qpalzmz112
fd6e4bec5c
Updated with feedback from the PR
2024-07-31 17:53:29 -05:00
Mike Auty
d576f8cb48
Fix CodeQL error
2024-07-31 21:49:07 +01:00
Mike Auty
73bc10c283
Wire the argcomplete into volshell too
2024-07-31 21:46:57 +01:00
ikelos and GitHub
16cde44400
Merge pull request #1228 from volatilityfoundation/ldr_fix
...
Remove errant filter on ldrmodule checks
2024-07-30 23:21:57 +01:00
ikelos and GitHub
2743e78481
Merge pull request #1227 from dgmcdona/dgmcdona/windows-netscan-update
...
Windows: Updates netscan with new symbol file
2024-07-30 23:19:56 +01:00
ikelos and GitHub
189f8729e5
Merge pull request #1222 from gcmoreira/renderers_time_conversion_fixes
...
Renderers time conversion fixes
2024-07-30 23:08:11 +01:00
ikelos and GitHub
af7466b353
Merge pull request #1224 from dgmcdona/dgmcdona/windows-callback-symbol-fix
...
Windows: Fixes bad structure member in callbacks
2024-07-30 22:45:50 +01:00
ikelos and GitHub
4e8d64ed86
Merge pull request #1217 from eve-mem/windows_issue_1146
...
Windows: update handles plugin sar warnings to use DEFAULT_SAR_VALUE var
2024-07-30 22:38:36 +01:00
ikelos and GitHub
bee333908b
Merge pull request #1221 from volatilityfoundation/issues/issue1216
...
Renderers: Allow BaseAbsentValues in value results
2024-07-30 22:37:42 +01:00
Andrew Case
a84a3706c5
Remove errant filter on ldrmodule checks
2024-07-30 14:00:41 -05:00
David McDonald
56b618f5c3
Windows: Updates netscan with new symbol file
...
`netscan` was missing coverage for Windows 10 Build 20348, causing
owners and create times for `_TCP_ENDPOINTS` to be missing. This adds a
symbol file and the necessary version check in the netscan plugin.
Testing confirms that this returns the correct creation time and owner
process.
2024-07-30 13:04:53 -05:00
Gustavo Moreira
efc48d5831
Make timeliner able to sort aware datetimes. Otherwise, it will raise an exception when comparing the plugin output data with this naive datetime
2024-07-30 17:18:14 +10:00
Arcuri Davide and GitHub
30217ed36d
Merge branch 'volatilityfoundation:develop' into develop
2024-07-30 09:11:33 +02:00
Andrew Case
896b40bd22
Fix bugs in thrdscan and threads. Add orphan kernel threads plugin
2024-07-29 18:50:55 -05:00
Andrew Case
59fec176aa
Fix bugs in thrdscan and threads. Add orphan kernel threads plugin
2024-07-29 18:49:48 -05:00
David McDonald
d97fd777f3
Windows: Bumps netstat module version requirement
...
This is a bump of the version number for the netstat plugin's `modules`
requirement - it didn't get updated after #1173 was merged.
2024-07-29 18:41:57 -05:00
David McDonald
ba7ec00599
Windows: Fixes bad structure member in callbacks
...
This fixes a bug in the x64 callbacks symbols. The `NotificationRoutine`
is currently an `unsigned int` instead of a void pointer. This prevents
the correct mapping of the notification routine to the kernel module
that contains it.
2024-07-29 17:55:56 -05:00
Gustavo Moreira
b343734bae
Renderers conversion exceptions fix: Even though the documentation states that OverflowError should be raised starting from version 3.3, it has been observed that ValueError is still being triggered. Also, in Linux, we noticed that OSError is also being raised in some cases.
2024-07-29 15:16:34 +10:00
Gustavo Moreira
ece15c914f
Renderers conversion exceptions fix: Since version 3.3 utcfromtimestamp() and fromtimestamp() Python datimetime module raises OverflowError instead of ValueError. As of today, Volatility3 requires Python 3.7.3 so we should only include OverflowError
2024-07-29 14:18:10 +10:00
Gustavo Moreira
76414d3246
Renderers conversion fix: Create aware datetimes to represent times in UTC. Fix Python 3.12 datetime.utcfromtimestamp() deprecation.
...
See warning note on https://docs.python.org/3/library/datetime.html#datetime.datetime.utcfromtimestamp :
Because naive datetime objects are treated by many datetime methods as local times, it is preferred to use aware datetimes to represent times in UTC. As such, the recommended way to create an object representing a specific timestamp in UTC is by calling datetime.fromtimestamp(timestamp, tz=timezone.utc).
Additionaly, datetime.utcfromtimestamp() is deprecated since 3.12
2024-07-29 14:13:54 +10:00
Mike Auty
b659a060bd
Renderers: Ensure the version is bumped so plugins can require the format_hints properly
2024-07-28 21:57:48 +01:00
Mike Auty
0d8fb76b3a
Renderers: Allow BaseAbsentValues in value results
...
Fixes #1216
2024-07-28 19:57:23 +01:00
Mike Auty
e89e776377
Try out argcomplete as well
2024-07-28 12:41:31 +01:00
Mike Auty
44f26c928e
Add in shtab autocompletion
2024-07-28 12:35:02 +01:00
qpalzmz112
824b0599f2
formatted
2024-07-27 20:35:08 -05:00
qpalzmz112
f44ceb321d
Added psxview
2024-07-27 20:11:39 -05:00
k1nd0ne
815252c9ba
Adding watchdogs
2024-07-27 16:35:22 +02:00
k1nd0ne
7024588076
Code clean
2024-07-27 16:09:52 +02:00
k1nd0ne
650dd06245
Modifications following the review
2024-07-27 16:03:59 +02:00
ikelos and GitHub
438fc79c8c
Merge pull request #1197 from eve-mem/issue_1040
...
Windows: remove size from filescan output as it is not the file size
2024-07-26 10:03:50 +01:00
Eve
7a03e9deab
Windows: Add a _version to the filescan plugin
2024-07-25 18:21:12 +01:00
Eve
799afe6e51
Windows: fix type in handles plugin
2024-07-25 18:02:30 +01:00
Eve
6f3f645dbc
Windows: update handles plugin sar warnings to use DEFAULT_SAR_VALUE var
2024-07-25 17:59:10 +01:00
Davide Arcuri
dc8dc9b078
fix yara depending plugins
2024-07-25 14:37:18 +02:00
Davide Arcuri
c6727ffb70
fix f-string for previous python release
2024-07-25 08:43:21 +02:00
Davide Arcuri
1616a898ae
restore comment
2024-07-25 08:37:27 +02:00
Davide Arcuri
fceb79ba8b
use with context, bump release
2024-07-25 08:34:04 +02:00
Arcuri Davide and GitHub
c92cd1935e
Merge branch 'volatilityfoundation:develop' into develop
2024-07-25 08:32:01 +02:00
ikelos and GitHub
05aa81b63c
Merge pull request #1214 from eve-mem/windows_issue_1146
...
Windows: update handles plugin to use a default SAR value of 0x10
2024-07-24 22:11:42 +01:00
ikelos and GitHub
19e1c21cbb
Merge pull request #1207 from volatilityfoundation/issues/fix-generator-inheritance
...
Add in threads that only provides an implmentation method
2024-07-24 21:04:36 +01:00
Mike Auty
f4cbed856b
Fix up missing filter parameter
2024-07-24 20:47:05 +01:00
Mike Auty
e1065f9e78
Fix up a missing super which @atcuno spotted
2024-07-24 20:32:36 +01:00
Eve
7d52f7992d
Windows: Make the default sar value used in handles plugin a variable so if it needs to be changed it gets updated in one place only
2024-07-24 11:06:26 +01:00
Eve
b8b146a444
Windows: update handles plugin to use a default SAR value of 0x10 if decoding fails. Produce warnings when this happens. Ref issue #1147
2024-07-24 10:59:52 +01:00
ForensicXlab and GitHub
d8970cc606
Merge branch 'volatilityfoundation:develop' into feature/lsof_inodes
2024-07-23 22:06:08 +02:00
k1nd0ne
af2d620676
Improving lsof
2024-07-23 22:02:34 +02:00
Davide Arcuri
ce9832a2b3
both yara-python and yara-x support
2024-07-22 13:58:33 +02:00
Arcuri Davide and GitHub
0b84a5627b
Merge branch 'volatilityfoundation:develop' into develop
2024-07-22 13:56:34 +02:00
Mike Auty
5e96327cb0
Add in threads that only provides an implmentation method
2024-07-21 22:58:43 +01:00
ikelos and GitHub
721971652c
Merge pull request #1168 from volatilityfoundation/svcdiff_malware_detection
...
Add svclist and svcdiff plugins. Make svcscan more modular to support…
2024-07-21 18:37:49 +01:00
qpalzmz112