WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 17:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,288 Commits 80 Branches 17 Tags
67a83871adac20171a862d55dcafe5ab383c024b
Commit Graph
5288 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
ikelosandGitHub cc3818391c Merge pull request #405 from volatilityfoundation/issues/mac_vpager_native_layer 
Linux: Use native_layer when constructing from a pointer offset
 2021-01-06 21:05:00 +00:00
ikelosandGitHub b3339437fb Merge pull request #404 from volatilityfoundation/issues/bad_dtb_finder_code 
Automagic: Windows DTB finder was too limited
 2021-01-06 21:04:07 +00:00
ikelosandGitHub a6f176ac28 Merge pull request #402 from volatilityfoundation/feature/better-object-description 
Objects: Make repr(object) more useful
 2021-01-06 21:01:18 +00:00
Mike Auty 7db3e81850 Merge branch 'release/v2.0.0' into develop 2021-01-06 20:59:08 +00:00
Mike Auty e1032623fe Layers: Ensure intel PAE reports pae in the metadata 2021-01-06 19:28:24 +00:00
iMHLv2 d7d176d040 add Is64Bit and IsPAE properties to the windows.info plugin 2021-01-06 11:36:56 -06:00
iMHLv2 53397117ef remove unnecessary and unused imports from the windows extensions init file 2021-01-06 10:30:01 -06:00
iMHLv2 2c3b6668d5 refs #368 fix handles on 32-bit windows 8 and 10 - finding SAR is not necessary on these versions 2021-01-06 10:10:51 -06:00
Mike Auty f75e77997d Layerwriter: Remove erroneous debugging statements 2021-01-03 10:38:49 +00:00
Mike Auty d1b10781d4 CLI: Parse windows file as files not URIs 
Fixes #408
 2020-12-30 18:06:41 +00:00
Jan 71e48cc672 complex objects are not passed as arguments directly anymore, but rather by offset 2020-12-28 21:51:28 +01:00
Jan f731ceba3a optimizations as raised by #397 2020-12-28 21:22:50 +01:00
Mike Auty 1c2a9921ff Windows: Partial fix for #368 error messages 2020-12-27 15:21:18 +00:00
Mike Auty feefc93adc CLI: Fix inaccurate documentation 2020-12-27 15:21:18 +00:00
Mike Auty 991a0a1091 Objects: Make repr(object) more useful 2020-12-22 17:11:46 +00:00
Jan 0e136b9437 adds partition_table type to ISFs 2020-12-22 17:18:20 +01:00
Jan 2e70a9cb45 addresses issues raised in pr #399 2020-12-22 17:11:55 +01:00
Mike Auty f262821924 Documentation: minor bugfix 2020-12-21 17:07:51 +00:00
Mike Auty ccef55e448 Linux: Use native_layer when constructing from a pointer offset 2020-12-21 15:57:18 +00:00
Mike Auty c45b1b3423 Automagic: Windows DTB finder was too limited 
The DTB finder test returns a full DTB, if that's over the scan chunk
size it'll get discarded, so we remove that test.
 2020-12-21 15:52:43 +00:00
Jan bcc79d4cb9 better documentation and support for more x64 Windows versions 2020-12-19 17:13:53 +01:00
Mike Auty 1abc65c2ac CLI: Fix inaccurate documentation 2020-12-11 16:04:13 +00:00
Mike Auty f9102a60b8 Release: Update the version number for this release 
Entering code-freeze
10th Dec - Bug fixes and documentation, no new features
7th Jan - Only critical fixes
21st Jan - Release date
 2020-12-10 22:42:39 +00:00
Andrew Caseandikelos 93c6a62972 Detect attempts to fix the image base for LARGEADDRESSAWARE executables and provide the user with a warning. #332 2020-12-10 18:58:00 +00:00
Mike Auty d63aef566f Codebase: Yapf the codebase again 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos 747fe8609f update copywrite to 2020 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos 17e629a4c4 converted process_file_object into a classmethod 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos e9f870ff05 revert self.context change back to self._context 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos 9f977080c5 changed self._context to self.context 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos d98337cc09 added debug statements to dump_file_producer when none is returned 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos 4f37a28185 dump_file_producer is now a classmethod and returns a FileInterface Object 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos 49acf44302 dumpfiles.py is now consistent with master and runs correctly 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos 8e1a599203 changed PluginRequirement to VersionRequirement 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 0a9e663c41 remove the _VACB.is_valid() method - do all validity checks in the calling function 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 442f877e9a refs #197 initial commit of windows.dumpfiles 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 20f4fbf157 add --virtaddr and --physaddr options so users can supply virtual or physical addresses (or both) 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 0c09b98318 use native_layer_name in file_name_with_device() in case the FILE_OBJECT is instantiated from a memory (physical) layer 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 25b56b5ca4 remove the _VACB.is_valid() method - do all validity checks in the calling function 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 3ac89577cc refs #197 initial commit of windows.dumpfiles 2020-12-10 15:37:40 +00:00
Mike Auty 56ff75a74b Layers: Add internal intel debugging flag 2020-12-10 12:18:14 +00:00
Mike Auty db86aeb861 Volshell: Fix up filename/location confusion 2020-12-10 12:17:39 +00:00
Mike Auty b759ff3966 Volshell: Clarify load_file to accept location and filename 2020-12-10 10:07:44 +00:00
Mike Auty dbda8998bc Volshell: Make it easier to make configurables 2020-12-10 10:07:44 +00:00
Jan 972d3d7076 netlist for 16299 and 17134 2020-12-08 20:04:03 +01:00
Mike Auty e28016e45b Pdbutility: Improve usability of symbol_table_from_offset 2020-12-08 16:34:59 +00:00
Janandikelos 3dea2b4187 adds os_distinguisher for 18363 2020-12-08 10:34:07 +00:00
Janandikelos b3ffddcff0 fixes wrong offset in 18363 x64 2020-12-08 10:34:07 +00:00
Janandikelos 774528206c adds new vol3 netscan profiles and fixes rare bug 2020-12-08 10:34:07 +00:00
Mike Auty 84741c30fd Documentation: Make improvements based on feedback from NiklasBeierl 2020-12-07 23:13:22 +00:00
Mike Auty 754cfcd7ac Documentation: Add more detail on writing objects 
Fixes #390
 2020-12-06 23:55:49 +00:00