WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-24 15:12:23 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,318 Commits 80 Branches 17 Tags
5166bcbe95384faaa66a4e2e880afb727292fe98
Commit Graph
1801 Commits
Author SHA1 Message Date
Steffi Keeneandikelos 5166bcbe95 Memdump and memmap running/tested with grrcon-0a7030d.imh 2020-08-12 20:56:15 +01:00
Steffi Keeneandikelos 2e765c7d70 working with grrcon- 2020-08-12 20:56:15 +01:00
Steffi Keeneandikelos 1c58043004 memdump running but not tested 2020-08-12 20:56:15 +01:00
Steffi Keeneandikelos 1472048b41 testing memmap 2020-08-12 20:56:15 +01:00
Mike Auty c1f6c224d7 Symbols: Resolve symbols returned from symbol_space.get_symbol 
This ensures that ReferenceTemplates are not returned from a call to
symbol_space.get_symbol.  This is in keeping with the get_type method.

The symbol_space containing all symbol tables has visibility of all
tables and can cross-resolve amongst them.  Asking a specific table
for a type may result in a ReferenceTemplate.  This feels like a
better solution than having individual tables ask their parent space
to fill in the details of sibling tables.

Fixes #279.
 2020-08-12 20:39:33 +01:00
AsafEitaniandikelos f7b456a703 Update strings.py 2020-08-12 14:57:57 +01:00
AsafEitaniandikelos 67c515f38d Improved strings efficiency 
1. Replaced readlines() with readline() to prevent loading the entire strings file to memory all at once.
2. Added process callback to indicate the progression.
3. Converted the re.compile of strings parse_line to global in order to prevent compilation for each line.
4. Changed the regex to not include the trailing newline (\n)
 2020-08-12 14:57:57 +01:00
Mike Auty 03d69204f3 Documentation: Add in using volatility as a library 2020-08-10 22:17:40 +01:00
Matt Tresslerandikelos 2467e3986d added address mask to fix issue with kernel tracking 2020-08-06 18:12:42 +01:00
Matt Tresslerandikelos eb2d7715ce fixed poor variable name, removed unnecessary code 2020-08-06 18:12:42 +01:00
Matt Tresslerandikelos 8f7171ac5f fix copyright year 2020-08-06 18:12:42 +01:00
Matt Tresslerandikelos d7619d6170 created linux_check_idt; plugin currently is not finding the module names for each entry in idt table 2020-08-06 18:12:42 +01:00
Mike Auty 0b392f5186 Windows: Add a version to the info plugin now its got classmethods 2020-08-05 11:47:04 +01:00
Mike Auty 2166834d87 Timeliner: Actually make use of the TextIoWrapper 2020-08-03 20:36:40 +01:00
Mike Auty cbea698ab0 Timeliner: Sort results and provide a filter 
Sorts the results (as stated).  Note that user interfaces may decide to
sort their results in an order of their choosing.

Also added a parameter that can be provided multiple times to only allow
plugins that match (any of) the parameters provided.
 2020-08-03 20:13:25 +01:00
Mike Auty a339fd0783 Linux: Fix keyboard_notifiers copyright year 2020-08-03 17:05:41 +01:00
Mike Auty 556c880c90 Codebase: Ensure all conversions to bytes handle unicode 
All conversions using `latin-1` have been converted to
`raw_unicode_escape` which is like `latin-1`, but handles unicode
characters appropriately (with a `\u` prefix).

Since this is like `latin-1` it should have no impact on things that ran
previously, but those that would fail with a unicode error now will
present an encoded unicode string.  There may be situations where the
binary representation of unicode would be better (timeliner file
output?), but those can be changed when/if it's determined necessary.

Fixes #274.
 2020-08-03 16:53:48 +01:00
Mike Auty ff32383f82 Yapf: Minor reformats for recent plugins 2020-08-03 16:33:10 +01:00
mtresslerandikelos 2e6dc851d3 removed extra whitespace 2020-08-03 16:30:09 +01:00
Matt Tresslerandikelos 0452f69f82 created keyboard_notifiers 2020-08-03 16:30:09 +01:00
Mike Auty f5f9ee7292 Linux: Fix plugin case and re-run yapf 2020-07-31 00:28:21 +01:00
Mike Auty ccd9a2836c Windows.info: Refactor windows.info as classmethods 2020-07-30 23:25:47 +01:00
Matt Tresslerandikelos 8beac1d67d fixed bug causing no output when tty_check is run 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos 71dc85ade5 removed debugging print statements 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos 34ff856a79 Updated imports to reflect new location of utility class; plugins are no longer outputing anything so commiting for Andrew to take a look at 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos 355c25fefb added parameter type to generate_kernel_handler_info 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos ddec0d482d added kernel string to linux constants file; changed automagic methods so that they reconstruct the kernel object within the method for consistancy with other methods 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos b9f5450ac3 added docs to automagic methods, fixed missing return types, changed parameters to be more specific 2020-07-30 23:24:23 +01:00
mtresslerandikelos d61034bca8 Removed unnecessary code from tty_check.py 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos 314b6aa2c6 added some documentation 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos 44911bf54a Fixed tty_check not finding the ttyhook module 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos 512cc8b451 fixed some formatting for tty_check.py 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos ec8e9161bf created tty_check.py; edited automagic/linux.py to add kernel tracking abilities 2020-07-30 23:24:23 +01:00
Mike Auty 03877ef2ec Core: Maintain 3.5.3 compatibility 2020-07-30 22:27:26 +01:00
Mike Auty b04fd7c9bd Objects: Update enumeration method to is_valid_choice 2020-07-29 20:25:34 +01:00
Mike Auty 180eee569f Objects: Add a convenience function for validating enum values 2020-07-29 20:25:34 +01:00
Mike Auty bbaf4f22d6 Plugins: Remove unnecessary dependency for yarascan 2020-07-29 20:18:03 +01:00
Mike Auty a5ecae29cc Configuration: Improve the VersionableInterface documentation 2020-07-29 20:18:03 +01:00
Mike Auty 3eb463475b Core: Refactor versioning and associated requirements 2020-07-29 20:18:03 +01:00
Mike Auty 2c39489790 Yarascan: Move most of yarascanning into a versionable plugin 
This refactors common yara tasks, so we can use the plugin versioning to
keep track of changes to the YaraScanner class.
 2020-07-29 20:18:03 +01:00
Mike Auty faaa3bf6d8 Caching: Only cache remote files 2020-07-28 21:03:16 +01:00
Mike Auty 123e9bc8a3 Registry: Fix error message 2020-07-28 20:49:53 +01:00
Mike Auty 54b62709d1 Hashdump: Reformat and convert to proper byte handling 2020-07-28 20:49:27 +01:00
Andrew Case dec13f5082 Linux - stash the Linux kernel virtual address 2020-07-28 13:16:40 -05:00
Jack Wengerandikelos 465a7ca6ad Added documentation and logging 2020-07-28 17:59:57 +01:00
Jack Wengerandikelos 72bc40ee69 added hashdump 2020-07-28 17:59:57 +01:00
Andrew Caseandikelos 75d4390255 Remove extra debug prints 2020-07-28 17:00:20 +01:00
Mike Auty 8481406488 Linux: Support stashing the KASLR 2020-07-28 17:00:20 +01:00
Mike Auty a4b50d183d Mac: Stash the verified ASLR shift and improve logging 2020-07-28 17:00:20 +01:00
Andrew Caseandikelos f6a1b28424 First attempt and better DTB and ASLR validation. Debugging statements left in. 2020-07-28 17:00:20 +01:00