Andrew Case
49c4ae2aa4
Mac - have bash inherit from tasks
2019-09-26 23:05:49 -05:00
Andrew Case
a6e7c7a919
Mac - have malfind inherit from tasks
2019-09-26 23:01:37 -05:00
Andrew Case
7339c12eaa
Mac - have proc maps inherit from tasks
2019-09-26 22:52:45 -05:00
Andrew Case
eeb04655e6
Mac - smear protection in network address enumeration
2019-09-26 22:08:47 -05:00
Andrew Case
3af593c16a
Mac - switch netstat to inherit from tasks
2019-09-26 22:07:41 -05:00
Andrew Case
2d7bc99d6a
Mac - make pslist smear resistant
2019-09-26 21:57:48 -05:00
Andrew Case
a85ce3ecf5
Merge branch 'master' of https://github.com/volatilityfoundation/volatility3
2019-09-26 21:56:55 -05:00
Andrew Case
b4ad15c226
Mac - update lsof to inherit from tasks and be more smear resistant
2019-09-26 21:56:38 -05:00
Mike Auty
dfcbd78a8a
Remove object validate method.
...
With agreement from @attrc and @imhlv2, I'm removing the useless
validate method from the object. It defaulted to returning inaccurate
information (validity undetermined, but validate returned True as if
validation had happened) and is better handled by individual classes
implementing is_valid (which seems the preferred nomenclature) and
throwing exceptions if it's called on a class that doesn't have it.
2019-09-27 01:49:42 +01:00
Mike Auty
8b3453dd29
Ensure we use the cache rathe rather than just saying we will.
2019-09-26 21:18:23 +01:00
Mike Auty
066a4e64f2
Minor fix for construct_layers.
2019-09-26 21:16:46 +01:00
Mike Auty
ae010a2390
Improve log levels and distribution of messages.
2019-09-26 21:16:12 +01:00
Mike Auty
211ad0d524
Remove useless calls to validate.
2019-09-26 15:58:22 +01:00
Mike Auty
679a0eabc2
Tidy Exceptions and ensure LayerExceptions are passed a layer name.
2019-09-26 15:44:36 +01:00
Mike Auty
2acdc3e060
Fix up PADDING_INFO for very specific versions of windows.
2019-09-26 13:35:23 +01:00
Mike Auty
e0b9d72c84
Update the license URL and LICENSE.txt
2019-09-25 21:44:05 +01:00
Mike Auty
ee008cb76b
Make sure we accurately check the PADDING_INFO presence.
2019-09-25 21:32:53 +01:00
Mike Auty
2252876375
Correct the PADDING_INFO handling.
2019-09-25 21:32:53 +01:00
Mike Auty
5a8946da83
Shift the InfoMask stuff into the top-down approach.
2019-09-25 21:32:53 +01:00
Mike Auty
b0559656fc
Update the header offsets for the InfoMask.
2019-09-25 21:32:53 +01:00
Mike Auty
6a3a6cdb3c
Add this as more of an example of how to cache.
...
In a volatility object, we can use our own internal _vol variable to
expose values externally, or just for us to cache. It will override
preexisting values though, so when used as a cache, best to make its key
long and unique as possible.
2019-09-25 21:32:53 +01:00
Mike Auty
0fd9bf2dbb
Try to shave some time from the poolscanner by Infomask checking.
2019-09-25 21:32:53 +01:00
Mike Auty
37cb541013
Change the layer naming convention to include the underscores when necessary.
2019-09-25 19:38:39 +01:00
Mike Auty
c05b8dfd6a
Volshell: Add support for constructing objects at specific offsets.
2019-09-25 01:22:48 +01:00
Mike Auty
926288a7ac
Ensure process layer name contains the process ID.
2019-09-25 01:15:58 +01:00
Mike Auty
628ff6f740
Volshell: Add a convenience display symbols function.
2019-09-25 01:02:43 +01:00
Mike Auty
320f24d23f
Volshell: Rename key methods and separate out NullFileConsumer.
2019-09-24 00:05:41 +01:00
Mike Auty
21f3d29576
Volshell: split running the plugin into separate run and render steps.
2019-09-24 00:00:25 +01:00
Mike Auty
6a43cd4593
Volshell: improve help function if arguments are used.
2019-09-23 23:59:54 +01:00
Mike Auty
b25094035d
Update renderers to work on populated treegrids.
2019-09-23 23:59:35 +01:00
Mike Auty
0e61062cb0
Volshell: Try not to pollute the configuration dictionary.
2019-09-23 23:11:45 +01:00
Mike Auty
89938cfbbc
Volshell: Add support for quickly running plugins
2019-09-23 22:59:56 +01:00
Mike Auty
6c4c3f5a52
Volshell: improve dt error handling
2019-09-23 22:31:12 +01:00
Mike Auty
03c2444fbb
Volshell: Fix up typo and improve spacing
2019-09-23 22:17:25 +01:00
Mike Auty
152572182f
volshell: Improve dt method
2019-09-23 22:13:32 +01:00
Mike Auty
575463e69e
Improve volshell: aliases and mode
2019-09-23 21:41:35 +01:00
Mike Auty
72567e1c50
Yapf-0.28.0 rerun across the whole codebase.
2019-09-21 21:08:23 +01:00
Mike Auty
dad88692b8
Minor improvements for pyinstaller packages.
2019-09-21 21:06:05 +01:00
Mike Auty
d2b892cf94
Fix up docstring errors in documentation build
2019-09-19 23:00:37 +01:00
Mike Auty
1f9605abf7
Revert "Fix warnings when generated documentation."
...
This actually broke autodoc generation and wasn't accurate. The
documentation warnings may have to stay for now.
This reverts commit 37e13321f9
2019-09-17 18:32:44 +01:00
Mike Auty
a248bdc804
Fix up old code and docstring indent issue.
2019-09-17 18:15:05 +01:00
Mike Auty
7efe19224e
Make several small typing information fixes.
2019-09-17 18:01:11 +01:00
Mike Auty
33451967b2
Typing fixes for virtmap and remove extranious exception.
2019-09-17 17:58:47 +01:00
Mike Auty
f872aa3390
Revert "Add in no-dump option to certificates plugin."
...
Arg, too much mind changing. This option would make sense if the
certificates plugin returned much useful information, but parsing
certificates isn't easy in with just stdlib, and therefore dumping the
certificates is the most sensible thing for this plugin to do (meaning
no need for a no-dump option).
This reverts commit 5491825652
2019-09-17 16:59:50 +01:00
Mike Auty
444fd5451b
Add in no-dump option to certificates plugin.
2019-09-17 16:59:50 +01:00
Mike Auty
ab4b77a754
Revert "Add in the option to not produce files."
...
It makes more sense to allow each plugin to individually decide whether
to produce files or not.
This reverts commit 07adce2721
2019-09-17 16:59:50 +01:00
superponible and ikelos
ae8822dddf
check if hive offset is valid before yielding
2019-09-17 16:59:50 +01:00
Mike Auty
442b47c87d
Add in the option to not produce files.
2019-09-17 16:59:50 +01:00
Mike Auty
83e113dad0
Revert "Provide a more user friendly filename."
...
As Dave pointed out in the pull request, "User" assumes only one user
and not multiple hives.
This reverts commit a802ecab86
2019-09-17 16:59:50 +01:00
Mike Auty
1b953e3c80
Provide a more user friendly filename.
2019-09-17 16:59:50 +01:00
Andrew Case