Elad Levi
d449104d8b
removed unnecessary imports
2025-04-28 13:26:14 +00:00
Elad Levi
02634d0e30
oops
2025-04-28 12:54:46 +00:00
Elad Levi
533f96ec03
Added extended usage of pe_symbols
2025-04-28 12:53:46 +00:00
ikelos and GitHub
0c08b94547
Merge pull request #1793 from eve-mem/issue_1685
...
cli: add debug log of plugin version when the plugin is successfully constructed
2025-04-28 09:10:57 +01:00
eve
41142ef621
cli: add debug log of plugin version when the plugin is successfully constructed
2025-04-28 07:18:47 +01:00
ikelos and GitHub
8807e35cab
Merge pull request #1792 from volatilityfoundation/issues/update-codeql
...
Update codeql action from v2 to v3
2025-04-27 18:29:41 +01:00
Mike Auty
d3da34ce10
Update codeql action from v2 to v3
2025-04-27 16:18:47 +01:00
Mike Auty
f4a2c7aec2
Drop pycov requirement by 1 since github can't seem to find the most recent version
2025-04-27 15:02:12 +01:00
Mike Auty
bc265edcdc
Try to slightly loosen the pytest-cov requirement
2025-04-27 15:00:09 +01:00
Mike Auty
9c7655a635
Add in coverage recording to the test process
2025-04-27 14:56:17 +01:00
ikelos and GitHub
c6e8c0d4e8
Merge pull request #1783 from volatilityfoundation/bugfix/shimcache_tracebacks
...
Windows Shimcachemem: Fix tracebacks
2025-04-26 21:33:39 +01:00
ikelos and GitHub
577747f22c
Merge pull request #1789 from eve-mem/linux_issue_1603
...
Linux: update extensions used by kallsyms plugin to use utility.pointer_to_string fix issue #1603
2025-04-26 20:30:34 +01:00
eve
2d80f4680e
Linux: update kernel_symbol extensions _do_get_name and _do_get_namespace to use errors='ignore' to match previous implimentation
2025-04-25 16:52:48 +01:00
eve
2d1acaca51
Linux: update extensions used by kallsyms plugin to use utility.pointer_to_string
2025-04-25 16:40:06 +01:00
eve
7cfc03da5d
Linux: update sockscan to use minor version for the requirements this has been tested with
2025-04-25 12:13:16 +01:00
eve
6f11161bd5
Linux: add MultiStringScanner requirement for sockscan
2025-04-25 11:59:43 +01:00
eve
0d32cac067
Linux: fix sockscan use of direct imports of TreeGrid and NotAvailableValue
2025-04-25 11:58:29 +01:00
eve
ab5dac10d9
Linux: fix virtual to physical offsets for sockscan file_ops method
2025-04-25 11:54:55 +01:00
Mike Auty
b5c98a080a
Fix a default value being mutable
2025-04-25 11:31:45 +01:00
eve
787f3b629a
Revert "Linux: sockstat contiuned work to breakdown large generator function"
...
This reverts commit d532f37454
2025-04-25 11:10:05 +01:00
Elad Levi and GitHub
a167ddc04d
Update etwpatch.py
2025-04-24 20:51:02 +03:00
Elad Levi and GitHub
31184afe85
Update etwpatch.py
2025-04-24 20:48:59 +03:00
Elad Levi and GitHub
6ac76b27ff
Update etwpatch.py
2025-04-24 20:47:08 +03:00
Elad Levi and GitHub
e25e23d8cf
Create etwpatch.py
2025-04-24 20:46:19 +03:00
eve
d532f37454
Linux: sockstat contiuned work to breakdown large generator function
2025-04-24 09:37:39 +01:00
eve
704f0f023d
Linux: Fix incorrect first parameter name in test_linux_sockscan
2025-04-24 09:35:04 +01:00
eve
ca584cce74
Linux: Update linux sockscan to work with SockHandlers v4.0.0
2025-04-24 09:23:21 +01:00
eve
e55ab3313f
Linux: update tests for sockscan
2025-04-24 09:16:23 +01:00
eve
1a57a66ce6
Linux: update sockstat ruff issue with f-string using no placeholders
2025-04-24 09:11:36 +01:00
eve
5e549b2d92
Linux: update sockstat requirements
2025-04-24 09:10:51 +01:00
Eve and GitHub
40144e7c71
Merge branch 'develop' into linux_sockscan
2025-04-24 09:05:26 +01:00
95c54351f0
Update volatility3/framework/plugins/linux/sockscan.py
...
Co-authored-by: ikelos <ikelos@users.noreply.github.com >
2025-04-24 09:01:53 +01:00
0fbe03912e
Update volatility3/framework/plugins/linux/sockscan.py
...
Co-authored-by: ikelos <ikelos@users.noreply.github.com >
2025-04-24 09:01:42 +01:00
dcded3a1fc
Update test/test_volatility.py
...
Co-authored-by: ikelos <ikelos@users.noreply.github.com >
2025-04-24 09:00:50 +01:00
David McDonald
bceae67d43
Windows Handles: Update dependents
...
This updates the plugins that depend on `Handles` with the correct
required version number, as well as calls to the new handles
classmethods where needed.
2025-04-23 11:33:58 -05:00
David McDonald
bb91d688cb
Windows Handles: Convert to classmethods
...
A lot of functionality in this plugin class was using instance methods
instead of classmethods; this refactors the plugin to use classmethods
instead of instance methods for consistency with the rest of the
framework, and bumps the plugin major version to 4.0.0.
2025-04-23 11:33:58 -05:00
David McDonald
2641e5fc41
ShimcacheMem: Fix exc getting module name
...
`module.BaseDll.String` can raise an `InvalidAddressException`, this
catches it and continues through the loop.
2025-04-21 15:50:57 -05:00
Dave Lassalle
094ba8e269
#1780 - black and ruff fixes
2025-04-17 16:44:22 -05:00
Dave Lassalle
4d19181848
#1780 - add LoadCount to dlllist output
2025-04-17 16:42:17 -05:00
ikelos and GitHub
63f7cbd447
Merge pull request #1779 from j-t-1/svcdiff
...
Amend SvcDiff comments at top of file
2025-04-17 21:10:31 +01:00
j-t-1 and GitHub
ff5d736f94
Amend SvcDiff comments at top of file
...
Previously contained information about Skeleton_Key_Check, change this to be about SvcDiff.
2025-04-17 20:35:38 +01:00
ikelos and GitHub
fa73298e0f
Merge pull request #1579 from volatilityfoundation/feature/coding-style
...
Feature/coding style
2025-04-16 10:19:26 +01:00
ikelos and GitHub
65a02d961e
Merge pull request #1764 from volatilityfoundation/issues/make-quickstart-quicker
...
Documentation: Improve the readme to make quickstart the first thing …
2025-04-16 10:18:22 +01:00
ikelos and GitHub
6eb95ca4dc
Merge pull request #1778 from Abyss-W4tcher/qemu_layer_incomplete_requirements
...
Make QEMU layer call parent's requirements
2025-04-15 23:50:44 +01:00
Abyss Watcher
4c6188766c
black
2025-04-15 23:05:00 +02:00
Abyss Watcher
330e19f159
call parent get_requirements()
2025-04-15 23:04:49 +02:00
David McDonald
85ec26db91
Shimcachemem: Changes absent value return type
...
This is more appropriately set to `renderers.UnreadableValue` since it
is set when an `exceptions.InvalidAddressException` occurs.
2025-04-15 15:55:52 -05:00
David McDonald
4ce173e87a
ShimcacheMem: Fix traceback in extension method
...
When performing the attribute checks for ListFlags.BlobBuffer, a pointer
dereference occurs implicitly that can trigger an
`exceptions.InvalidAddressException`. This wraps the checks in a
try/except block, and sets the value of `_exec_flag` to
`renderers.UnreadableValue` if one occurs.
2025-04-15 15:52:54 -05:00
ikelos and GitHub
2a16bf19d1
Merge pull request #1777 from volatilityfoundation/fix_thrdscan_tracebacks
...
ThrdScan: Fix tracebacks + filtering
2025-04-15 20:08:42 +01:00
David McDonald
b04a498cd7
ThrdScan: Fix process filtering
...
This check was both causing an `InvalidAddressException` due to the
member access, while at the same time not being a useful check, since it
prevents VADs from being mapped in children of the `System` process.
2025-04-15 13:40:04 -05:00
Elad Levi