Frank Gomulka
3919c909bc
Comment and Pydoc changes
2021-09-19 16:04:17 -04:00
Frank Gomulka
54203e0253
Add patch for driverscan for windows 7 and earlier
...
This patches an issue for some versions of windows that require the
bottom-up approach for finding the size of "object body" by
recognizing additional structures occupying the "object body"
position. The sizes of these additional structures are added to
the size of `_DRIVER_OBJECT` to more accurately compute the actual
size of "object body".
2021-09-19 16:04:13 -04:00
Mike Auty
95713fc7ac
Core: Change Module to ConfigurableInterface
2021-09-19 01:33:10 +01:00
Mike Auty
dd35e78dd0
Linux: Fix kmsg plugin
2021-09-19 01:32:39 +01:00
Mike Auty
9e3d1bdc26
Core: Fix module size finding
2021-09-19 01:05:23 +01:00
ikelos and GitHub
1af0c2185d
Merge pull request #546 from volatilityfoundation/mac_list_files_infinite_loops
...
Fix several code paths that could infinite loop and were triggered ba…
2021-09-15 20:32:12 +01:00
ikelos and GitHub
8409e2df83
Merge pull request #559 from volatilityfoundation/feature/unify-dtb-selfref-checks
...
Feature/unify dtb selfref checks
2021-09-15 20:25:36 +01:00
ikelos and GitHub
cb4cc7805f
Merge pull request #563 from NiklasBeierl/doc_list_head
...
Doc: list_head.to_list, pslist pid 0
2021-09-12 14:59:19 +01:00
Mike Auty
cc26494b7b
Automagic: Don't churn memory as much
2021-09-12 13:21:17 +01:00
Mike Auty
48e802e255
Automagic: Ensure reserved bits are for valid pages
2021-09-12 12:55:42 +01:00
Mike Auty
807662c41f
Automagic: Prioritize tests in order
2021-09-12 12:36:35 +01:00
Mike Auty
ee2a868c97
Automagic: Windows 32-bit bit 7 is not always 0
2021-09-12 11:35:44 +01:00
Mike Auty
86afc8fb0c
Automagic: Actually use reserved_bits
2021-09-08 22:42:58 +01:00
Mike Auty
ca047c1fd5
Revert "Automagic: Sort DTB results by test"
...
This reverts commit 75feba0099
2021-09-08 21:46:35 +01:00
Mike Auty
75feba0099
Automagic: Sort DTB results by test
2021-09-08 21:31:45 +01:00
Mike Auty
76d319c83a
Automagic: Improve reserved bit detection for PAE
2021-09-08 20:50:38 +01:00
Niklas Beierl
bef1a0f654
Doc: list_head.to_list, pslist pid 0
...
Added Documentation for the params of list_head.to_list
Added a comment to linux.pslist explaining why the init task is not yielded.
2021-09-08 12:04:28 +02:00
Mike Auty
02a1ff31b4
Automagic: Extended the possible DTB locations for Win 11
2021-09-07 09:25:39 +01:00
Mike Auty
4b3fc58c9f
Mac: Finish the previous LGTM clean-up
2021-09-06 20:21:29 +01:00
ikelos and GitHub
9908fa54a9
Merge pull request #406 from volatilityfoundation/plugin-zips
...
Plugin zips
2021-09-05 15:51:12 +01:00
Mike Auty
853b0376ce
Core: Change zipimporting code
...
The previous patch in this branch would allow passing zipfiles
as part of the plugin path list. Instead, we now traverse any
zipfiles in the plugin directories and load them based on where
they are. The filenames for the zip files aren't important.
2021-09-05 15:49:21 +01:00
Mike Auty
10aa2f7620
Core: Support zip files as plugin paths
2021-09-05 15:49:21 +01:00
Mike Auty
ced2dbe67d
Mac: Remove unused code (LGTM)
2021-09-05 15:44:30 +01:00
Mike Auty
7d7a8e4c2e
Linux: Remove unused code (LGTM)
2021-09-05 15:44:12 +01:00
ikelos and GitHub
d0a963b070
Merge pull request #557 from volatilityfoundation/issues/issue556
...
Windows: Pstree loop protection
2021-09-05 12:58:58 +01:00
ikelos and GitHub
df5df3dbe4
Merge pull request #561 from volatilityfoundation/issues/issue_547_regvaluetype_usage
...
Correct usage for RegValueTypes enum
2021-09-05 12:50:45 +01:00
Mike Auty
17efe7dbdc
Windows: Fix issue #385
2021-09-05 12:48:32 +01:00
Mike Auty
e9e80035eb
Linux: Fixes after the pslist kernel req change
2021-09-04 15:28:57 +01:00
superponible
6492a458db
correct usage for RegValueTypes enum
2021-09-03 17:32:57 -05:00
Mike Auty
be54de140e
Automagic: Better check for bad DTBs
2021-09-03 15:44:36 +01:00
Mike Auty
66ec8ff841
Automagic: Further sections for older windows
2021-09-03 15:27:08 +01:00
Mike Auty
d17ad710f2
Automagic: Remove unused old code
2021-09-02 23:01:26 +01:00
Mike Auty
4b56ee4c73
Automagic: Increase windows self-ref segment for win7
2021-09-02 23:01:05 +01:00
Mike Auty
bb3f411e22
Automagic: Add a section for where old kernels live
2021-09-02 22:54:25 +01:00
Mike Auty
03136d1469
Automagic: Clean up the windows self-referential dtb finder
2021-09-02 22:51:32 +01:00
Mike Auty
5d030263ea
Windows: Totally revert broken merge issue505-2
2021-09-02 21:50:24 +01:00
Mike Auty
3f0f5fb29c
Windows: Reduce the full automagic range *again* 5:\
2021-09-02 17:05:35 +01:00
ikelos and GitHub
3072a584cb
Merge pull request #511 from volatilityfoundation/issues/issue505-2
...
Windows: Ensure DTBs don't have all valid entries
2021-09-02 13:11:41 +01:00
Mike Auty
4634a146c7
Windows: Pstree loop protection
2021-09-02 02:11:32 +01:00
ikelos and GitHub
6b3396f4cc
Merge pull request #555 from shu-tom/develop
...
Fixed an issue where the symbol file download from the Microsoft site failed
2021-08-30 13:48:34 +01:00
shusei tomonaga
b43712f9f4
Fixed an issue where the PDB guid value was not zero padded.
2021-08-30 21:24:47 +09:00
ikelos and GitHub
7626f60bb4
Merge pull request #526 from volatilityfoundation/feature/linux-mac-repo
...
Feature/linux mac repo
2021-08-30 12:42:59 +01:00
Mike Auty
e6547a2d5e
Revert "CLI: Verify improvement for buildbot"
...
This fix for buildbot didn't seem to have any effect
This reverts commit 57e1243932
2021-08-28 00:34:11 +01:00
Mike Auty
57e1243932
CLI: Verify improvement for buildbot
2021-08-27 22:23:33 +01:00
ikelos and GitHub
35713bb6d8
Merge pull request #554 from volatilityfoundation/feature/linux-mac-windows-unify-config
...
Feature/linux mac windows unify config
2021-08-27 22:20:43 +01:00
Mike Auty
f082c1c8cc
Objects: Fix up pointer caching to default to native layer
2021-08-26 17:25:03 +01:00
Mike Auty
b1156fa0a1
Automagic: Remove the superfluous num_entries fields
2021-08-26 16:18:27 +01:00
Mike Auty
1e1b3fda36
Windows: Fix up typo in num_entries parameter
2021-08-26 14:05:53 +01:00
Mike Auty
2371c1158d
Windows: Ensure DTBs don't have all valid entries
...
We were finding that PAE results were being masked by certain pages with
64bit results. The DTBs could be distinguished from good DTBs because
every entry was valid (which for a 64-bit or even 32-bit DTB is
extremely unlikely except on systems with *vast* quanties of memory.
As such, this now tests for all entries being allocated and doesn't return the
DTB if this is the case.
2021-08-26 11:50:04 +01:00
Mike Auty
aa1c24e60a
Core: Make pointer caching more accurate
2021-08-26 11:43:32 +01:00
Frank Gomulka