Hannah Sarkey and GitHub
43fa84d2d1
Update dlllist.py to have more detailed --base description
2024-07-04 21:33:55 -04:00
ikelos and GitHub
4f69638d4d
Merge pull request #1110 from dgmcdona/dgmcdona/windows-callbacks
...
Windows: Add support for missing callback types
2024-07-04 23:04:55 +01:00
ikelos and GitHub
1e58547aa9
Merge pull request #1191 from gcmoreira/fix_text_renderer_hexdump
...
Fix hexdump text render. Set default to 16 bytes width
2024-07-04 19:46:20 +01:00
Gustavo Moreira
52e6812d39
Fix hexdump text render. Set default to 16 bytes width
2024-07-04 14:03:59 +10:00
Gustavo Moreira
fcc9eab471
Improve smear protection on windows processes validation
2024-07-04 13:09:12 +10:00
Gustavo Moreira
b36fd84ab5
Handle virtual_process_from_physical() invalid address exceptions to prevent psscan from breaking
2024-07-04 13:07:17 +10:00
David McDonald
4d6f4bba0d
Windows: Add version to driverirp.DriverIrp plugin
...
This plugin class was missing a `_version` attribute, so I added one and
set it to (1, 0, 0).
2024-07-03 17:15:16 -05:00
David McDonald
55881535bb
Windows: Callbacks - parse missing callback types
...
Updates the Windows callbacks plugin to support several types of
callbacks that were present in the original volatility framework, but
were missing in volatility3. Adds an extension for `_SHUTDOWN_PACKET`
structures for determining validity of structure.
2024-07-03 17:15:16 -05:00
David McDonald
89b024d8f5
Framework: Fix bad format string
...
Fixes a bad format string inside of a raised exception
2024-07-03 16:54:43 -05:00
David McDonald
acc41c2b86
Windows: Callbacks - update symbol files
...
Updates the windows callbacks symbol files to include structures that
were missing from the original volatility plugin.
2024-07-03 16:54:43 -05:00
ikelos and GitHub
0da48fa23a
Merge pull request #1172 from volatilityfoundation/threads
...
Add threads and suspicious_threads plugins. Condense code for re-use
2024-07-03 21:05:11 +01:00
atcuno
020005f43c
Address feedback from ikelos
2024-07-03 09:55:07 -05:00
atcuno
857cd8df49
Updates from ikelos' feedback
2024-07-02 19:14:15 -05:00
atcuno
8525edd333
Formatting fixes
2024-06-27 17:15:49 -05:00
atcuno
8c1a5c46e3
Add timeliner support to userassist
2024-06-27 17:13:37 -05:00
Hannah Sarkey and GitHub
06a2c0c76c
Merge branch 'volatilityfoundation:develop' into hsarkey/windows-dlllist
2024-06-26 12:10:11 -04:00
ikelos and GitHub
ac5769cf86
Merge pull request #1178 from dgmcdona/dgmcdona/windows_poolscan_layer_bug
...
Windows: fixes scanner bug for versions < win10
2024-06-23 11:08:39 +01:00
Mike Auty
7ece5fb1bf
Windows: Improve Virtmap error messages slightly
2024-06-23 00:16:32 +01:00
ikelos and GitHub
351db0e573
Merge pull request #1171 from Abyss-W4tcher/crash_layer_issue_509
...
fix #509 and simplify logic in crash layer _load_segments
2024-06-22 09:30:02 +01:00
David McDonald
898c0844c4
Windows: fixes scanner bug for versions < win10
...
This commit fixes a bug where the `layer_name` gets discarded when
constructing objects. Previously, it was assumed that we would not want
to construct an object for a module with a layer_name different from that
of the module. However, because we switch to scanning the memory layer on
samples where the version is < 10, but still construct kernel executive
objects based on the result of the memory layer scan, we actually do
sometimes need to specify a different layer.
2024-06-21 18:47:48 -05:00
Dave Lassalle
146baab14c
#118 - refactor get_dpc
2024-06-21 15:54:16 -05:00
Dave Lassalle
2d7789f850
#118 - fix black issues
2024-06-21 15:49:03 -05:00
Dave Lassalle
7065446e8a
#118 - fix black issues
2024-06-21 15:17:40 -05:00
Dave Lassalle
c79dc52a85
#118 - black formatted
2024-06-21 15:09:21 -05:00
Dave Lassalle
e172676d3c
#118 - initial timers plugin
2024-06-21 15:07:18 -05:00
Dave Lassalle
b601250279
#1175 - initial unloadedmodules plugin
2024-06-21 08:29:50 -05:00
atcuno
ed140e9ac4
placeholder
2024-06-20 13:06:43 -05:00
Abyss Watcher
c688744f66
revert useless for-else
2024-06-20 04:16:32 +02:00
Abyss Watcher
a68a482632
fix #509 and simplify logic in _load_segments
2024-06-20 04:00:20 +02:00
atcuno
178f7c45f7
formatting fixes
2024-06-19 20:13:04 -05:00
atcuno
02bda980d4
formatting fixes
2024-06-19 20:12:07 -05:00
atcuno
3d1b9ef2bc
Add new plugin to detect hollowed processes using a variety of techniques and allowing for easy additions of future detection techniques
2024-06-19 20:09:05 -05:00
atcuno
f6a053d7b3
Format fixes
2024-06-19 14:58:05 -05:00
atcuno
d42fb0a145
Format fixes
2024-06-19 14:56:57 -05:00
atcuno
91184c7d92
Format fixes
2024-06-19 14:54:20 -05:00
atcuno
c4e7e50180
Add svclist and svcdiff plugins. Make svcscan more modular to support inheritance and cleaner code
2024-06-19 14:42:23 -05:00
atcuno
4e15019c46
Fixes for black
2024-06-19 11:34:06 -05:00
atcuno
6c42c51a8a
Fixes for black
2024-06-19 11:31:43 -05:00
atcuno
aee81276a2
Add processghosting plugin to detect process ghosting and related techniques. Add process filter that gathers only active, non-smeared userland processes
2024-06-19 11:27:32 -05:00
ikelos and GitHub
b187dd9686
Merge pull request #1165 from volatilityfoundation/notes_bleed_through
...
The notes variable is not reset for each VAD, allowing bleed through …
2024-06-15 10:51:46 +01:00
atcuno
59f6a05068
The notes variable is not reset for each VAD, allowing bleed through of a previously set note value to VADs enumerated afterwards
2024-06-14 16:45:54 -05:00
ikelos and GitHub
07794c7b29
Merge pull request #1164 from volatilityfoundation/fix_ads_rendering
...
Prevent backtrace in ADS scanning when contents cannot be recovered. …
2024-06-14 00:11:36 +01:00
atcuno
04ca0214eb
Prevent backtrace in ADS scanning when contents cannot be recovered. Fix missing parantheses as well as format_hints call on bad value
2024-06-13 15:24:32 -05:00
Mike Auty
0ee3573be2
Revert "Intel layer: Fix. This if statement will never be executed unless "minimum_address > maximum_address" which doesn't make sense to me."
...
This reverts commit e5a5b89577
2024-06-12 23:14:45 +01:00
ikelos and GitHub
0808e873fa
Merge pull request #1141 from gcmoreira/layers_several_fixes
...
Layers - Several fixes around maximum_address and chunk sizes
2024-06-11 23:15:18 +01:00
ikelos and GitHub
05ba1f9f8f
Merge pull request #1160 from eve-mem/windows_ldrmodules_issue_1158
...
Windows: ldrmodules update exception handling to InvalidAddressException
2024-06-11 23:02:42 +01:00
Eve
e4aac0c976
Windows: ldrmodules update exception handling to InvalidAddressException
2024-06-10 11:30:15 +01:00
Gustavo Moreira
77fb0b7b26
Update the output filename (preferred_filename) so that we can notify it correctly to the user
2024-06-10 18:37:38 +10:00
Gustavo Moreira
ab84070df3
Revert "Store the real/final output filename so that we can notify it correctly to the user"
...
This reverts commit d7aae3a982
2024-06-10 17:25:05 +10:00
Gustavo Moreira
a72062f288
Revert "LayerWriter plugin: Fix --output argument. It's referenced in the code but never mentioned as a requirement"
...
This reverts commit 6d22347ce6
2024-06-10 17:20:47 +10:00
