Eve
9b85342673
Linux: bump version for linux kmsg
2023-12-14 09:24:51 +00:00
Eve
fda3cedaba
Linux: update kmsg to create objects via context rather than module
2023-12-14 09:18:01 +00:00
ikelos and GitHub
713b5f96dd
Merge pull request #997 from gcmoreira/issue_985
...
Issue 985
2023-12-12 23:35:54 +00:00
ikelos and GitHub
298570aba4
Merge branch 'develop' into issue_985
2023-12-12 23:06:45 +00:00
Eve
3d9b0208cb
Linux: change pstree to a basic plugin rather than inheriting from pslist
2023-12-12 06:56:14 +00:00
Eve
19499d5113
Linux: update pslist with classmethod for get_task_fields
2023-12-11 06:39:09 +00:00
Eve
c08dda88de
Linux: Update pslist plugin so that it can be used from pstree, and update pstree to support dumping of processes
2023-12-08 22:56:17 +00:00
Eve and GitHub
b9c60a5545
Merge branch 'volatilityfoundation:develop' into linux_kmsg_issue_1055
2023-12-07 09:07:15 +00:00
Eve
831e6cf341
Linux: update kmsg KmsgFiveTen class to handle symbol shift and create objects with absolute addresses
2023-12-07 09:06:13 +00:00
ikelos and GitHub
a08b7809b5
Merge pull request #1050 from eve-mem/windows_vadyarascan_issue_1047
...
Windows: update vadyarascan to use generic yarascan requirements
2023-12-05 18:46:07 +00:00
ikelos and GitHub
8262737912
Merge pull request #1010 from eve-mem/linux_elf_padded_magic_read
...
Linux: Add error handling to elf extension magic bytes check
2023-12-03 15:22:33 +00:00
ikelos and GitHub
799c7edf66
Merge pull request #1044 from forensicxlab/feature/ADS
...
Feature: Alternate Data Streams.
2023-12-03 15:20:53 +00:00
k1nd0ne
acb088dbcd
Better code reading
2023-12-03 13:05:45 +01:00
k1nd0ne
ed2db939d6
Better exception handling. Fetching data using objects
2023-12-03 12:24:11 +01:00
ikelos and GitHub
42a89cf027
Merge pull request #1037 from forensicxlab/feature/bucket-s3
...
Feature: Remote analysis on cloud object-storage.
2023-12-01 14:07:52 +00:00
ikelos and GitHub
21af01ddd2
Merge pull request #1034 from eve-mem/linux_maple_tree_seen_parameter_fix
...
Linux: update maple tree extension to fix issue #1032
2023-12-01 13:57:45 +00:00
Eve
276e695237
Linux: update maple tree extension comment around the seen set.
2023-12-01 13:46:00 +00:00
Eve
7fe086f64f
Linux: update maple tree extension to fix issue #1032 correcting the mutable type used as a default parameter.
2023-12-01 13:37:09 +00:00
k1nd0ne
1f5a18d679
patch running black
2023-11-30 11:54:55 +01:00
k1nd0ne
ed98d453f6
Changing requirements + formating
2023-11-30 11:50:04 +01:00
ikelos and GitHub
292bef9fcc
Merge pull request #1051 from eve-mem/linux_iomem_absolute_address_bugfix
...
Linux: fix bug with iomem plugin due to absolute address misuse
2023-11-29 21:04:44 +00:00
Eve
099403d07c
Linux: fix bug with iomem plugin where an absolute address is used to make an object but the absolute flag is not set
2023-11-29 20:47:14 +00:00
Mike Auty
b20643d5e0
Linux: Tidy up the elf symbol table name
2023-11-29 12:03:43 +00:00
ikelos and GitHub
0769df4b3c
Merge pull request #1039 from Abyss-W4tcher/linux_extensions_patches
...
Linux extensions patches
2023-11-29 12:02:46 +00:00
Abyss Watcher
39144ff45f
type hint get_symbols_names_and_addresses
2023-11-29 12:51:08 +01:00
Eve
c610497fa0
Windows: update vadyarascan to use generic yarascan requirements
2023-11-29 09:28:34 +00:00
ikelos and GitHub
4ce42fcac4
Merge pull request #1049 from volatilityfoundation/issues/improve-mftscan
...
Simplify attribute object accesses
2023-11-28 21:45:13 +00:00
k1nd0ne
7624c494e8
Simplify attribute object accesses like #1049 + custom class (MFTAttribute)
2023-11-28 13:57:02 +01:00
Mike Auty
8d5877e904
Simplify attribute object accesses
...
This is a very small percentage slower, for some reason, than the
previous mechanism, probably overhead from object creation/member
access. However, it vastly simplifies the code and makes better use of
the volatility object model.
2023-11-27 01:00:00 +00:00
ikelos and GitHub
9f9afbf90f
Merge pull request #1048 from volatilityfoundation/issues/issue922
...
Issues/issue922
2023-11-26 12:53:49 +00:00
Mike Auty
8b6ab44310
Core: Fix array_of_pointers to act only on those pointers
2023-11-26 12:30:06 +00:00
Mike Auty
62506aece6
Core: Fix up github security issues
...
This fixes an unused import, an improper use of self and lots and lots
of places where we implicitly return None. This now explicitly returns
None to improve readability and prevent mixed implicit and explicit
return values. This should also somewhat aid type checking by humans.
2023-11-26 11:24:53 +00:00
k1nd0ne
24609856de
Fixing: unused import, typo, ISF enhancement
2023-11-25 17:04:47 +01:00
ikelos and GitHub
7012edb815
Merge pull request #885 from eve-mem/vmayarascan
...
add linux.vmayarascan
2023-11-23 09:08:17 +00:00
k1nd0ne
c3dbf9714d
Better variable init
2023-11-20 19:12:07 +01:00
Abyss Watcher
80483722eb
split module functions to keep current API
2023-11-20 11:57:56 +01:00
k1nd0ne
fd5c828939
Renaming file, handling url parsing using urllib, changing logger and requirement condition placement.
2023-11-20 11:02:31 +01:00
k1nd0ne
46a6ab1721
Making sure it is ADS
2023-11-19 13:09:47 +01:00
k1nd0ne
6c6d036cc0
Adding Alternate Data Stream Scanner
2023-11-19 00:54:56 +01:00
k1nd0ne
ceac912014
Adding requirements
2023-11-18 15:47:49 +01:00
k1nd0ne
f8e3464219
Forgot to return 'None' in the s3 scheme
2023-11-18 15:17:54 +01:00
k1nd0ne
fa2b840b55
Object Storage Layer for PR #1037
2023-11-18 15:05:11 +01:00
Abyss Watcher
6372b6f367
symbols getters follow vol2 format
2023-11-17 17:52:58 +01:00
Abyss Watcher
1a73717b93
set 'module' as config string
2023-11-17 17:49:54 +01:00
ikelos and GitHub
d56297c4b1
Merge pull request #1038 from eve-mem/linux_check_afinfo_member_checks
...
Linux: add member presence checks to linux.checks_afinfo
2023-11-15 23:00:25 +00:00
Eve
4f4e2efd99
Linux: update warning logic in linux.checks_afinfo so that only one warning is shown and debug logs are cleaner
2023-11-15 10:29:06 +00:00
ikelos and GitHub
c616c0b35e
Merge pull request #1011 from eve-mem/layer_debug_info
...
Layer debug info to show file size
2023-11-15 01:06:13 +00:00
ikelos and GitHub
2e4d6cde17
Merge pull request #1035 from eve-mem/linux_bash_get_sections_only_once
...
Linux: update bash plugin to only get memory sections once
2023-11-15 00:59:30 +00:00
ikelos and GitHub
19d40b1a7f
Merge pull request #1027 from daddycocoaman/fix/pdbutility-signature
...
fix guid and pdb_name for #1026
2023-11-14 23:38:53 +00:00
Abyss Watcher
36327a4315
check if symbol name is empty after strip
2023-11-14 17:20:16 +01:00
Eve