ikelos and GitHub
4f69638d4d
Merge pull request #1110 from dgmcdona/dgmcdona/windows-callbacks
...
Windows: Add support for missing callback types
2024-07-04 23:04:55 +01:00
ikelos and GitHub
1e58547aa9
Merge pull request #1191 from gcmoreira/fix_text_renderer_hexdump
...
Fix hexdump text render. Set default to 16 bytes width
2024-07-04 19:46:20 +01:00
Gustavo Moreira
52e6812d39
Fix hexdump text render. Set default to 16 bytes width
2024-07-04 14:03:59 +10:00
David McDonald
4d6f4bba0d
Windows: Add version to driverirp.DriverIrp plugin
...
This plugin class was missing a `_version` attribute, so I added one and
set it to (1, 0, 0).
2024-07-03 17:15:16 -05:00
David McDonald
55881535bb
Windows: Callbacks - parse missing callback types
...
Updates the Windows callbacks plugin to support several types of
callbacks that were present in the original volatility framework, but
were missing in volatility3. Adds an extension for `_SHUTDOWN_PACKET`
structures for determining validity of structure.
2024-07-03 17:15:16 -05:00
David McDonald
89b024d8f5
Framework: Fix bad format string
...
Fixes a bad format string inside of a raised exception
2024-07-03 16:54:43 -05:00
David McDonald
acc41c2b86
Windows: Callbacks - update symbol files
...
Updates the windows callbacks symbol files to include structures that
were missing from the original volatility plugin.
2024-07-03 16:54:43 -05:00
ikelos and GitHub
0da48fa23a
Merge pull request #1172 from volatilityfoundation/threads
...
Add threads and suspicious_threads plugins. Condense code for re-use
2024-07-03 21:05:11 +01:00
atcuno
020005f43c
Address feedback from ikelos
2024-07-03 09:55:07 -05:00
ikelos and GitHub
ac5769cf86
Merge pull request #1178 from dgmcdona/dgmcdona/windows_poolscan_layer_bug
...
Windows: fixes scanner bug for versions < win10
2024-06-23 11:08:39 +01:00
Mike Auty
7ece5fb1bf
Windows: Improve Virtmap error messages slightly
2024-06-23 00:16:32 +01:00
ikelos and GitHub
351db0e573
Merge pull request #1171 from Abyss-W4tcher/crash_layer_issue_509
...
fix #509 and simplify logic in crash layer _load_segments
2024-06-22 09:30:02 +01:00
David McDonald
898c0844c4
Windows: fixes scanner bug for versions < win10
...
This commit fixes a bug where the `layer_name` gets discarded when
constructing objects. Previously, it was assumed that we would not want
to construct an object for a module with a layer_name different from that
of the module. However, because we switch to scanning the memory layer on
samples where the version is < 10, but still construct kernel executive
objects based on the result of the memory layer scan, we actually do
sometimes need to specify a different layer.
2024-06-21 18:47:48 -05:00
atcuno
ed140e9ac4
placeholder
2024-06-20 13:06:43 -05:00
Abyss Watcher
c688744f66
revert useless for-else
2024-06-20 04:16:32 +02:00
Abyss Watcher
a68a482632
fix #509 and simplify logic in _load_segments
2024-06-20 04:00:20 +02:00
ikelos and GitHub
b187dd9686
Merge pull request #1165 from volatilityfoundation/notes_bleed_through
...
The notes variable is not reset for each VAD, allowing bleed through …
2024-06-15 10:51:46 +01:00
atcuno
59f6a05068
The notes variable is not reset for each VAD, allowing bleed through of a previously set note value to VADs enumerated afterwards
2024-06-14 16:45:54 -05:00
ikelos and GitHub
07794c7b29
Merge pull request #1164 from volatilityfoundation/fix_ads_rendering
...
Prevent backtrace in ADS scanning when contents cannot be recovered. …
2024-06-14 00:11:36 +01:00
atcuno
04ca0214eb
Prevent backtrace in ADS scanning when contents cannot be recovered. Fix missing parantheses as well as format_hints call on bad value
2024-06-13 15:24:32 -05:00
Mike Auty
0ee3573be2
Revert "Intel layer: Fix. This if statement will never be executed unless "minimum_address > maximum_address" which doesn't make sense to me."
...
This reverts commit e5a5b89577
2024-06-12 23:14:45 +01:00
ikelos and GitHub
0808e873fa
Merge pull request #1141 from gcmoreira/layers_several_fixes
...
Layers - Several fixes around maximum_address and chunk sizes
2024-06-11 23:15:18 +01:00
ikelos and GitHub
05ba1f9f8f
Merge pull request #1160 from eve-mem/windows_ldrmodules_issue_1158
...
Windows: ldrmodules update exception handling to InvalidAddressException
2024-06-11 23:02:42 +01:00
Eve
e4aac0c976
Windows: ldrmodules update exception handling to InvalidAddressException
2024-06-10 11:30:15 +01:00
Gustavo Moreira
77fb0b7b26
Update the output filename (preferred_filename) so that we can notify it correctly to the user
2024-06-10 18:37:38 +10:00
Gustavo Moreira
ab84070df3
Revert "Store the real/final output filename so that we can notify it correctly to the user"
...
This reverts commit d7aae3a982
2024-06-10 17:25:05 +10:00
Gustavo Moreira
a72062f288
Revert "LayerWriter plugin: Fix --output argument. It's referenced in the code but never mentioned as a requirement"
...
This reverts commit 6d22347ce6
2024-06-10 17:20:47 +10:00
ikelos and GitHub
543a39485b
Merge pull request #1149 from volatilityfoundation/getcellroutine
...
Add a new getcellroutine plugin that reports hooked GetCellRoutine ha…
2024-06-09 23:21:35 +01:00
ikelos and GitHub
faadfab481
Merge pull request #1151 from volatilityfoundation/feature/linux-replace-intunsignedlong
...
Linux: Replace uses of specific types with the more generic pointer
2024-06-09 23:20:04 +01:00
ikelos and GitHub
7c2eca4932
Merge pull request #1150 from volatilityfoundation/feature/vmscan
...
Generic: Add vmscan plugin
2024-06-09 23:17:57 +01:00
Mike Auty
771ed10b44
Core: Bump to 2.7.1
2024-05-29 20:44:04 +01:00
Mike Auty
35122df27d
Infra: Upgrade deprecated githubs actions 2
2024-05-29 20:42:25 +01:00
Mike Auty
57b3a99a1e
Infra: Upgrade deprecated githubs actions
2024-05-29 20:40:44 +01:00
Mike Auty
08493e9c3a
Automagic: Do some slight gymnastics to get the true value of the pointer
2024-05-21 23:13:31 +01:00
Mike Auty
c6d207d170
Generic: Fix code scanning issue with vmscan
2024-05-21 09:06:01 +01:00
Mike Auty
c5a45f91fc
Linux: Replace uses of specific types with the more generic pointer
2024-05-20 21:09:00 +01:00
Mike Auty
3eab0671b4
Generic: Add vmscan plugin
2024-05-20 20:47:12 +01:00
atcuno
901b0fd6ba
Fix year in header
2024-05-19 15:11:06 -05:00
atcuno
bc8666b64a
Fixes for black
2024-05-19 14:24:53 -05:00
atcuno
4ed7d40ecb
Fixes for black
2024-05-19 14:23:21 -05:00
atcuno
47eb42204e
Fixes for black
2024-05-19 14:21:03 -05:00
atcuno
c2b2321622
Add a new getcellroutine plugin that reports hooked GetCellRoutine handlers of memory mapped Windows registry hives
2024-05-19 14:09:14 -05:00
ikelos and GitHub
dc7a3878fa
Merge pull request #1147 from eve-mem/windows_handles_debug_logging
...
Windows: add extra debugging messages to handles plugin
2024-05-16 23:09:24 +01:00
Eve
5d5fa96e36
Windows: add extra debugging messages to handles plugin, ref #1146
2024-05-16 09:19:59 +01:00
ikelos and GitHub
1b3ba6ab2e
Merge pull request #1145 from volatilityfoundation/handles_bad_read_check
...
Correctly check for a failed read
2024-05-09 22:37:15 +01:00
atcuno
2b165a56be
Fix pre-existing formatting issue from black checks
2024-05-09 14:53:24 -05:00
atcuno
4c937a922d
Correctly check for a failed read
2024-05-09 14:47:56 -05:00
ikelos and GitHub
1c4fd269d0
Merge pull request #1144 from volatilityfoundation/timerliner_missing_macb_times_fix
...
Add a default 0 value to macb columns to avoid mactime not reporting …
2024-05-09 16:35:40 +01:00
atcuno
3933061551
Add a default 0 value to macb columns to avoid mactime not reporting timeline entries
2024-05-09 09:17:32 -05:00
ikelos and GitHub
a66aa02050
Merge pull request #1143 from volatilityfoundation/dumpfiles_dump_only_once_per_file_object
...
Prevent duplicate processing of the same file object
2024-05-08 21:26:45 +01:00
