WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-23 14:42:25 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,318 Commits 80 Branches 17 Tags
5166bcbe95384faaa66a4e2e880afb727292fe98
Commit Graph
205 Commits
Author SHA1 Message Date
Steffi Keeneandikelos 5166bcbe95 Memdump and memmap running/tested with grrcon-0a7030d.imh 2020-08-12 20:56:15 +01:00
Steffi Keeneandikelos 2e765c7d70 working with grrcon- 2020-08-12 20:56:15 +01:00
Steffi Keeneandikelos 1c58043004 memdump running but not tested 2020-08-12 20:56:15 +01:00
Steffi Keeneandikelos 1472048b41 testing memmap 2020-08-12 20:56:15 +01:00
AsafEitaniandikelos f7b456a703 Update strings.py 2020-08-12 14:57:57 +01:00
AsafEitaniandikelos 67c515f38d Improved strings efficiency 
1. Replaced readlines() with readline() to prevent loading the entire strings file to memory all at once.
2. Added process callback to indicate the progression.
3. Converted the re.compile of strings parse_line to global in order to prevent compilation for each line.
4. Changed the regex to not include the trailing newline (\n)
 2020-08-12 14:57:57 +01:00
Mike Auty 0b392f5186 Windows: Add a version to the info plugin now its got classmethods 2020-08-05 11:47:04 +01:00
Mike Auty ccd9a2836c Windows.info: Refactor windows.info as classmethods 2020-07-30 23:25:47 +01:00
Mike Auty bbaf4f22d6 Plugins: Remove unnecessary dependency for yarascan 2020-07-29 20:18:03 +01:00
Mike Auty 3eb463475b Core: Refactor versioning and associated requirements 2020-07-29 20:18:03 +01:00
Mike Auty 2c39489790 Yarascan: Move most of yarascanning into a versionable plugin 
This refactors common yara tasks, so we can use the plugin versioning to
keep track of changes to the YaraScanner class.
 2020-07-29 20:18:03 +01:00
Mike Auty 54b62709d1 Hashdump: Reformat and convert to proper byte handling 2020-07-28 20:49:27 +01:00
Jack Wengerandikelos 465a7ca6ad Added documentation and logging 2020-07-28 17:59:57 +01:00
Jack Wengerandikelos 72bc40ee69 added hashdump 2020-07-28 17:59:57 +01:00
Mike Auty 9295f41586 Plugins: Convert existing plugins over to use a list for PIDs 2020-07-23 02:02:01 +01:00
Mike Auty 31600254b9 Codebase: Apply yapf across the codebase. 2020-07-23 01:31:41 +01:00
Janandikelos e5d51eb9b7 adds dynamic length of pool header alignments 2020-07-17 18:07:23 +01:00
Mike Auty af1b8c03e7 Renderer: Rename StrLike to MultiTypeData 2020-07-16 19:44:18 +01:00
Dave Lassalleandikelos 42a97dd10c Registry: handle ints, multi strings, and binary data with StrLike 2020-07-16 19:44:18 +01:00
Mike Auty ecddc40781 Printkey: Bump the required framework version due to the API changes. 2020-07-16 19:44:18 +01:00
Mike Auty a5fc7323ec Registry: Don't make assumptions about the default 2020-07-16 19:44:18 +01:00
Mike Auty 5571f19b09 Registry: Move StringLike from conversion to StrLike format_hint. 2020-07-16 19:44:18 +01:00
Mike Auty 1b774bc69d Yarascan: Bump plugin to include rule name (issue/PR #253) 
In order to try to version control the scanner, a version number was
added to the yarascan plugin along with a method for calling the
scanner.
 2020-07-13 10:52:04 +01:00
Michael Lighandikelos 87ff6dd87c refs #200 raise ValueError if an object doesn't have a name 2020-07-01 20:51:22 +01:00
Mike Auty 0ffe318cb0 Project: Update copyright headers for files added in 2020. 2020-06-10 21:13:37 +01:00
superponibleandikelos 69be2157fb fix typo 2020-05-27 23:16:18 +01:00
superponibleandikelos 48e33c2b98 create property for HiveGenerator invalid member 2020-05-27 23:16:18 +01:00
Mike Auty a0da5fef83 Issue #186: Rebase and apply yapf 2020-05-27 23:16:18 +01:00
superponibleandikelos 36c19735ee issue #186 - hivelist with new hivescan/bigpools 2020-05-27 23:16:18 +01:00
superponibleandikelos 002758c7f2 issue #186 - hivescan and hivelist with bigpools 2020-05-27 23:16:18 +01:00
superponibleandikelos a21ab89019 issue #186 - add bigpools plugin 2020-05-27 23:16:18 +01:00
superponibleandikelos 054d144f9b issue #186 - walk forward, backward, scan if needed 2020-05-27 23:16:18 +01:00
superponibleandikelos a4301afe22 issue #186 - skip type check on CMHIVE 2020-05-27 23:16:18 +01:00
Mike Auty 0c43beb42d Core: Apply yapf across all files again. 2020-05-05 22:14:33 +01:00
Mike Auty edecd64703 Yarascan: Fixes #209 by returning matched strings 2020-04-14 23:45:08 +01:00
Michael Ligh d5bdf9633d refs #204 fix modscan, _LDR_DATA_TABLE_ENTRY is not an executive object and doesn't have an object_type 2020-04-07 09:22:52 -05:00
Mike Auty bd2a382d88 CLI & windows.handles: Improve exception handling 2020-03-16 22:34:03 +00:00
Mike Auty 77be83edc4 Layers: Change mapping signature to return domain length 2020-03-04 20:29:42 +00:00
Mike Auty f00453e366 Procdump: Remove redundant line as caught by @iMHLv2 2020-01-22 19:49:11 +00:00
Michael Lighandikelos 1d7da6402b svcscan cleanup: win10 before 15063 uses win8 types 2020-01-22 19:23:30 +00:00
Mike Auty 9fe6e6ba37 registry: Add the hivedump plugin 2020-01-17 17:22:04 +00:00
Mike Auty 2d408491bd Printkey: Slightly improve subkey name determination. 2020-01-15 02:19:12 +00:00
Mike Auty 3f5b96f3c7 Yapf: Clean-up the whole codebase. 2020-01-14 15:44:07 +00:00
Mike Auty b7ba877727 procdump: Enure proc_id is defined. 2020-01-14 15:36:54 +00:00
doomedravenandikelos 07b94abc1e Update procdump.py 2020-01-14 10:52:05 +00:00
doomedravenandikelos cdc0835863 Update procdump.py 2020-01-14 10:52:05 +00:00
doomedravenandikelos e4d7b7975f expose process_dump to other plugins 2020-01-14 10:52:05 +00:00
iMHLv2andGitHub f7cc94a244 Merge pull request #168 from volatilityfoundation/issue-10-vad-protection-layer 
Use a kernel layer to read vad protection constants
 2020-01-04 10:02:59 -06:00
Michael Ligh b7b6c44eab remove unused variable in vaddump.py 2020-01-04 09:35:51 -06:00
Mike Auty d2daa12564 Malfind: Rename the layer_name parameter to be more descripttive 2020-01-03 22:12:04 +00:00