Mike Auty
5ee09df080
Symbols: Restore previous protection for non-native missing types
...
Fixes #1480
2025-02-25 09:59:28 +00:00
ikelos and GitHub
d70c571e6a
Merge pull request #1624 from volatilityfoundation/feature/linux_ifconfig_plugin
...
Feature/linux ifconfig plugin
2025-02-25 09:35:09 +00:00
ikelos and GitHub
37bdb6cb99
Merge pull request #1632 from volatilityfoundation/fix_poolscanners
...
Check Win10+ SlushSize member to support Windows 11 pool scanning. Re…
2025-02-23 22:38:32 +00:00
Andrew Case
ba56e42634
Fix for black
2025-02-23 22:34:23 +00:00
Andrew Case
335606774d
Check Win10+ SlushSize member to support Windows 11 pool scanning. Restrict the Pools that current scanners accept.
2025-02-23 22:30:20 +00:00
Mike Auty
5fabd7a04b
Linux: Correct partial renaming attempt - take 2
2025-02-23 15:49:18 +00:00
Mike Auty
6d254fa961
Linux: Correct partial renaming attempt
2025-02-23 15:48:05 +00:00
Mike Auty
944c841278
Linux: Rename net extensions to allow for net variable name
2025-02-23 15:44:38 +00:00
ikelos and GitHub
2ffb3ac6b1
Merge pull request #1623 from volatilityfoundation/issues/issue1618
...
Layers: Reduce double bounds test and simplify intel translation
2025-02-21 19:54:33 +00:00
Mike Auty
ce490298bf
Linux: Fix up typo unchanged net instance in sockscan
2025-02-20 09:51:43 +00:00
Mike Auty
17ea6e9fd0
Linux: Fix altered SockHandlers signature
2025-02-20 09:20:57 +00:00
Mike Auty
2ff7dea512
Linux: Remember to apply the symbols to addr as well as link
2025-02-20 01:07:10 +00:00
Mike Auty
815d695aab
Linux: Leave the existing symbol table the same
2025-02-20 00:30:48 +00:00
Mike Auty
056d7813a7
Linux: fix up typing typo
2025-02-20 00:25:31 +00:00
Mike Auty
1458b7dfc7
Linux: Add vast quantities of missing type information
2025-02-20 00:17:48 +00:00
Mike Auty
bfd210236f
Linux: Fix up too-net typing syntax
2025-02-20 00:00:53 +00:00
Mike Auty
eb21f89cf3
Linux: Fix ruff errors
2025-02-19 23:54:15 +00:00
Mike Auty
2fa0ce8e5c
Bump required version numbers
2025-02-19 23:51:06 +00:00
Mike Auty
054bb48157
Separate out the net symbols from standard linux
...
Also includes some typing changes.
2025-02-19 23:48:20 +00:00
Mike Auty
3ea563bde8
Windows: Use built-in libraries where possible (idea from #1627 )
2025-02-19 18:48:32 +00:00
Mike Auty
6486b4a569
Linux: Fix some black issues
2025-02-16 21:46:26 +00:00
Mike Auty
ea2c50710e
Linux: Correct enum import issues
2025-02-16 21:44:37 +00:00
ikelos and GitHub
80f2cc6a43
Merge pull request #1079 from gcmoreira/linux_ifconfig_plugin
...
Linux ip.Addr and ip.Link plugins
2025-02-16 21:41:05 +00:00
ikelos and GitHub
51c19fbdf2
Merge branch 'feature/linux_ifconfig_plugin' into linux_ifconfig_plugin
2025-02-16 21:40:36 +00:00
ikelos and GitHub
e0902ad7df
Merge pull request #1621 from volatilityfoundation/issue_1487_driver_handling
...
Stop reporting terminated/smeared drivers. Enforce names present. Add…
2025-02-16 21:24:13 +00:00
Andrew Case
7a533054f7
Address feedback
2025-02-16 21:24:33 +00:00
Mike Auty
346e58e798
Layers: Reduce double bounds test and simplify intel translation
2025-02-16 18:50:44 +00:00
Mike Auty
d5976146fb
Layers: Restore get_valid_table caching
...
Partially restore performance as per #1618
2025-02-16 18:24:23 +00:00
Andrew Case
ca5f811405
Stop reporting terminated/smeared drivers. Enforce names present. Add kernel start checking in all places
2025-02-15 21:26:54 +00:00
ikelos and GitHub
81bac4db11
Merge pull request #1613 from Abyss-W4tcher/linux_pagecache_recoverfs
...
New plugin: linux.pagecache.recoverfs
2025-02-15 16:26:17 +00:00
Abyss Watcher
2bf0a26c73
typos
2025-02-15 15:28:23 +01:00
Abyss Watcher
b86e54e427
extra checks and debug messages
2025-02-15 15:25:26 +01:00
Abyss Watcher
c2f8697cc5
normalize symlinks by relying on purepath
2025-02-15 15:24:53 +01:00
Abyss Watcher
51b66f7573
add symlink details in description
2025-02-15 14:14:02 +01:00
Abyss Watcher
9484430036
convert private classmethods to simple methods
2025-02-15 13:16:58 +01:00
ikelos and GitHub
a982939122
Merge pull request #1608 from volatilityfoundation/issue_1319_dumpfiles
...
Switch virtual and physical addresses to lists to support dumping mul…
2025-02-15 10:29:42 +00:00
Andrew Case
49b40eb30a
Make black happy
2025-02-15 00:36:12 +00:00
Andrew Case
6babe158f0
Address feedback
2025-02-15 00:35:31 +00:00
ikelos and GitHub
0ea766a0ad
Merge pull request #1620 from volatilityfoundation/issue_1474_orphan_threads
...
Enforce kernel boundaries correctly. Fix bugs. Closes #1474
2025-02-14 20:38:48 +00:00
Andrew Case
92db0e3f08
Address feedback
2025-02-14 20:42:00 +00:00
Andrew Case
9b78099a08
Enforce kernel boundaries correctly. Fix bugs. Closes #1474
2025-02-14 19:24:26 +00:00
ikelos and GitHub
575e645f4f
Merge pull request #1615 from volatilityfoundation/dgmcdona/envars_unbound_locals
...
Windows Envars: Fix unbound locals
2025-02-13 22:49:19 +00:00
ikelos and GitHub
3f2a514cc2
Merge pull request #1616 from volatilityfoundation/dgmcdona/windows_cmdline_output
...
Windows Cmdline: Clean up output
2025-02-13 22:47:40 +00:00
ikelos and GitHub
4172a574d5
Merge pull request #1617 from volatilityfoundation/dgmcdona/windows_envars_silent_vars
...
Windows Envars: Remove extra config check
2025-02-13 22:36:45 +00:00
David McDonald
4712cafa4b
Windows Envars: Remove extra config check
...
Tiny bit of cleanup here - there's no need to re-check the config for
`SILENT` for each variable. We can just initialize it once as either an
empty list or the calculated list of silent vars depending on the config
value.
2025-02-12 10:23:46 -06:00
David McDonald
bcbfc27d4f
Windows Cmdline: Clean up output
...
The strings being used as return values here would (IMO) be better as
debug statements, with the plugin returning
`renderers.UnreadableValue()` for any of the `InvalidAddressException`
code paths.
2025-02-12 10:11:23 -06:00
David McDonald
443cfd2515
Windows Envars: Fix unbound locals
...
Technically, these were protected against `UnboundLocalError` exceptions
through the use of the `sys` and `ntuser` boolean variables, but this
really isn't the best way to prevent that from happening, and
type-checkers still warn about the potentially unbound locals. This fix
instead uses the `sys` and `ntuser` variables to hold the registry keys,
preinitializing them to `None` and checking their value before
attempting to access instance methods.
2025-02-12 10:02:31 -06:00
Abyss Watcher
1530e62a86
typo
2025-02-11 17:59:19 +01:00
Abyss Watcher
de42e58bfa
require framework v2.21.0 for recoverfs
2025-02-11 17:54:19 +01:00
Abyss Watcher
999f3d0d2c
add superblock or device numbers path prepending
2025-02-11 17:48:34 +01:00
Mike Auty