David McDonald
7299f925dc
Windows: Handles - major version bump
...
Bumps the major version in plugin + dependences after removal of a
publicly exposed instance method.
2024-12-16 17:58:53 -06:00
David McDonald
e8b3185528
Windows: Handles - New pointer calculation method
...
After researching this structure (`_HANDLE_TABLE_ENTRY`), it appears to
be stable as far back as Windows 8. It's also a union, with an
`ObjectPointerBits` member at the same offset as `LowValue` but within a
specific bit range (bit length 44, bit position 20). Taking this value
and shifting it left by four produces the correct pointer. This four-bit
shift is due to 16-byte alignment of object header structures, and is
what we would expect to see with 44-bit pointers in Windows. See
https://www.alex-ionescu.com/behind-windows-x64s-44-bit-memory-addressing-limit/
2024-12-13 10:47:12 -06:00
David McDonald
a07ee5a0d5
fix(Windows: Handles): Unreliable SAR value on 24H2
...
Handles are not being decoded in 24H2+ samples. This is because the
`Handles._decode_pointer` method grabs the SAR shift value from the
disassemble function, but in these samples this value (`0x11`) is
incorrect. Adding a fallback to the default SAR value of `0x10` if the
obtained pointer is not valid in the kernel address space resolves the
issue.
2024-12-09 18:11:27 -06:00
ikelos and GitHub
2ae723513a
Merge pull request #1386 from j-t-1/doc
...
Cosmetic changes to documentation
2024-12-07 17:19:38 +00:00
j-t-1 and GitHub
45f9064623
Cosmetic changes to documentation
2024-12-07 17:11:49 +00:00
j-t-1 and GitHub
e165c78ba7
Cosmetic changes to documentation
2024-12-07 16:37:39 +00:00
j-t-1 and GitHub
04d2554442
Cosmetic changes to documentation
2024-12-07 16:36:18 +00:00
j-t-1 and GitHub
97698cc5ed
Cosmetic changes to documentation
2024-12-07 16:29:58 +00:00
j-t-1 and GitHub
9ebc0bd90d
Cosmetic changes to documentation
2024-12-07 16:20:45 +00:00
Mike Auty
d29c23e922
Windows: Protect against missing _MM_SESSION_SPACE symbol
2024-12-07 15:52:58 +00:00
ikelos and GitHub
78e3ee26a0
Merge pull request #1384 from j-t-1/doc
...
Small documentation changes
2024-12-07 01:04:22 +00:00
j-t-1 and GitHub
93a47e811b
Small documentation changes
2024-12-06 21:52:51 +00:00
j-t-1 and GitHub
846403115a
Small documention changes
2024-12-06 16:00:03 +00:00
ikelos and GitHub
e2cdbdc2bf
Merge pull request #1382 from j-t-1/PYO
...
PEP 488 – Elimination of PYO files
2024-12-06 00:26:21 +00:00
j-t-1 and GitHub
f11ef06c27
PEP 488 – Elimination of PYO files
...
Python 3.5 implememted PEP 488, eliminating .pyo files.
2024-12-05 21:30:20 +00:00
j-t-1 and GitHub
5acf8858d9
PEP 488 – Elimination of PYO files
...
Python 3.5 implememted PEP 488, eliminating .pyo files.
2024-12-05 18:31:04 +00:00
Mike Auty
3ff304ceed
Layers: Fix intel bug introduced in commit 73d4f2f
...
The patch failed to mask the incoming address to the maximum physical
address. This allowed non-canonical addresses (potentially within the
page table) to be looked up incorrectly.
Fixes #1374 .
Thanks to @the-rectifier for quickly identifying the issue!
2024-12-03 19:58:23 +00:00
ikelos and GitHub
e4c552050c
Merge pull request #1377 from gcmoreira/pytest_image_autoselection_improvement
...
Testing: Enable automatic OS image selection by matching test name and image filename prefixes
2024-12-01 11:06:46 +00:00
ikelos and GitHub
fbc72d35b9
Merge pull request #1368 from gcmoreira/linux_pslist_dependencies_fix_1366
...
Linux pslist dependencies fix 1366
2024-12-01 11:00:12 +00:00
ikelos and GitHub
4d628c839b
Merge pull request #1376 from gcmoreira/fix_pretty_renderer_hex_bytes_as_text
...
Renderers - Fix HexBytes formatter for pretty renderer
2024-12-01 10:52:00 +00:00
Gustavo Moreira
535ce3a22a
testing: Enable automatic selection of the OS image based on the test and filename prefix, addressing an issue in the development environment.
...
For example, when using VSCode with pytest, test autodiscovery triggers pytest_generate_tests(), adding all images to each test case. This causes issues, as Linux tests end up being executed with Windows and Mac images, and vice versa.
2024-12-01 19:34:35 +11:00
Gustavo Moreira
c19a54cbd9
testcases: Minor cleanup: Renaming and reordering functions to align with the Linux/Windows test cases
2024-12-01 14:08:53 +11:00
Gustavo Moreira
7ae27c4eaa
Merge branch 'develop' into linux_pslist_dependencies_fix_1366
2024-12-01 13:24:53 +11:00
Gustavo Moreira
3c20e46902
renderers: Fix HexBytes formatter to apply padding also at the end of the string, ensuring proper output alignment when the pretty renderer justifies each line to the right
2024-12-01 12:36:35 +11:00
ikelos and GitHub
9222f4915a
Merge pull request #1371 from volatilityfoundation/issues/use-yara-scanner-over-handling-yara-directly
...
Fix up vmayarascan and vadyarascan to use yarascan properly
2024-12-01 01:26:04 +00:00
Mike Auty
d404747de5
Tests: Add in vadyarascan tests
2024-12-01 00:04:46 +00:00
Mike Auty
2dc1686289
Windows: Protect the SERICE_RECORD is_valid function a little more
...
The request to .Order could fail depending on where the structure lies
in memory.
2024-11-30 13:36:17 +00:00
Mike Auty
56f6ef0add
Include a test developed by @gcmoreira and @eve-mem
2024-11-30 11:52:16 +00:00
Mike Auty
3df385369c
Ensure the VAD/VMA gets scanned in a single block
2024-11-30 11:28:09 +00:00
ikelos and GitHub
ba98b088cb
Merge pull request #1369 from gcmoreira/logging_producer_information
...
Linux/Mac: Log producer metadata information
2024-11-29 10:27:32 +00:00
Mike Auty
393db1050f
Windows: protect again mz_offsets being None
2024-11-29 08:51:06 +00:00
Mike Auty
0030129ff8
Make suggested fixes to reduce loops and ignore insane sections
2024-11-29 08:43:04 +00:00
Gustavo Moreira
77778ee6f6
Linux/Mac: ISF metadata: Rename s/DWARF/POSIX/, as I'm not happy with the generic name. BTF source could potentially generate the same keys
2024-11-29 19:35:18 +11:00
Gustavo Moreira
b8023f0c97
Linux/Mac: Address code review suggestions
...
- Add getters for Linux/Mac ISF sources
- Avoid using internal attributes
- Use the dict repr instead of walking the dict to simplify code
2024-11-29 19:05:27 +11:00
Mike Auty
bec6bc6594
Fix up vmayarascan and vadyarascan to use yarascan properly
2024-11-28 16:59:52 +00:00
Mike Auty
3748cb89b8
Windows: Improve debugging output for pdbscan
2024-11-28 10:22:49 +00:00
Gustavo Moreira
8ecd7e2ddd
Linux/Mac: Log producer information
2024-11-28 15:17:22 +11:00
Gustavo Moreira
aaeec80fdf
linux: library_list testcase: Optimize testing performance by limiting the number of processes to just one. This change will reduce execution time and speed up the test
2024-11-28 13:53:11 +11:00
Gustavo Moreira
9048cd1ab8
linux: boottime: Minor, removed unnecessary blank line
2024-11-28 13:47:03 +11:00
Gustavo Moreira
fb4ab9d477
linux: test cases: remove unused variables
2024-11-28 13:45:26 +11:00
Gustavo Moreira
63ac0abe64
linux: Add 15 new test cases for plugins dependent on pslist
2024-11-28 13:25:08 +11:00
Gustavo Moreira
fa06064635
linux plugins: Update pslist major version and its 18 dependent plugins
2024-11-28 13:16:33 +11:00
Gustavo Moreira
97534f02de
linux: sockstat: It should import and verify the pslist version directly, instead of relying on lsof
2024-11-28 12:19:56 +11:00
Gustavo Moreira
7c559c53f4
test_cases: underscore unused variables
2024-11-28 12:11:14 +11:00
ikelos and GitHub
0233193c9d
Merge pull request #1335 from gcmoreira/linux_prot_none_L1TF_and_layer_addr_translation_fixes
...
Linux - PROT_NONE, L1TF mitigation and layer address translation fix
2024-11-27 10:31:18 +00:00
Gustavo Moreira
eff2a529c8
Linux: intel: Remove the bitwise zero complement to simplify the protnone mask calculation
2024-11-27 18:10:14 +11:00
Gustavo Moreira
641e008caf
Linux: intel: The non-present mapping shouldn't be inverted
2024-11-27 15:06:33 +11:00
ikelos and GitHub
bdd3e1e48e
Merge pull request #1365 from volatilityfoundation/issues/pr1343
...
CLI: Partial changes by @lesander contributed in #1343
2024-11-24 09:58:04 +00:00
Mike Auty
523a6e92fc
CLI: Apply black to recent changes
2024-11-24 09:33:30 +00:00
lesander and Mike Auty
1a0d1a238d
CLI: Partial changes by @lesander contributed in #1343
2024-11-24 09:31:26 +00:00
David McDonald