 9ba3d9ba4e Several fixes: 
* The capabilities array was to have a 64bit bitwise.
* Capabilities set has to be tested with the kernel maximum. We can't use the plugin capabilities set, otherwise we can have wrong interpretations when we tried to compress the list of capabilities to "all"
* Supports kernels >= 6.3. They changed the kernel_cap_struct::cap type again to a u64 type.
 2023-07-19 22:48:06 +02:00
ikelosandGitHub 373d769690 Merge pull request #978 from volatilityfoundation/feature/parameterized_object_from_symbol 
Core: Add type parameter to object_from_symbol
 2023-07-12 22:17:53 +01:00
ikelosandGitHub 89b6c090b3 Merge pull request #952 from cpuu/mac_pslist 
Add more process information to mac.pslist plugin
 2023-07-12 22:16:55 +01:00
cpuuandGitHub f8fc5d5e58 Update pslist.py 
list modules in code in alphabetical order
 2023-07-12 14:43:38 +09:00
cpuuandGitHub 6907575d77 Merge branch 'volatilityfoundation:develop' into mac_pslist 2023-07-12 14:37:30 +09:00
ikelosandGitHub 74e8582360 Merge pull request #957 from gcmoreira/linux_capabilities 
Linux capabilities plugin
 2023-07-10 07:49:44 +01:00
Gustavo Moreira 42fe37ed52 Adjust docstring to the new retuned type. 2023-07-10 01:12:20 +02:00
Gustavo Moreira 38e9b6baa8 Removed Dict type from the imports 2023-07-10 01:08:46 +02:00
Gustavo Moreira 63c7719763 Fixed returned types. An empty string is now returned when no capability is enabled. 2023-07-10 01:01:30 +02:00
Mike Auty 239e164ce6 Windows: Fix strings plugin missing kernel pages 
@eve-mem spotted that we were only recording the first kernel page in
any contiguous set of kernel pages, thus missing some results.  This
should now be fixed.
 2023-07-09 23:50:13 +01:00
Gustavo Moreira 241cf832f9 Plugin parameters removed. Instead, it now shows each capability set in their textual representation. The dictionary was replaced by a dataclass. 
Last but not leas, CAP_FULL moved to constants.
 2023-07-10 00:07:40 +02:00
Mike Auty 6c0ce1d130 Volshell: Typo Fixes #958 2023-07-01 20:58:36 +01:00
Mike Auty 66598f5b63 Core: Second fix is the charm... 2023-07-01 19:05:22 +01:00
Mike Auty c8e53ff16a Core: Fix small typing issue in previous patch 2023-07-01 19:02:51 +01:00
Mike Auty 50b5d2232b Core: Add type parameter to object_from_symbol 2023-07-01 19:00:03 +01:00
Mike Auty 1ff2d80b44 Documentation: Update basics - memory layer information 2023-07-01 17:02:10 +01:00
Mike Auty a9698e4e73 Documentation: minor fixes/updates 2023-07-01 17:01:33 +01:00
ikelosandGitHub 5aa0a64cfa Merge pull request #884 from eve-mem/linux_proc_dump 
First attempt at adding a --dump option to linux.proc
 2023-06-18 15:07:19 +01:00
EveandGitHub fa5af08c81 Merge branch 'develop' into linux_proc_dump 2023-06-18 07:34:45 +01:00
ikelosandGitHub e17cb1532b Merge pull request #970 from volatilityfoundation/issues/issue969 
Windows: Fix VAD offset canonicalization
 2023-06-16 19:01:21 +01:00
Mike Auty aa04b8ca3d Windows: Fix VAD offset canonicalization #969 2023-06-16 18:03:07 +01:00
ikelosandGitHub 2e577790d2 Merge pull request #962 from gcmoreira/fix_dentry_mem_smear_issue_961 
Fix issue #961: Prevent potential dentry pointer memory smear
 2023-05-30 17:51:05 +01:00
Mike Auty b9e5cfb393 Core: Protect from clearing a non-existant cache 
Issue kindly raised by @garanews, thanks!  5:D
 2023-05-22 15:05:43 +01:00
Gustavo Moreira 0f42f0eaf1 fix typo 2023-05-22 01:39:14 +01:00
Gustavo Moreira bea981180d Prevent potential dentry pointer memory smear 2023-05-22 01:32:00 +01:00
Gustavo Moreira f0bd978716 Fix typo 2023-05-20 12:17:09 +02:00