WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 09:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,288 Commits 80 Branches 17 Tags
67a83871adac20171a862d55dcafe5ab383c024b
Commit Graph
5288 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Gustavo Moreira e197fbaf5f Linux: Boottime API: Refactor __sub__ to operate through __add__() and negate() for improved clarity and reuse 2024-10-30 15:39:40 +11:00
Gustavo Moreira 7abe92cf2f Linux: Boottime API: Minor. Move negate() up 2024-10-30 15:36:46 +11:00
Gustavo Moreira 42d918c05d Linux: Boottime API: Refactor Timespec Methods. 
Move TimespecVol3 methods to an abstract class Timespec64Abstract, which is now inherited by Timespec64 and Timespec64Concrete.
 2024-10-30 15:21:13 +11:00
Gustavo Moreira 722ccd527e Linux: Extensions: Clean up the Linux constants imports in the object extension file 2024-10-30 12:56:09 +11:00
Gustavo Moreira 4b76b699ad Linux: hidden_modules: Add docstrings and comments to enhance the documentation of the module verification process. Move the hardcoded values to the linux constants file. 2024-10-30 09:56:05 +11:00
Gustavo Moreira f537c4a7e0 Merge branch 'develop' into linux_hidden_modules 2024-10-30 09:24:51 +11:00
Gustavo Moreira 8960bdab08 Linux: hidden_modules: Add a symbol table check for a recent dwarf2json version 2024-10-29 17:33:06 +11:00
Gustavo Moreira 1c6a548017 Linux: hidden_modules: Simplify symbols type checks 2024-10-29 17:30:47 +11:00
Gustavo Moreira dfd8a1f195 Linux: hidden_modules: Include kernel version and commit details 2024-10-29 17:22:48 +11:00
Gustavo Moreira cbe071ff3e Linux: hidden_modules: Import the whole architectures module 2024-10-29 17:19:30 +11:00
Gustavo Moreira 526007f948 Linux: hidden_modules: Use child_template 2024-10-29 16:41:47 +11:00
Gustavo Moreira bee2a398eb Linux: Minor: Add comment/header on each set of constants 2024-10-29 15:13:26 +11:00
Gustavo Moreira bb6dc9a595 Merge branch 'develop' into linux_boottime_support 2024-10-29 14:41:51 +11:00
Gustavo Moreira 57ffd5b939 Linux: Boottime API: Refactor TimespecVol3::negate() to return a new object instead of modifying the original. It also normalizes its values, aligning with the behavior of the other addition and subtraction operators 2024-10-29 14:24:16 +11:00
Gustavo Moreira c4274c942c Linux: Fix exception message in TimespecVol3::__sub__() 2024-10-29 13:49:58 +11:00
Gustavo Moreira 4895af47bd Linux: Boottime timeliner: Rollback timeliner event type changes and use the created time for the boot time plugin 2024-10-29 13:46:19 +11:00
Gustavo Moreira 094cdf18f1 Linux: netfilter plugin: Fix hooked field to match vol2 output 2024-10-29 10:59:18 +11:00
David McDonald efdbc27b95 Windows: Scheduled tasks - removes special time type 
Removes the TaskSchedulerTime dataclass and discards the
is_localized value parsed with the timestamp.
 2024-10-25 14:15:06 -05:00
David McDonald 0413cc5e26 Windows: Scheduled tasks - code review fixes 2024-10-25 12:56:18 -05:00
ikelosandGitHub a1961401d5 Merge pull request #1320 from dgmcdona/dgmcdona/linux_pagecache_missing_iter_implementation 
Linux: Extensions - removes abc.Iterable definition
 2024-10-25 00:35:24 +01:00
David McDonald 4c2d2f98da Removes collections.abc.Iterable superclass 
Per @gcmoreira this is the correct fix vs the one previously proposed,
since self.vol.member_name cannot be used as the member name to
iterate this type.
 2024-10-24 15:39:15 -05:00
David McDonald 388a3e6458 Linux: Adds missing abc.Iterable implementation 
`hlist_head` is missing an implementation for
`collections.abc.Iterable`, resulting in a crash at runtime. This fixes
the issue by providing the required `__iter__` implementation for
`hlist_head`.
 2024-10-24 14:39:22 -05:00
ikelosandGitHub 62aa9c1e12 Merge pull request #1318 from Abyss-W4tcher/use_volshell_additional_locals 
Allow to import external locals in volshell environment
 2024-10-24 00:05:32 +01:00
Abyss Watcher 7f2d8eabb7 set correct locals priority 2024-10-23 21:39:57 +02:00
Abyss Watcher 708d933021 use additional_locals in run method 2024-10-23 21:23:14 +02:00
ikelosandGitHub 1500d2ecf6 Merge pull request #1314 from gcmoreira/linux_add_hlist_head_object_extension_fix_1313 
Linux adds hlist_head object extension
 2024-10-22 23:21:04 +01:00
Gustavo Moreira db8667f88a Linux - Fix hlist_head object extension by dropping the iterator since it can't determine the correct member_name 2024-10-23 08:55:44 +11:00
Mike Auty 65daab6cfa Linux: Fix minor coding style transgression 2024-10-22 21:47:13 +01:00
ikelosandGitHub 3e6ea7bb0e Merge pull request #1290 from dgmcdona/dgmcdona/windows-unloadedmodules-traceback 
Windows: unloadedmodules bugfix
 2024-10-22 21:38:31 +01:00
ikelosandGitHub b0a30c0652 Merge pull request #1238 from gcmoreira/linux_fix_mnt_namespace_issue_1187 
Linux: Add support for the mount namespace in kernels 6.8+
 2024-10-22 21:22:50 +01:00
ikelosandGitHub 51ac7600f5 Merge pull request #1315 from Abyss-W4tcher/rust_type_confusion_warning 
dwarf2json rust type confusion sanity check
 2024-10-22 21:20:22 +01:00
ikelosandGitHub 028502d772 Merge pull request #1288 from gcmoreira/linux_ptrace 
Add Linux ptrace plugin
 2024-10-22 21:11:44 +01:00
Gustavo Moreira 1651ecb1d7 linux: boottime api: Fix explicit returns mixed with implicit (fall through) returns 2024-10-18 13:58:27 +11:00
Gustavo Moreira d25df2357a Linux: pslist: Add the boottime plugin 2024-10-18 12:59:23 +11:00
Gustavo Moreira 69512dc991 Linux: pslist: Add creation time column and timeline support to the linux.pslist plugin 2024-10-18 12:58:02 +11:00
Gustavo Moreira f822468407 linux: Implement boot time support in the Volatility 3 core framework 2024-10-18 12:40:02 +11:00
Gustavo Moreira 18f7f035ee linux: fix datetime import and remove unused ones 2024-10-18 12:29:09 +11:00
Gustavo Moreira 0ddd9210a8 linux: hidden_modules: Remove unused module imports 2024-10-16 15:08:59 +11:00
Gustavo Moreira d98c7ebb1d linux: hidden_modules: Make the fast method the default. Remove vol2 and fall back to a 1-byte alignment scan if addresses aren't aligned to the L1 cache size 2024-10-16 15:05:02 +11:00
Andrew Case adee265b17 Address feedback 2024-10-15 14:12:23 -05:00
Andrew Case 79f81f0af9 Address feedback 2024-10-15 14:11:27 -05:00
Dave LassalleandAndrew Case 685dc97298 fix resident data bug for duplicate mft record numbers 2024-10-14 13:48:00 -05:00
Andrew Case da41124b1c Fix formatting with black 2024-10-14 13:48:00 -05:00
Andrew Case 33716be15b Rework for proper ADS recovery. Memory OOM issues 2024-10-14 13:48:00 -05:00
atcunoandAndrew Case da843b0367 Address feedback 2024-10-14 13:48:00 -05:00
atcunoandAndrew Case dea0e15689 Address feedback 2024-10-14 13:48:00 -05:00
Andrew Case a8c6db2fc4 Formatting fixes 2024-10-14 13:48:00 -05:00
Andrew Case 2c73d8812a Split layer gathering and add KeyError checks 2024-10-14 13:48:00 -05:00
Andrew Case 9b8eea015a Address feedback 2024-10-14 13:48:00 -05:00
atcunoandAndrew Case 105b4bab25 Format fixes 2024-10-14 13:48:00 -05:00