ikelos and GitHub
2dda3b4946
Merge pull request #549 from volatilityfoundation/feature/intel-coalesce-by-default
...
Layers: Coalesce intel mapping responses
2021-08-25 16:46:43 +01:00
Mike Auty
ece34139db
Mac: Standadize on kernel config name
2021-08-25 16:10:55 +01:00
Mike Auty
ad3560e1bc
Linux: Shift linux plugins to using kernel as their default module
2021-08-25 15:48:53 +01:00
Mike Auty
b90fd6bbb2
Automagic: Only traverse down intel layers
2021-08-24 21:59:18 +01:00
Mike Auty
27c5dfdffd
Plugins: Add in architectures for ModuleRequirement
...
Fixes #553
2021-08-24 21:47:47 +01:00
ikelos and GitHub
7bf3ac4a41
Merge pull request #551 from volatilityfoundation/feature/windows-kernel-module
...
Windows: Update to kernel ModuleRequirement for ease of config
2021-08-22 12:28:47 +01:00
Mike Auty
97da37d968
Windows: Update to kernel module for ease of config
2021-08-20 00:53:03 +01:00
Mike Auty
ab075ac667
Windows: Fix pstree physical/virtual offsets
2021-08-20 00:52:43 +01:00
Mike Auty
0aa59111df
Generic: YaraScanner fail on no rules
2021-08-19 23:06:55 +01:00
Mike Auty
260f879334
Core: Fix caching of pointer objects
2021-08-19 15:32:48 +01:00
Mike Auty
98db5e46d4
Windows: Remove hardcoded parameter in poolscanner
2021-08-19 11:12:05 +01:00
Mike Auty
db2ec8cfb2
Core: Ensure module configuration is recordable
2021-08-16 16:59:11 +01:00
x
ef27d07183
Add missing patch that fixes KERB_ECRYPT structure size
2021-08-13 15:06:48 +00:00
x
70750d2b92
Remove unused variable from plugin
2021-08-12 22:52:08 +00:00
ikelos and GitHub
5f276df35c
Merge pull request #484 from volatilityfoundation/skeleton_key_check_plugin
...
Skeleton key check plugin
2021-08-12 23:39:39 +01:00
x
d86b9b34e4
Fix return types, change confusing use of continue, switch to get_absolute_symbol_address
2021-08-12 15:47:16 +00:00
Mike Auty
19b2a06964
Layers: Coalesce intel mapping responses
2021-08-11 22:02:08 +01:00
Mike Auty
3ad20d566c
Automagic: Minor fixes for jar files and layers
2021-08-11 21:51:41 +01:00
Mike Auty
e7623baf45
Linux: Support None to turn off remote banner locations
2021-08-11 21:24:39 +01:00
Mike Auty
bb40a8a207
Automagic: Catch remote download exceptions
2021-08-11 21:22:03 +01:00
Mike Auty
3b2aae40d2
Automagic: Support remote banner versioning and chaining
2021-08-11 21:22:03 +01:00
Mike Auty
79b3be4cf6
Automagic: Add in remote banner cache first attempt
2021-08-11 21:22:03 +01:00
Mike Auty
4016b096c2
Core: Add in offline constant
2021-08-11 21:22:00 +01:00
ikelos and GitHub
595f377f19
Merge pull request #538 from volatilityfoundation/feature/better-modules-support2
...
Feature/better modules support
2021-08-11 21:09:24 +01:00
Mike Auty
86771d15d5
Core: Don't get to hasty with the API version
2021-08-11 21:08:33 +01:00
Mike Auty
2cfb65380a
Core: Include API changes file
2021-08-11 21:06:43 +01:00
Mike Auty
8745931dea
Windows: Add coalesce support to memmap
2021-08-05 17:28:36 +01:00
Mike Auty
1611a72eb9
Windows: Fix memmap not to create empty files
2021-08-05 16:21:48 +01:00
Mike Auty
058de2d9a8
Windows: Mute crypto warnings from lgtm
2021-08-04 22:25:13 +01:00
ikelos and GitHub
ee70c1c6ab
Merge pull request #540 from volatilityfoundation/feature/pdbconv-vs19
...
Feature/pdbconv vs19
2021-08-02 11:02:12 +01:00
Mike Auty
0343c8f81e
Windows: Pdbsan typing and doc fixes
2021-07-30 21:20:33 +01:00
Mike Auty
30eec0cb76
Windows: Ensure the kernel contains an actual kvo
2021-07-30 00:17:26 +01:00
Mike Auty
e793956e02
Windows: Update netscan offsets for win10-17763-x64 ( #478 )
2021-07-29 00:17:22 +01:00
Mike Auty
fda1512273
Windows: Fix pdbconv handling of unknown types
2021-07-29 00:05:36 +01:00
Frank Gomulka
7311f24149
Comment and Pydoc changes
2021-07-28 08:38:53 -04:00
Frank Gomulka
6f4ff5f2df
Add patch for driverscan for windows 7 and earlier
...
This patches an issue for some versions of windows that require the
bottom-up approach for finding the size of "object body" by
recognizing additional structures occupying the "object body"
position. The sizes of these additional structures are added to
the size of `_DRIVER_OBJECT` to more accurately compute the actual
size of "object body".
2021-07-28 08:38:53 -04:00
Andrew Case
f6c1e0eafc
Fix several code paths that could infinite loop and were triggered based on @fgomulka testing
2021-07-27 21:31:07 +00:00
ikelos and GitHub
d1173b07ee
Merge pull request #545 from volatilityfoundation/skip_invalid_socket_references
...
Skip invalid sockets in netstat enumeration, based on @fgomulka testing
2021-07-27 22:23:47 +01:00
ikelos and GitHub
0c925a49a8
Merge pull request #544 from volatilityfoundation/improve_mac_vnode_handling
...
Cleanup vnode processing and smear protection based on @fgomulka testing
2021-07-27 22:23:07 +01:00
Andrew Case
c9232ab7b5
Skip invalid sockets in netstat enumeration, based on @fgomulka testing
2021-07-27 20:04:24 +00:00
Andrew Case
c1bf63db83
Adding missing change for pointer_to_string exception catching
2021-07-27 19:59:28 +00:00
Andrew Case
63b4c60d3b
Cleanup vnode processing and smear protection based on @fgomulka testing
2021-07-27 19:51:55 +00:00
ikelos and GitHub
01a63ff331
Merge pull request #499 from gcmoreira/kmsg-plugin
...
Linux kernel ring buffer reader plugin
2021-07-26 21:48:18 +01:00
Mike Auty
deaa86f625
Windows: Ensure we emit LF_STRUCTURE_VS19 types
2021-07-24 23:01:11 +01:00
Mike Auty
9358700553
Windows: Refactor PDB code and support VS19 new types
2021-07-24 22:39:02 +01:00
Mike Auty
6fdf6e9e9f
Windows: Convert pslist as an example
2021-07-22 22:46:39 +01:00
Mike Auty
cd2f40bc34
Mac: Update all plugins to ModuleRequirement
2021-07-22 22:42:06 +01:00
Mike Auty
1480aca453
Linux: Update all plugins to ModuleRequirement
2021-07-22 22:40:09 +01:00
Mike Auty
abbd516f99
Layers: Add minimum framework requirements
2021-07-22 22:37:58 +01:00
Mike Auty
31dc6f34c9
Automagic: Make symbol_shift automagic change
2021-07-22 22:37:58 +01:00
