David McDonald
57ef3f587e
Windows: Adds scheduled tasks plugin
...
This adds a plugin 'ScheduledTasks' that can decode binary-encoded
scheduled tasks from the Windows registry's SOFTWARE hive using a custom
reader that extends the `io.BytesIO` class. Decoding operations are
intended to be as fault tolerant as possible, swallowing exceptions and
returning `None` to account for smear or missing data.
Because each task can have mulitple triggers and multiple actions, a
single entry is generated for each trigger + action pair. In the event
that the either the actions could not be parsed or the triggers could
not be parsed due to missing or smeared data, an entry will still be
generated using the available information from the other registry value,
since trigger and action data is stored separately.
Much more information is decoded than is rendered, this was done
intentionally to avoid overpopulating the TreeGrid with less pertinent
data and to avoid an explosion of trigger and action-specific fields that
may not apply to most other entries.
2024-10-09 17:27:06 -05:00
ikelos and GitHub
4ffaad5a15
Merge pull request #1301 from gcmoreira/fix_black_stable_version
...
Fix black stable version issue with Python 3.8
2024-10-08 09:42:58 +01:00
Gustavo Moreira
384042202e
fix black stable version issue with Python 3.8
2024-10-08 18:37:32 +11:00
ikelos and GitHub
d1c5fc2ac1
Merge pull request #1299 from volatilityfoundation/1298-printkey-output-confusing-when-key-not-found
...
#1298 - include hive name in key path
2024-10-07 23:19:14 +01:00
ikelos and GitHub
64d55bf1a7
Merge pull request #1209 from dgmcdona/dgmcdona/windows-amcache
...
Windows: Adds Amcache plugin
2024-10-07 23:15:04 +01:00
ikelos and GitHub
5ff06fe1ef
Merge pull request #1272 from volatilityfoundation/816-port-cmdscan-and-console-plugins-from-vol2-to-vol3-please
...
#816 cmdscan and console
2024-10-07 23:13:19 +01:00
ikelos and GitHub
1409f472db
Merge pull request #1297 from volatilityfoundation/1296-sort-volshell-methods-alphabetically
...
refs #1296 sort volshell methods alphabetically in hh() output
2024-10-07 23:07:46 +01:00
ikelos and GitHub
eb74437dbe
Merge pull request #1263 from gcmoreira/linux_lsof_refactoring_fixes_and_improvements
...
Linux: Add support for threads in both lsof and sockstat plugins.
2024-10-07 23:04:24 +01:00
Mike Auty
9addf6bee8
Remove the old .style.yapf
...
This was used before we shifted to black permanently. It allowed
additional spacing between keyword arguments and their default values,
but it was inconsisnent and could get in a state where it would flip
between two weights, so every "fix" would then be "fixed" back again.
No longer feasible for a project of this size.
2024-10-07 22:57:57 +01:00
ikelos and GitHub
5c4e26865d
Merge pull request #1289 from dgmcdona/dgmcdona/linux-dentry-simple-dname
...
Linux: Properly get paths in simple_dname paths
2024-10-07 22:37:16 +01:00
Dave Lassalle
996875c059
#1298 - include hive name in key path
2024-10-07 16:13:12 -05:00
David McDonald
27ea555b37
Add product version to output columns
2024-10-07 13:54:30 -05:00
David McDonald
dec0d506f9
Fix type signature on get_name
2024-10-07 13:54:07 -05:00
David McDonald
e622acc7f8
Minor version bump: registry extensions API addition
2024-10-07 13:20:50 -05:00
David McDonald
e46d24397d
Code review fixes
2024-10-07 13:20:50 -05:00
David McDonald
f3f5784c71
Remove unused method
2024-10-07 13:17:24 -05:00
David McDonald
0bfac049de
Windows: Adds Amcache plugin
2024-10-07 13:17:24 -05:00
Dave Lassalle
1c3e5574f4
#816 - remove unused import
2024-10-07 12:39:58 -05:00
Dave Lassalle
95f56ad122
#816 - remove extra text from buffer output
2024-10-07 12:39:03 -05:00
Dave Lassalle
0dd082b7fd
#816 initial PR comment fixes
2024-10-07 12:26:17 -05:00
MHL
cb98a085d7
refs #1296 sort volshell methods alphabetically in hh() output
2024-10-07 09:11:49 -05:00
Gustavo Moreira
ee75964345
Linux: lsof plugin: Fix typo in docstring
2024-10-07 20:46:44 +11:00
Gustavo Moreira
2859d7a641
Linux: lsof plugin: Fix list_fds() return typing
2024-10-07 18:49:38 +11:00
Gustavo Moreira
bf19b9f2e0
Linux: lsof plugin: Fix dataclasses import to stick to the style guide
2024-10-07 18:46:18 +11:00
ikelos and GitHub
9477d16f1b
Merge pull request #1295 from eve-mem/linux_docs_lime_warning
...
Docs: Add warning around LiME raw format
2024-10-07 08:17:45 +01:00
Gustavo Moreira
bf02723695
Linux: lsof plugin: Fix module import to stick to the style guide
2024-10-07 17:59:55 +11:00
eve
5d072864d7
Docs: Add warning around LiME raw format
2024-10-07 07:00:44 +01:00
ikelos and GitHub
c13c76c745
Merge pull request #1274 from volatilityfoundation/issues/issue1119
...
Ensure the class for Modules is stored in the configruation
2024-10-06 20:13:04 +01:00
ikelos and GitHub
4149c551a9
Merge pull request #1293 from volatilityfoundation/1292-dumpfiles-uses-incorrect-sector-size-for-datasectionobject
...
#1292 - use correct sector size for DataSectionObject file dumping
2024-10-06 19:03:46 +01:00
ikelos and GitHub
9bda20df34
Merge pull request #1279 from dgmcdona/dgmcdona/linux-sockstat-pytest
...
Linux: Sockstat - adds pytest
2024-10-06 18:17:45 +01:00
ikelos and GitHub
c2feeecee3
Merge pull request #1259 from gcmoreira/linux_pagecache_pointer_verification_improvements
...
Linux Page Cache smear memory protection improvements
2024-10-06 18:07:48 +01:00
ikelos and GitHub
cd979804e0
Merge pull request #1285 from gcmoreira/remote_isf_url
...
Add --remote-isf-url argument to be able to use a remote ISF server from the command-line arguments
2024-10-06 16:57:02 +01:00
ikelos and GitHub
c67f2e51c1
Merge pull request #1284 from gcmoreira/fix_all_any_misuses
...
Fix misuse of all() and any() functions across the codebase
2024-10-06 16:41:51 +01:00
Dave Lassalle
bb5a447502
#1292 - use correct sector size for DataSectionObject file dumping
2024-10-05 09:58:01 -05:00
Gustavo Moreira
cffad872bb
Linux: sockstat. Fix #1271 which unnecessarily extends the interface of the list_sockets() class method
2024-10-04 12:22:53 +10:00
Gustavo Moreira
d7d84b4c7f
Merge branch 'develop' into linux_lsof_refactoring_fixes_and_improvements
2024-10-04 12:08:10 +10:00
David McDonald
4ac9b0825a
Linux: Properly get paths in simple_dname paths
...
Some dentry paths were not being recovered from `simple_dname` paths,
this fixes the issue by properly dereferencing the string pointer.
2024-10-03 10:59:59 -05:00
Gustavo Moreira
a64813be43
Added metavar and single letter argument to the --remote-isf-url
2024-10-02 13:08:05 +10:00
Gustavo Moreira
a63e9f1699
Add --remote-isf-url argument to be able mutually exclusive to --offline
2024-10-02 13:00:45 +10:00
Gustavo Moreira
c18818aa8d
Fix misuse of all() and any() functions across the codebase
2024-10-02 10:38:01 +10:00
ikelos and GitHub
72abb419cc
Merge pull request #1281 from eve-mem/linux_malfind_32bit_arch_detection
...
Linux: Update malfind plugin to use symbols.symbol_table_is_64bit when determining if a 32bit OS is detected in the sample
2024-10-02 00:07:20 +01:00
Mike Auty
950ab3e201
Add in additional microarchitectures for vmscan
2024-10-01 19:47:19 +01:00
Dave Lassalle
ece2dbe9a7
#816 formatting fixes
2024-10-01 13:00:15 -05:00
David McDonald
c0672f6c4b
Linux: Sockstat - adds pytest
...
This adds a pytest for the `linux.sockstat.Sockstat` plugin.
2024-10-01 10:02:25 -05:00
eve
ba351f511d
Linux: Update malfind plugin to use symbols.symbol_table_is_64bit when determining if a 32bit OS is detected in the sample
2024-10-01 06:36:56 +01:00
ikelos and GitHub
5d2a5f94d4
Merge pull request #1276 from dgmcdona/dgmcdona/windows-callbacks-validity-check
...
Windows: Callbacks - fixes bad callback validity check
2024-10-01 00:42:29 +01:00
ikelos and GitHub
c37d9eed1f
Merge pull request #1278 from dgmcdona/dgmcdona/linux-sockstat-version-bump-fix
...
Linux: Sockstat - fix incorrect version bump
2024-10-01 00:34:14 +01:00
David McDonald
db55f23070
Windows: Callbacks - fix breaking API change
...
Moves as much of the `is_parseable` check as possible back into an
`is_valid` method to avoid breaking API changes.
2024-09-30 17:03:12 -05:00
David McDonald
806f78d372
Linux: Sockstat - fix incorrect version bump
...
I erred when I bumped the version as a part of !1271 - The `SockHandlers`
class got the major version bump, not `Sockstat`. This reverts the
`SockHandlers` version bump and applies it to `Sockstat` instead.
2024-09-30 15:27:03 -05:00
David McDonald
8ad592a490
Windows: Fixes bad callback validity check
...
This fixes a bug in the callbacks plugin which causes it to miss
`IoRegisterShutdownNotification` callbacks on x86b samples. The
`header.NameInfo.Name` field was being incorrectly treated as the device
type. This fixes the issue by updating the `is_valid` method on the
`_SHUTDOWN_PACKET` extension type to take a `type_map` parameter, and
updates the method to correctly validate the object type.
2024-09-30 14:56:40 -05:00
David McDonald