WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-29 11:19:40 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,819 Commits 80 Branches 17 Tags
534f9be1276fbbdf79a7eb59cd4829713976a79e
Commit Graph
3819 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
ikelosandGitHub 534f9be127 Merge pull request #928 from eve-mem/linux_maple_tree 
Add basic support for Linux maple tree struct
 2023-05-10 11:06:44 +01:00
ikelosandGitHub e4db77d20a Merge pull request #942 from gcmoreira/mountinfo_fixes 
Mountinfo fixes
 2023-05-10 11:03:32 +01:00
Gustavo Moreira 7516346b64 Adjust framework versioning 2023-05-10 10:55:19 +02:00
Eve b3c348820f Linux: apply black v23.3.0 formating to volatility3/framework/symbols/linux/__init__.py 2023-05-10 09:18:05 +01:00
Eve 834372a6f8 Linux: apply black v23.3.0 formating to volatility3/framework/symbols/linux/extensions/__init__.py 2023-05-10 09:12:03 +01:00
Eve 7f9afccf6f Linux: apply black formating to maple tree parsing 2023-05-10 08:49:46 +01:00
Gustavo Moreira 89ed65cc56 Improve filter warning implementation 2023-05-09 09:59:21 +02:00
Gustavo Moreira 6c5db21ae7 Undo mnt_ns_id cast to str 2023-05-09 09:22:02 +02:00
Gustavo Moreira d367b973a5 Renamed get_vmlinux_from_volobj() to get_module_from_volobj_type() 2023-05-09 09:05:37 +02:00
Eve a2906ad270 Linux: Update comments and var names for maple tree depth warnings 2023-05-09 07:07:39 +01:00
Eve 8594824459 Linux: Ensure that objects made when parsing maple tree use the native_layer_name 2023-05-09 06:47:07 +01:00
Gustavo Moreira de28b5ab70 Rollback explicit context 2023-05-08 19:59:53 +02:00
Gustavo Moreira 7d65c20cc0 Fix f-string 2023-05-08 14:59:58 +02:00
Gustavo Moreira 200099f8b3 Improve support for socket filters in kernels < 4.1.52 2023-05-08 14:58:51 +02:00
Gustavo Moreira ced6ff346c Apply 'Black' suggestions 2023-05-08 11:54:48 +02:00
ikelosandGitHub 778df1a550 Merge pull request #948 from paulkermann/feature/modules_name_flag 
Added modules name flag
 2023-05-08 08:47:05 +01:00
Paul Kermann c40b3a043f CR fixes 2023-05-08 05:07:19 +03:00
Gustavo Moreira a09f77897b sockstat improvements: 
+ Fixes issues with netlink sockets for older kernels, supporting now kernels < 3.7.10
+ Fixes issue with network namespace id for older kernels.
 2023-05-06 14:21:58 +02:00
Gustavo Moreira 2d922a8cd6 Improves the way the mount points and the namespaces are filtered. 
Previously, it was filtering by mount namespaces id. Even that approach was working as expected, it's not viable for older kernels were there was not a mount namespace ID. With this changes we filtered the mount points individually by the mount ID which is unique system wide, no mather the namespace to which it belongs to.
 2023-05-06 14:18:33 +02:00
Gustavo Moreira 7063e60944 mountinfo improvements: 
+ Fixes issue with repeated path suffixes.
+ Adds support for older kernels (<3.3.8) and
+ Adds a function which simplify the way the framework internally can gets a context and a vmlinux.
This is obtaining the context and symbol space from the same vol object instead of drag a context everywhere.
This changes also affects other plugins such as elfs, malfind and proc.maps.
It also adds doc strings to some of the existent functions.
 2023-05-06 14:12:09 +02:00
Paul Kermann 8952c6c985 formatting 2023-05-04 15:18:37 +03:00
Paul Kermann 9249758dde formatting 2023-05-04 15:15:23 +03:00
Paul Kermann 1ad8c950da Added modules name flag 2023-05-04 13:47:57 +03:00
ikelosandGitHub 8788390424 Merge pull request #947 from cpuu/bug-fix 
Bug fix (2.4.2 / URIRequirement)
 2023-05-04 10:00:44 +01:00
cpuuandGitHub c9e0b6695f Update index.rst 2023-05-04 12:52:16 +09:00
cpuuandGitHub 14f449367d Delete getting-started-macos-tutorial.rst 2023-05-04 12:52:00 +09:00
cpuuandGitHub 159e5a2fbd Fix requirements.URLRequirement to requirements.URIRequirement 
[Refactor] Fix requirements.URLRequirement to requirements.URIRequirement in single_location assignment
 2023-05-04 11:59:30 +09:00
cpuuandGitHub da6f2cf850 Merge branch 'volatilityfoundation:develop' into develop 2023-05-04 10:56:34 +09:00
ikelosandGitHub b6af37af2d Merge pull request #938 from volatilityfoundation/issues/issue937 
Improve handling of swap files
 2023-05-03 00:45:50 +01:00
ikelosandGitHub 73cd54cf8a Merge pull request #945 from digitalisx/fix/code-comment 
Add: help comment for windows plugins (`windows.crashinfo`, `windows.ldrmodules`, `windows.statistics`).
 2023-05-03 00:45:23 +01:00
Donghyun Kim c06836e45d Lint: black issue for windows.ldrmodules 2023-05-02 05:58:57 +09:00
Donghyun Kim 79cd3fe2fe Lint: black issue for windows.statistics 2023-05-02 05:57:56 +09:00
Donghyun Kim 77081d3f68 Add: code comment for plugins 2023-05-02 05:51:24 +09:00
Mike Auty 317f565685 Core: Renable the import protection for volatility3.framework.plugins 
In commit 21d916b (about 10 months ago) the logic for the warning about
volatility3.framework importing was disabled.  This re-enables it.

Also updates to support pyinstaller 5.10 function stack depth.

Closes #944
 2023-04-30 09:02:40 +01:00
Gustavo Moreira b2d33c2cb0 Check if 'mnt_namespace' has the 'ns' member before using it 2023-04-26 00:36:58 +10:00
Gustavo Moreira 33f54f8cf7 Replace LinuxUtilities._do_get_path() with the new mountinfo _do_get_path() avoiding duplicate code. It also fixes issue #930 2023-04-26 00:33:35 +10:00
Mike Auty a5e6c550e3 Automagic: Handle file swap locations and throw a warning if they don't exist 2023-04-16 13:30:55 +01:00
Mike Auty 58af80df3c Requirements: Shift location_from_file to the requirement from the CLI class 2023-04-16 13:29:41 +01:00
Mike Auty 900ab70452 Volshell: Mark the script as executable in the repo 2023-04-14 08:08:27 +01:00
Mike Auty ebb74e2f92 Core: Bump the copyright year of the README 2023-04-12 19:57:15 +01:00
ikelosandGitHub 66c37c3945 Merge pull request #898 from volatilityfoundation/feature/xen-coredump-support 
Layers: Add in Xen CoreDump format support
 2023-04-09 14:10:56 +01:00
ikelosandGitHub 467462ea0e Merge pull request #935 from digitalisx/fix/typo 
Fix: typo for `linux.iomem` plugin.
 2023-04-09 14:08:35 +01:00
Donghyun Kim 2e0ecdd770 Fix: typo for linux iomem plugin 2023-04-07 18:04:56 +09:00
ikelosandGitHub 3c31de8847 Merge pull request #934 from volatilityfoundation/issues/issue931 
Automagic: Update clear-cache and do removals first
 2023-04-06 09:22:57 +01:00
ikelosandGitHub 2ed7d0d45c Merge pull request #933 from volatilityfoundation/issues/issue932 
Plugins: Support yara-4.3.0 and above
 2023-04-05 14:12:51 +01:00
Mike Auty f33ea67e86 Automagic: Update clear-cache and do removals first 2023-04-04 23:57:35 +01:00
Mike Auty 41edab2309 Plugins: Support yara-4.3.0 and above 2023-04-04 23:23:27 +01:00
Mike Auty 60292c2da1 Linux: Fix slight issue in envvars renaming 2023-03-29 20:46:06 +01:00
Eve 089234671c Remove checks for leaf node in linux maple tree parsing, node type is enough. 2023-03-27 06:29:30 +01:00
Eve 89e477a068 Remove _parse_maple_tree_entry function and make parsing easier to read 2023-03-24 20:07:32 +00:00