WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 17:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,288 Commits 80 Branches 17 Tags
67a83871adac20171a862d55dcafe5ab383c024b
Commit Graph
5288 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mike Auty 5135215c62 Do some tidying and renaming. 2018-12-13 15:56:24 +00:00
Mike Auty 7a462d5f85 Refactor out the shared symbol cache/finder code from linux and mac. 2018-12-13 15:56:24 +00:00
Mike Auty 55286f04cb Consolidate identical code into a single symbol cache, add mac automagic list and pycharm reformat. 2018-12-13 15:56:24 +00:00
Andrew Caseandikelos 622c86f9ed Add initial mac backend code, with broken DTB finding, along with the pslist plugin 2018-12-13 15:56:24 +00:00
Mike Auty c9a08603c7 Move the get_requirements over to the IntermedSymbols which actually requires the parameter. 2018-12-13 01:39:26 +00:00
Mike Auty 5e8ba16709 Remove the unimplemented hook. 2018-12-13 01:16:05 +00:00
Mike Auty dfaaf1e455 Fix up some things missed in the master refactor. 2018-12-13 01:16:05 +00:00
Mike Auty 7c4cb0d291 Remove attempts to improve speed that may not help. 2018-12-13 01:16:05 +00:00
Mike Auty da2f3b38d3 Add in page-table repetition blocking code (helps with windows 10 virtual space). 2018-12-13 01:16:05 +00:00
Michael Lighandikelos 736a1c6e50 add is_valid() for _FILE_OBJECT and _EPROCESS 2018-12-13 01:16:05 +00:00
Mike Auty 91b2c61803 Try to add some optimizations to intel scanning. 2018-12-13 01:16:05 +00:00
Mike Auty a16fb3bf7d Don't break on validity tests. 2018-12-13 01:16:05 +00:00
Mike Auty 76264cee34 Catch invalid _OBJECT_HEADER objects. 2018-12-13 01:16:05 +00:00
Michael Lighandikelos 650a188d51 updates for win8/win10 poolscanning 2018-12-13 01:16:05 +00:00
Mike Auty fa033b8ab7 Back out the symbol_table_name parameter, and provide full symbol names in the constraints. 2018-12-13 01:16:05 +00:00
Mike Auty eacc45dab6 Ensure POOL_HEADER finds the right object in the right symbol table. 2018-12-13 01:16:05 +00:00
Michael Lighandikelos 4c68da8b06 move the functionality for getting an object's type into the _OBJECT_HEADER extension 2018-12-13 01:16:05 +00:00
Michael Lighandikelos 4b0e7e5309 remove the Path column from poolscanner. add File scanning 2018-12-13 01:16:05 +00:00
Michael Lighandikelos d653839359 switch Handles.find_cookie() to a classmethod so it can be called from the poolscanner. add typing 2018-12-13 01:16:05 +00:00
Michael Lighandikelos d667a68f97 switch Handles.list_objects() to a classmethod so it can be called from the poolscanner. pass the type_map into get_object() 2018-12-13 01:16:05 +00:00
Michael Lighandikelos a76d71a7dc move the functionality for getting an object's type into the _OBJECT_HEADER extension 2018-12-13 01:16:05 +00:00
Mike Auty b148305f76 Add in protection for the Lime Layer being unable to read the header. 2018-12-12 23:42:31 +00:00
Mike Auty 8acbe8bba3 Refactor conversion code from objects.utility to a conversion module in renderers. 2018-12-12 23:39:10 +00:00
Mike Auty 1a5c9d3af8 Roll symbols.utility into symbols file until we get enough functions we need to split them out again. 2018-12-12 23:38:01 +00:00
Mike Auty 67f5230d77 Ensure the plugins are appropriately sorted when listing them. 2018-12-09 13:32:51 +00:00
Mike Auty f57bfa5738 Prepare core plugins for moving into the framework namespace. 2018-12-09 13:32:32 +00:00
Mike Auty cf95f6e73e Minor typing fix. 2018-12-08 18:41:13 +00:00
Mike Auty 323ea0f348 Add in the timeliner interface to the linux bash plugin. 2018-12-08 18:26:45 +00:00
Mike Auty b5d532555c Convert the adhoc scanner into a layer scanner using sections. 2018-12-08 18:21:39 +00:00
Mike Auty 649a39a13d Change time_as_integer from a property to get_time_as_integer method. 2018-12-08 18:00:44 +00:00
Mike Auty 918653e398 Convert aslr_mask_symbol_table to more parameterized form. 2018-12-08 17:55:13 +00:00
Mike Auty 378820bf23 More 'inheritance' fixes. 2018-12-08 17:45:28 +00:00
Mike Auty 780c5d2646 Avoid 'inheritance' issues with requirements. 2018-12-08 17:43:28 +00:00
Mike Auty f1780bc547 Use constants.BANG (plus pycharm autoreformat). 2018-12-08 17:34:48 +00:00
Andrew Caseandikelos dc91a16a2f update check syscall 2018-12-08 17:34:48 +00:00
Andrew Caseandikelos ade6aa1e74 update check_afinfo for write member 2018-12-08 17:34:48 +00:00
Andrew Caseandikelos 9d9b68eaa3 have check_afinfo not inherit from lsmod 2018-12-08 17:34:48 +00:00
Andrew Caseandikelos 8705fb3047 update time_object to get_time_object 2018-12-08 17:34:48 +00:00
Andrew Caseandikelos 0e7b6b6702 Updated hist_entry type and references, add bash plugin 2018-12-08 17:34:48 +00:00
Andrew Caseandikelos 3ab654847e Change NotApplicableValue -> UnparsableValue 2018-12-08 17:34:48 +00:00
Andrew Caseandikelos c6e9763e5a Linux - add bash plugin 2018-12-08 17:34:48 +00:00
Andrew Caseandikelos 36131d01bb Add check_afinfo plugin 2018-12-08 17:34:48 +00:00
Andrew Caseandikelos 72798d3187 Add linux system call checking plugin 2018-12-08 17:34:48 +00:00
Mike Auty 34ed11bfc0 Fix up issue with coalescing sections. 2018-12-07 01:47:16 +00:00
Mike Auty aaeb349a70 Remove debugging call. 2018-12-07 01:47:16 +00:00
Mike Auty 4fabb762d2 Make some typing fixes and remove specification of the iterator. 2018-12-07 01:47:16 +00:00
Mike Auty 5a331f9f01 A few remaining changes due to the API aleration. 2018-12-07 01:47:16 +00:00
Mike Auty 341b9b8f9e Add in initial changes for scanner sections. 2018-12-07 01:47:16 +00:00
Mike Auty 3f2f3cd2f3 Add a reminder to fix up the API in this place. 2018-12-03 21:52:29 +00:00
Mike Auty 4703f192e4 Add in a check to ensure mappings that ignore errors don't cause errors. 2018-12-01 21:33:09 +00:00