WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 09:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,288 Commits 80 Branches 17 Tags
67a83871adac20171a862d55dcafe5ab383c024b
Commit Graph
5288 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
ikelosandGitHub 068a604a8b Merge pull request #1397 from j-t-1/library 
Modify using as a library documentation
 2024-12-17 19:36:24 +00:00
ikelosandGitHub 49ad2bdd21 Merge pull request #1422 from dgmcdona/dgmcdona/pedump_contextmanager 
Windows: PeDump - use contextmanager
 2024-12-17 19:35:10 +00:00
David McDonald b04ca88d07 Windows Extensions: Fixes type-hint on list_timers 
This method is incorrectly type-hinted as returning a `Tuple` when it
should be returning an instance of the `KTIMER` extension class. This
leaves the version number as is since it only updates the type-hint, but
let me know if that's incorrect and we need to bump it.
 2024-12-17 13:29:51 -06:00
j-t-1andGitHub 6e3defc677 Merge branch 'volatilityfoundation:develop' into library 2024-12-17 19:22:48 +00:00
j-t-1andGitHub 24e1904376 Modify using as a library documentation 
Tiny changes.
 2024-12-17 19:22:35 +00:00
David McDonald 9ef90c2091 Windows: PeDump - use contextmanager 
Several tools, including pyright and PyCharm, report that `file_handle`
may be an unbound local. Regardless of whether or not this is likely to
happen in practice, it makes sense to just use a `ContextManager` here
anyway, since `FileHandlerInterface` implements it.
 2024-12-17 13:17:27 -06:00
Mike Auty 1b8f831fda Core: Also fix up the interface to match the concrete classes 2024-12-17 18:37:39 +00:00
Mike Auty a0b169cf6b This PR does not strictly change any interfaces, just the inner workings of a function. 2024-12-17 18:34:40 +00:00
Mike Auty f0f3bb6558 Core: Start to fix up the typing in ModuleCollection 
Fixes #1418
 2024-12-17 18:31:45 +00:00
Mike Auty c45beb3ebe Automagic: Fixes #1417 2024-12-17 18:15:59 +00:00
Mike Auty 246d19c0fa Windows: Fix black issue 2024-12-17 18:14:29 +00:00
Mike Auty 054f0496c1 Windows: Cannot use capstone typing information if capstone didn'tr import 2024-12-17 17:55:52 +00:00
ikelosandGitHub 6c1614de6c Merge pull request #1414 from gcmoreira/fix_producer_maetadata_bug_introduced_in_1369 
Fix ProducerMetadata class bug introduced in #1369
 2024-12-17 17:48:45 +00:00
TheMythologist 0255151ef5 Fix: Error early if no inodes are found in linux.pagecache.InodePages plugin 2024-12-17 12:15:46 +08:00
Gustavo Moreira 74ff42a12d Fix ProducerMetadata class bug introduced in #1369 2024-12-17 13:28:57 +11:00
Gustavo Moreira 02f17af8a6 linux: fix task parent pid in several plugins. 
It also adds a method to get the correct one in a unified way from the task object extension
 2024-12-17 12:09:29 +11:00
ikelosandGitHub 0b04a138ad Merge pull request #1389 from dgmcdona/dgmcdona/24H2_handles_pointer_decoding 
fix(Windows: Handles): Unreliable SAR value on 24H2
 2024-12-17 00:20:05 +00:00
David McDonald fd9d3ec04c Windows: Typing - Remove type casts, add signature 
Removes the needless `int` casts, and adds the return type to the
`get_session_id` method signature.
 2024-12-16 18:17:42 -06:00
ikelosandGitHub b083549e33 Merge pull request #1393 from gcmoreira/linux_pagecache_dumping_convention_1392 
Linux: Update inode pagecache plugin to conform to framework dumping convention
 2024-12-17 00:17:37 +00:00
ikelosandGitHub 03c3488458 Merge pull request #1070 from vobst/add-sanity-check-find_aslr-linux 
Linux: add sanity check in `find_aslr`
 2024-12-17 00:05:09 +00:00
David McDonald 7299f925dc Windows: Handles - major version bump 
Bumps the major version in plugin + dependences after removal of a
publicly exposed instance method.
 2024-12-16 17:58:53 -06:00
ikelosandGitHub 2cdc0fea5d Merge pull request #1406 from j-t-1/intel 
Remove use of int function after math.ceil
 2024-12-16 23:54:37 +00:00
ikelosandGitHub 793039b6a3 Merge pull request #1402 from TheMythologist/develop 
Refactor: move version `None` check to top
 2024-12-16 23:45:07 +00:00
ikelosandGitHub b037a486b5 Merge pull request #1405 from gcmoreira/fix_dentry_prior_kernels_3.19 
Linux - Fix dentry type support for kernels pre 3.19
 2024-12-16 23:42:25 +00:00
ikelosandGitHub dc4eedb3f9 Merge pull request #1403 from j-t-1/text_renderer 
Tiny change text_renderer.py
 2024-12-16 23:30:33 +00:00
ikelosandGitHub 71de86d19d Merge pull request #1398 from j-t-1/manual 
Update the CLI manual documentation
 2024-12-16 23:25:24 +00:00
Gustavo Moreira 267c5a60c3 Linux: PageCache: Remove unused variable 2024-12-17 10:05:38 +11:00
ikelosandGitHub d2725b6a00 Merge pull request #1394 from j-t-1/linux 
Tweak the getting started linux tutorial
 2024-12-16 22:46:44 +00:00
ikelosandGitHub 2fd9dd8a52 Merge pull request #1395 from j-t-1/mac 
Tweak the getting started mac tutorial
 2024-12-16 22:45:40 +00:00
ikelosandGitHub 88537066fa Merge pull request #1396 from j-t-1/windows 
Tweak the getting started windows tutorial
 2024-12-16 22:44:32 +00:00
j-t-1andGitHub b37923c183 Remove use of int function after math.ceil 
Return type of math.ceil is already an int.
 2024-12-16 17:08:37 +00:00
j-t-1andGitHub 02b11b44a2 Remove use of int function after math.ceil 
Return type of math.ceil is already an int.
 2024-12-16 16:59:58 +00:00
Gustavo Moreira 3b0f0915c7 linux: page_cache: add testcase for page_cache.files plugin 2024-12-16 19:36:54 +11:00
Gustavo Moreira bb1ff69e42 linux: dentry: Fix dentry type support for kernels pre-3.19 2024-12-16 19:25:24 +11:00
j-t-1andGitHub c8c39837ab Tiny change text_renderer.py 2024-12-15 19:26:22 +00:00
TheMythologist 5086be30b2 Refactor: move version None check to top 2024-12-15 14:04:15 +08:00
j-t-1andGitHub 31492f4ab8 Rectify maximum repetition of verbose flag 
From four to six (-vvvvvv).
 2024-12-14 15:50:50 +00:00
David McDonald e8b3185528 Windows: Handles - New pointer calculation method 
After researching this structure (`_HANDLE_TABLE_ENTRY`), it appears to
be stable as far back as Windows 8. It's also a union, with an
`ObjectPointerBits` member at the same offset as `LowValue` but within a
specific bit range (bit length 44, bit position 20). Taking this value
and shifting it left by four produces the correct pointer. This four-bit
shift is due to 16-byte alignment of object header structures, and is
what we would expect to see with 44-bit pointers in Windows. See
https://www.alex-ionescu.com/behind-windows-x64s-44-bit-memory-addressing-limit/
 2024-12-13 10:47:12 -06:00
David McDonald 04517ca797 Windows: Handle missing _MM_SESSION_SPACE 
As of Windows 11 24H2, the `_MM_SESSION_SPACE` type no longer appears in
the kernel PDB. Instead, the `_EPROCESS.Session` member refers to a new
type, `_PSP_SESSION_SPACE`, which does not have a type definition.
However, experimentation has shown that this new structure is
functionally identical to the old structure - the `ProcessList`
and `SessionId` members still appear to be at their old offsets.
In order to account for this when analyzing these newer Windows
versions, this catches the `SymbolError` and instantiates an `unsigned
long` at the offset (8) where the `SessionId` member would normally be
defined within an `_MM_SESSION_SPACE` structure.
 2024-12-12 23:24:40 -06:00
j-t-1andGitHub b235ed05b7 Update the CLI manual documentation 2024-12-12 18:50:23 +00:00
j-t-1andGitHub c740a6c770 Modify using as a library documentation 
Tiny changes.
 2024-12-12 18:14:35 +00:00
j-t-1andGitHub d77d696e2b Tweak the getting started windows tutorial 2024-12-12 17:49:25 +00:00
j-t-1andGitHub e31e13f471 Tweak the getting started mac tutorial 2024-12-12 17:44:01 +00:00
j-t-1andGitHub 6ffef285f4 Tweak the getting started linux tutorial 2024-12-12 17:36:51 +00:00
j-t-1andGitHub 58a9c3d6da Slightly modify documentation 
Include regex_scan, new functionality of volshell. Add Intermediate Symbol File (ISF) to glossary.
 2024-12-12 07:20:30 +00:00
Gustavo Moreira 9d0cd4b4c9 Linux: PageCache: Update inode plugin to conform to framework dumping convention 2024-12-12 11:17:15 +11:00
j-t-1andGitHub 3d260f3829 Slightly modify documentation 
Include regex_scan, new functionality of volshell.
 2024-12-11 12:42:20 +00:00
Mike Auty b6717d80d9 Windows: Fix up minor typo and CodeQL warning 2024-12-10 23:55:44 +00:00
ikelosandGitHub f00b596954 Merge pull request #1262 from volatilityfoundation/direct_indirect_system_calls 
Add detection of direct and indirect system calls
 2024-12-10 23:54:02 +00:00
j-t-1andGitHub fc33fd9127 Slightly modify documentation 
Include regex_scan, new functionality of volshell.
 2024-12-10 17:14:59 +00:00