WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 17:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,288 Commits 80 Branches 17 Tags
67a83871adac20171a862d55dcafe5ab383c024b
Commit Graph
5288 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
superponibleandikelos a4301afe22 issue #186 - skip type check on CMHIVE 2020-05-27 23:16:18 +01:00
superponibleandikelos 0de87e5bce fix off by one and loop counters 2020-05-27 23:14:26 +01:00
Mike Auty 84e9b92d71 Development: Allow for debian packages in stock converter. 2020-05-25 23:44:43 +01:00
Mike Auty 27660d62ee Development: Add in fedora kernel locations. 2020-05-25 02:04:43 +01:00
Mike Auty 48d3fb8f98 Development: Add in simple script to create centos ISF files 2020-05-24 21:56:28 +01:00
Mike Auty 94426ad313 Automagic: Ensure all layers can be reconstructed 2020-05-10 19:30:58 +01:00
Mike Auty 09dd048834 Documentation: Minor fixes for recent documentation 2020-05-10 17:31:26 +01:00
Mike Auty 6e91349c73 Documentation: Add in information about creating layers. 2020-05-09 02:07:08 +01:00
Mike Auty 0c43beb42d Core: Apply yapf across all files again. 2020-05-05 22:14:33 +01:00
Mike Auty 4587de356d Fix issue with cleaning the symbol cache 2020-05-02 01:16:06 +01:00
Mike Auty edecd64703 Yarascan: Fixes #209 by returning matched strings 2020-04-14 23:45:08 +01:00
Mike Auty 15d26ce415 Linux: Remove parameters that are unnecessary/removed. 2020-04-10 22:38:21 +01:00
Mike Auty 01ef78db11 Fix a typo in the last commit 2020-04-10 22:19:24 +01:00
Mike Auty 8935e4dd19 Fix up linuxutils to use symbol_tables rather than hard coded values 2020-04-10 22:12:03 +01:00
Andrew Caseandikelos 719cd0d476 Move module gathering into generator 2020-04-08 18:17:34 +01:00
Andrew Caseandikelos b42dfd614a Add API for mapping kernel addresses to kernel symbols or a specific kext 2020-04-08 18:17:34 +01:00
Michael Ligh d5bdf9633d refs #204 fix modscan, _LDR_DATA_TABLE_ENTRY is not an executive object and doesn't have an object_type 2020-04-07 09:22:52 -05:00
Mike Auty 2cd6a9478f Intermed: Resolve unintended change of length to size and issue with anonymous checking 2020-04-03 00:00:57 +01:00
Mike Auty 83ef338a6e Fix the typos as spotted by eagle-eyed Ilya, thanks! 2020-03-26 13:32:30 +00:00
Mike Auty b08a2e47d7 Schemas: Implement changes in comments from dwarf2json#11 2020-03-26 13:32:30 +00:00
Mike Auty 919c4cb0dd Schema: Add in more specifics for linux/mac specification 2020-03-26 13:32:30 +00:00
Ilya Chukhmanandikelos a5c19abe87 add mac metadata object to 6.2.0 schema 2020-03-26 13:32:30 +00:00
Mike Auty be1faa91a5 Initial attempt at resolving anonymoous fields. 2020-03-26 13:32:30 +00:00
Mike Auty bd2a382d88 CLI & windows.handles: Improve exception handling 2020-03-16 22:34:03 +00:00
Mike Auty b8bc0f0ed6 mac.netstat: Fix up typing and interface imports 2020-03-12 19:53:51 +00:00
Andrew Caseandikelos 7d6d74bc91 Update order of arguments 2020-03-12 19:47:15 +00:00
Andrew Caseandikelos 722700d2dc Add docstrings 2020-03-12 19:47:15 +00:00
Andrew Caseandikelos 7b21e83b07 Mac - convert socket gathering to class method and clean up associated code 2020-03-12 19:47:15 +00:00
Mike Auty 640afdda2c Layers: Add in NonLinear Segmented layers 2020-03-04 20:29:42 +00:00
Mike Auty a745503b72 Layers: Make the linear/non-linear changes minimal 2020-03-04 20:29:42 +00:00
Mike Auty df804928b5 Layers: Alter the decode method to take data directly 2020-03-04 20:29:42 +00:00
Mike Auty 87dc98655b Layers: Fix up an intel inaccuracy in mapping sizes 2020-03-04 20:29:42 +00:00
Mike Auty e089314898 Layers: Add pad option to the decode/encode steps 2020-03-04 20:29:42 +00:00
Mike Auty ca9d7075d3 Layers: Refactor the decode/encode methods 2020-03-04 20:29:42 +00:00
Mike Auty 77be83edc4 Layers: Change mapping signature to return domain length 2020-03-04 20:29:42 +00:00
Mike Auty a2ac55ba0b Wintel: Reorder the DTB tests 
Reorder the DTB tests, since 64-bits have more to match and are likely
more common these days.  We've had an instance where a 32-bit DTB was
detected because of a self-referential pointer over a 64-bit DTB leading
to an inaccessible image.

This fixes issue #193.
 2020-03-04 20:28:52 +00:00
Mike Auty 7c260ce4bd Crashdump: Ensure the number of runs is reflected in the array length 2020-02-29 18:47:34 +00:00
Mike Auty 3a824b519e CLI: Show choices options when no argument provided 
Fixes issue #191.
 2020-02-15 13:23:19 +00:00
Tamas K Lengyelandikelos 6a6cf37b02 pdbconv: save _imp functions in JSON 2020-02-14 09:20:15 +00:00
Andrew Caseandikelos a60bef3283 Mac - update queue walking code 2020-02-12 21:04:23 +00:00
Andrew Caseandikelos 5a99d35a9e update timer code 2020-02-12 19:56:37 +00:00
Michael Lighandikelos 4c7f2a3762 catch InvalidAddressException when traversing left and right child VADs (triggered on terminated processes) 2020-02-12 19:19:27 +00:00
Andrew Caseandikelos ab42f0941c Add sysctl docstrings and return types 2020-02-12 19:17:19 +00:00
Andrew Caseandikelos 29cc435b5e update sysctl v2 2020-02-12 19:17:19 +00:00
Mike Auty 7873a65999 Procdump: Don't loop through twice without good reason. 2020-02-12 19:07:24 +00:00
Mike Auty 920b85743b Revert "Automagic: Add excessive debugging to symbol cache" 
This reverts commit db8ba4029c.
 2020-01-30 01:58:07 +00:00
Mike Auty c4829ccca3 Caching: Add clear-cache option (except hashcaches) 2020-01-30 01:57:48 +00:00
Mike Auty db8ba4029c Automagic: Add excessive debugging to symbol cache 2020-01-30 01:34:30 +00:00
Mike Auty 6e38727ffe Mac: Refactor/optimize repeated code. 2020-01-28 01:37:21 +00:00
Mike Auty f111e9e051 Mac: Ensure queues error check all entries, not just the first. 2020-01-28 01:37:21 +00:00