David McDonald and Andrew Case
5cbc07887c
Windows PsList: Add method for listing procs from kernel
...
This adds a new classmethod, `list_processes_from_kernel`, updates the
`list_processes` method signature to use only the kernel module name and
the context instead of splitting information about the kernel between
the layer_name and symbol_table_name paramters, and does a major version
number increase on the plugin.
Also updates the documentation to reflect pslist method signature
change.
Co-authored-by: Andrew Case <andrew@dfir.org >
2025-03-05 17:59:38 -06:00
David McDonald
59919dc1da
Windows: Adds GUI plugin
2025-03-05 17:59:38 -06:00
David McDonald
319edbb486
Windows: Adds windows OS version checks
2025-03-05 17:59:38 -06:00
David McDonald
b92247fe32
Windows: Adds windows GUI vtypes
2025-03-05 17:59:38 -06:00
ikelos and GitHub
caa52c08d3
Merge pull request #1670 from volatilityfoundation/fix_module_enum
...
Avoid smear in module enumeration paths
2025-03-05 23:43:34 +00:00
Andrew Case
437c611cb9
Avoid smear in module enumeration paths
2025-03-05 23:45:38 +00:00
ikelos and GitHub
453b2f6f9e
Merge pull request #1664 from volatilityfoundation/fix_psaux_env_decode
...
Correctly use decode with replace to avoid backtraces on partially sm…
2025-03-05 23:42:12 +00:00
ikelos and GitHub
7c17d3b6ea
Merge pull request #1669 from volatilityfoundation/fix_node_access
...
Prevent backtraces when the node head is smeared
2025-03-05 23:41:17 +00:00
ikelos and GitHub
96604fb586
Merge pull request #1668 from volatilityfoundation/fix_keyboard_notifiers
...
Gracefully terminate the plugin when the keyboard notifier list head …
2025-03-05 23:40:47 +00:00
ikelos and GitHub
0bea7e2604
Merge pull request #1667 from volatilityfoundation/fix_slot_access
...
Ensure slot address is valid inside of array
2025-03-05 23:40:02 +00:00
ikelos and GitHub
be1e933a90
Merge pull request #1666 from volatilityfoundation/elf_parsing_decode_fix
...
Properly decode values from ELF files even with partial smear
2025-03-05 23:39:35 +00:00
ikelos and GitHub
993f664797
Merge pull request #1665 from volatilityfoundation/fix_netfilter
...
Prevent backtraces in netfilter due to smear
2025-03-05 23:38:56 +00:00
Andrew Case
56d7398fe5
Prevent backtraces when the node head is smeared
2025-03-05 23:25:52 +00:00
Andrew Case
3141a741eb
Gracefully terminate the plugin when the keyboard notifier list head is paged out
2025-03-05 23:21:21 +00:00
Andrew Case
86fa9d8556
Ensure slot address is valid inside of array
2025-03-05 23:15:14 +00:00
Andrew Case
bfab5bfd23
Properly decode values from ELF files even with partial smear
2025-03-05 23:11:37 +00:00
Andrew Case
86ef99f57a
Properly decode values from ELF files even with partial smear
2025-03-05 23:10:27 +00:00
Andrew Case
e5b0c84532
Prevent backtraces in netfilter due to smear
2025-03-05 23:05:36 +00:00
Andrew Case
6036cbd3e0
Correctly use decode with replace to avoid backtraces on partially smeared strings
2025-03-05 22:42:07 +00:00
ikelos and GitHub
ced9e15b0c
Merge pull request #1663 from volatilityfoundation/fix_check_idt
...
Fix several bugs in IDT verification for Linux
2025-03-05 22:32:07 +00:00
Andrew Case
4d7f1ea311
Fix several bugs in IDT verification for Linux
2025-03-05 22:33:53 +00:00
ikelos and GitHub
6654ba9446
Merge pull request #1660 from Abyss-W4tcher/bump_ubuntu_runner_to_22_04
...
Bump GitHub runner to Ubuntu 22.04
2025-03-05 21:28:12 +00:00
ikelos and GitHub
df097bf4cd
Merge pull request #1658 from volatilityfoundation/fix_tty_check
...
Correctly check tty instance to avoid backtrace
2025-03-05 21:15:55 +00:00
ikelos and GitHub
d0805b1400
Merge pull request #1657 from volatilityfoundation/useful_error_message
...
Report the memer name and type when attributes cannot be found
2025-03-05 21:14:59 +00:00
ikelos and GitHub
54b70b0fd4
Merge pull request #1654 from volatilityfoundation/fix_vma_iteration
...
Fix bugs in Linux memory region enumeration
2025-03-05 21:09:14 +00:00
ikelos and GitHub
b68b6817e8
Merge pull request #1653 from volatilityfoundation/kmsg_fixes
...
Fix crash-causing bugs. Add typing where possible.
2025-03-05 21:07:54 +00:00
Abyss Watcher
22594847d2
ubuntu 20.04 unsupported on 01/04/2025
2025-03-04 17:36:40 +01:00
Abyss Watcher
8b634e49e1
ubuntu 20.04 unsupported on 01/04/2025
2025-03-04 17:25:09 +01:00
Andrew Case
d2f16dc0f4
Correctly check tty instance
2025-03-01 15:03:18 -06:00
Andrew Case
8ce77e81eb
Report the memer name and type when attributes cannot be found
2025-03-01 14:47:00 -06:00
Andrew Case
57b086295b
Fix bugs in Linux memory region enumeration
2025-03-01 14:00:42 -06:00
Andrew Case
89e87ff24c
Fix crash-causing bugs. Add typing where possible.
2025-03-01 12:36:40 -06:00
ikelos and GitHub
795b853ad5
Merge pull request #1641 from volatilityfoundation/1639-broken-use-of-cell_datacount
...
#1639 - cast big data to _CM_BIG_DATA
2025-02-27 20:06:13 +00:00
Dave Lassalle
a906506736
#1639 - cast big data to _CM_BIG_DATA
2025-02-26 13:25:40 -06:00
ikelos and GitHub
481e93b6fd
Merge pull request #1635 from volatilityfoundation/issues/issue1443
...
Linux: Fix typing is lsof
2025-02-25 15:08:27 +00:00
Mike Auty
1c8f9edaf0
Linux: Fix typing is lsof
...
Fixes #1443
2025-02-25 10:15:30 +00:00
ikelos and GitHub
d8b8b20bcc
Merge pull request #1625 from volatilityfoundation/issues/issue1435
...
Windows: Fix console potentially unbound variables
2025-02-25 09:42:43 +00:00
ikelos and GitHub
1f3c4f24dc
Merge pull request #1631 from volatilityfoundation/issues/issue1408
...
Issues/issue1408 - Delete partial cache downloads
2025-02-25 09:40:37 +00:00
ikelos and GitHub
08f47d499c
Merge pull request #1630 from volatilityfoundation/issues/issue1629
...
Issues/issue1629
2025-02-25 09:36:39 +00:00
ikelos and GitHub
d70c571e6a
Merge pull request #1624 from volatilityfoundation/feature/linux_ifconfig_plugin
...
Feature/linux ifconfig plugin
2025-02-25 09:35:09 +00:00
ikelos and GitHub
37bdb6cb99
Merge pull request #1632 from volatilityfoundation/fix_poolscanners
...
Check Win10+ SlushSize member to support Windows 11 pool scanning. Re…
2025-02-23 22:38:32 +00:00
Andrew Case
ba56e42634
Fix for black
2025-02-23 22:34:23 +00:00
Andrew Case
335606774d
Check Win10+ SlushSize member to support Windows 11 pool scanning. Restrict the Pools that current scanners accept.
2025-02-23 22:30:20 +00:00
Mike Auty
48894dae0c
Core: Fix up ruff issue from #1631
2025-02-23 20:56:17 +00:00
Mike Auty
2ff83c4434
Core: Ensure cached files aren't saved if incomplete
2025-02-23 20:50:35 +00:00
Mike Auty
c269086402
Core: Improve caching to only allow one open file write at a time
2025-02-23 20:31:07 +00:00
Mike Auty
e9a6f3214c
Add comment for where to apply the fix
2025-02-23 20:29:29 +00:00
Mike Auty
5fabd7a04b
Linux: Correct partial renaming attempt - take 2
2025-02-23 15:49:18 +00:00
Mike Auty
6d254fa961
Linux: Correct partial renaming attempt
2025-02-23 15:48:05 +00:00
Mike Auty
944c841278
Linux: Rename net extensions to allow for net variable name
2025-02-23 15:44:38 +00:00
