WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 09:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,288 Commits 80 Branches 17 Tags
67a83871adac20171a862d55dcafe5ab383c024b
Commit Graph
5288 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mike Auty 803c56e3c4 Core: include the volatility3 package and all volatility3 subpackages 2023-09-05 23:51:17 +01:00
Mike Auty 9d2fd40517 Revert "Core: Include only volatility3 in distributions packages" 
This reverts commit b4c6b661f0.
 2023-09-05 23:07:57 +01:00
Shutdown ef341d54d6 Fixing fail-fast strategy 2023-09-05 22:37:45 +02:00
Shutdown 9982a44131 Adding matrix strategy for hosts and python version 2023-09-05 22:36:40 +02:00
Shutdown 2a67aa639a Removing Python version 2023-09-05 22:29:25 +02:00
Shutdown 627e2fbab9 Adding install.yml workflow 2023-09-05 22:27:53 +02:00
Mike Auty 05df365936 Core: Fix missing packages in setup.py 
Fixes #1002.
 2023-09-05 18:23:54 +01:00
xabrouck 455487dbb6 Making cred optional as it didn't exist in old 2.6 kernels 2023-09-05 16:20:46 +02:00
Eve 52207e0933 Add extra debug information for layer stacker to show file size of the physical file 2023-09-04 17:44:24 +01:00
Mike Auty da203f7d68 Documentation: Improve library documentation 
Fixes #993.
 2023-09-03 22:07:20 +01:00
ikelosandGitHub 3ff4f015c4 Merge pull request #899 from cstation/feature/linux_elf_dump 
Dump ELFs to file
 2023-09-03 21:59:36 +01:00
ikelosandGitHub c8a85e11b2 Merge pull request #995 from xabrouck/dirty 
Check IoC of dirty bit in PTEs from executable VMAs.
 2023-09-03 21:56:25 +01:00
ikelosandGitHub c72129203b Merge pull request #996 from eve-mem/Linux-Change-get_process_memory_sections-to-use-get_vma_iter 
Linux: fix bug where get_process_memory_sections fails with 6.1+ kernels
 2023-09-03 21:41:43 +01:00
Mike Auty b4c6b661f0 Core: Include only volatility3 in distributions packages 
Fixes #951
 2023-09-03 21:13:37 +01:00
616c696365 5c80a66d6d Windows: Update pslist.py, add friendly option 2023-08-30 20:12:12 +01:00
Gustavo Moreira 9b5c4b0415 fix comment typo 2023-08-22 15:59:45 +10:00
gcmoreiraandGitHub 7dc74f14b6 Merge branch 'volatilityfoundation:develop' into issue_985 2023-08-22 15:51:42 +10:00
xabrouck 6f7f1284ad Fix bug with PAGE_SHIFT that wasn't shifted, also greatly increases performance 
Use black
Better logging
 2023-08-18 11:37:04 +02:00
EveandGitHub 804d68d94d Linux: fix bug where get_process_memory_sections fails with 6.1+ kernels 2023-08-17 13:38:23 +01:00
Mike Auty 581c493f4f Add in action to make old tickets stale. 2023-08-16 21:35:11 +01:00
xabrouck 7c82da4f50 check IoC of dirty bit in PTEs from executable VMAs. 
this can for example detect code injected using ptrace().
this can also detect injected code that was reset to the original code (malware uninstalled before memory dump happened).
 2023-08-14 11:53:14 +02:00
Mike Auty 5d4c70d517 Documentation: Fix requirements -> get_requirements #993 2023-08-03 15:16:36 +01:00
ikelosandGitHub b050b108e4 Merge pull request #988 from xabrouck/avml-fix2 
fix bug in snappy lib loading and make it work on macOS.
 2023-07-27 14:08:35 +01:00
xabrouck a226b90b4d previous commit would break linux snappy support 2023-07-27 09:37:57 +02:00
xabrouck d872abaf30 fix bug in snappy lib loading and make it work on macOS. 2023-07-27 09:28:53 +02:00
cstationandGitHub d53714fac8 Fix linting 2023-07-22 17:03:57 +00:00
cstationandGitHub fca4c5db4b Merge branch 'develop' into feature/linux_elf_dump 2023-07-22 17:00:12 +00:00
cstation 8373b5ed5a Push ELF export limit to a constant 2023-07-22 18:56:51 +02:00
Gustavo Moreira 0a6deae6bd This will fix #985. It requires the changes in dwarf2json mentioned in this ticket. 2023-07-21 12:52:21 +02:00
ikelosandGitHub 6f71781405 Merge pull request #984 from gcmoreira/linux_capabilities_fixes 
Linux capabilities fixes
 2023-07-20 11:02:56 +01:00
Gustavo Moreira 90da6298e0 Added further details to the kernel_cap_struct::cap comments 2023-07-20 00:29:52 +02:00
Gustavo Moreira 9ba3d9ba4e Several fixes: 
* The capabilities array was to have a 64bit bitwise.
* Capabilities set has to be tested with the kernel maximum. We can't use the plugin capabilities set, otherwise we can have wrong interpretations when we tried to compress the list of capabilities to "all"
* Supports kernels >= 6.3. They changed the kernel_cap_struct::cap type again to a u64 type.
 2023-07-19 22:48:06 +02:00
RuBublik 338238c639 fixed build number - resets when MINOR version goes up 2023-07-16 00:10:31 +03:00
ikelosandGitHub 373d769690 Merge pull request #978 from volatilityfoundation/feature/parameterized_object_from_symbol 
Core: Add type parameter to object_from_symbol
 2023-07-12 22:17:53 +01:00
ikelosandGitHub 89b6c090b3 Merge pull request #952 from cpuu/mac_pslist 
Add more process information to mac.pslist plugin
 2023-07-12 22:16:55 +01:00
cpuuandGitHub f8fc5d5e58 Update pslist.py 
list modules in code in alphabetical order
 2023-07-12 14:43:38 +09:00
cpuuandGitHub 6907575d77 Merge branch 'volatilityfoundation:develop' into mac_pslist 2023-07-12 14:37:30 +09:00
ikelosandGitHub 74e8582360 Merge pull request #957 from gcmoreira/linux_capabilities 
Linux capabilities plugin
 2023-07-10 07:49:44 +01:00
Gustavo Moreira 42fe37ed52 Adjust docstring to the new retuned type. 2023-07-10 01:12:20 +02:00
Gustavo Moreira 38e9b6baa8 Removed Dict type from the imports 2023-07-10 01:08:46 +02:00
Gustavo Moreira 63c7719763 Fixed returned types. An empty string is now returned when no capability is enabled. 2023-07-10 01:01:30 +02:00
Mike Auty 239e164ce6 Windows: Fix strings plugin missing kernel pages 
@eve-mem spotted that we were only recording the first kernel page in
any contiguous set of kernel pages, thus missing some results.  This
should now be fixed.
 2023-07-09 23:50:13 +01:00
Gustavo Moreira 241cf832f9 Plugin parameters removed. Instead, it now shows each capability set in their textual representation. The dictionary was replaced by a dataclass. 
Last but not leas, CAP_FULL moved to constants.
 2023-07-10 00:07:40 +02:00
RuBublik abf1c2e03d fixed typos 2023-07-07 20:25:02 +03:00
RuBublik 524ff59107 bumped MINOR_VERSION to 2.5.2 after changes, and updated dependent thrdscan plugin's required version to this 2023-07-07 20:22:58 +03:00
Mike Auty 6c0ce1d130 Volshell: Typo Fixes #958 2023-07-01 20:58:36 +01:00
Mike Auty 66598f5b63 Core: Second fix is the charm... 2023-07-01 19:05:22 +01:00
Mike Auty c8e53ff16a Core: Fix small typing issue in previous patch 2023-07-01 19:02:51 +01:00
Mike Auty 50b5d2232b Core: Add type parameter to object_from_symbol 2023-07-01 19:00:03 +01:00
Mike Auty 1ff2d80b44 Documentation: Update basics - memory layer information 2023-07-01 17:02:10 +01:00