WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-05 17:27:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,411 Commits 80 Branches 17 Tags
7a8dea3356c709cda2bdd20b7cb3ff97f1f7987d
Commit Graph
4411 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Gustavo Moreira 7a8dea3356 PR review fixes: Code scanning complains about these unused variables. Let's comment them and adapt the FIXME message 2024-08-08 01:57:35 -07:00
Gustavo Moreira 0f3f338633 PR review fixes: Since the IDR, XArray and RadixTree can store any value, it renames the function names to a more generic name 2024-08-08 01:52:57 -07:00
Gustavo Moreira ee10ba8abb PR review fixes: Fix IDR explicit returns mixed with implicit returns and improve and fix code. 2024-08-08 01:46:53 -07:00
Gustavo Moreira de6637c987 PR review fixes: ebpf plugin code improvement. Use the object_from_symbol() instead 2024-08-08 00:52:34 -07:00
Gustavo Moreira 46842981fb PR review fixes: Use contextlib.suppress() instead of an empty exception handler 2024-08-07 00:24:58 -07:00
Gustavo Moreira 805b3514c3 PR review fixes: Fix page flags list method name, this was introduced earlier in another commit of this PR. 2024-08-07 00:23:19 -07:00
Gustavo Moreira f737b88d03 PR review fixes: Improve _walk_dentry() and get_inodes() variable names, arguments and return values 2024-08-06 23:12:01 -07:00
Gustavo Moreira c8cb4465da PR review fixes: Remove filter function, it isn't needed 2024-08-06 23:08:21 -07:00
Gustavo Moreira 339a9a94f5 PR review fixes: pidhashtable plugin add missing typing. 2024-08-06 23:00:09 -07:00
Gustavo Moreira 7df0636f30 PR review fixes: Fix pidhashtable plugin explicit returns mixed with implicit returns 2024-08-06 04:57:33 -07:00
Gustavo Moreira bd37aa3930 PR review fixes: Fix pidhashtable plugin 2024-08-06 04:48:49 -07:00
Gustavo Moreira c9eb81c95f PR review fixes: Improve eBPF extension objects: bpf_prog and added bpf_prog_aux. Apply changes to the EBPF and Sockstat plugins. 2024-08-06 04:40:48 -07:00
ikelosandGitHub 398198042f Merge branch 'develop' into linux_page_cache 2024-08-04 13:44:37 +01:00
Gustavo Moreira 3e75c2ae9d Fix @functools.cache . It's available since Python 3.9 2024-08-04 14:40:45 +10:00
Gustavo Moreira cc04f665e3 Fix inode type 2024-08-03 23:47:28 +10:00
Gustavo Moreira 103537801e Linux: Add a basic eBPF program enumeration plugin to test and demonstrate using the IDR abstraction 2024-08-03 21:44:38 +10:00
Gustavo Moreira 55212008f8 Linux: Add pidhashtable plugin. This is based on the vol2 plugin, removing ancient kernel support, curating code and enhancing comments, while using the new IDR abstraction included also in this effort. 2024-08-03 21:39:51 +10:00
Gustavo Moreira ac27d6663a Linux: Add two page cache plugins, linux.pagecache.Files and linux.pagecache.InodePages 2024-08-03 21:26:29 +10:00
Gustavo Moreira 41684478ad Linux: Add page cache support, including abstractions like RadixTree, XArray, and IDR, to support both older and latest kernel versions 2024-08-03 21:21:49 +10:00
Gustavo Moreira a369a9e23c Linux: dentry object extension: Add a method to walk dentries subdirectories 2024-08-03 21:05:23 +10:00
Gustavo Moreira 231f682b27 Linux: Improve mount's object extension method docstrings 2024-08-03 21:01:59 +10:00
Gustavo Moreira 0dfb9d8a0f Linux mountinfo: Add a method to yield all filesystem superblocks 2024-08-03 20:57:23 +10:00
Gustavo Moreira d4ed07f95b PR review fixes: Add fixme to remember we should move wintime_to_datetime/unixtime_to_datetime out of renderers 2024-08-03 20:51:32 +10:00
ikelosandGitHub 32c8dc50af Merge pull request #1229 from volatilityfoundation/feature/argcomplete 
Feature/argcomplete
 2024-08-03 10:37:51 +01:00
ikelosandGitHub eb757b41cc Merge pull request #1230 from gcmoreira/linux_inode_timespec_timespec64_obj_extensions 
Linux: Add inode, timespec, and timespec64 object extensions
 2024-08-02 10:56:37 +01:00
Gustavo Moreira ed20834763 PR review fixes: Remove get_inode_number. It's better to use the type's original member name and handle the casting on the consumer side. 2024-08-02 19:48:09 +10:00
Gustavo Moreira d34b1ded3e PR review fixes: Remove get_inode_number. It's better to use the type's original member name and handle the casting on the consumer side. 2024-08-02 19:46:23 +10:00
Gustavo Moreira 933a41fa3a PR review fixes: Convert inode's is_* functions to properties 2024-08-02 14:22:27 +10:00
Gustavo Moreira b8d68b9a5e PR review fixes: Avoid using renderers in core functions. 2024-08-02 14:21:29 +10:00
Gustavo Moreira efba3a1b73 PR review fixes: Convert inode's is_* functions to properties 2024-08-02 14:17:57 +10:00
Gustavo Moreira 930d29046a PR review fixes: Avoid using renderers in core functions. 2024-08-02 14:15:01 +10:00
Gustavo Moreira 79529fb815 PR review fixes: Rename method name from private to internal 2024-08-02 13:52:07 +10:00
Gustavo Moreira 1dcaf9c0b1 PR review fixes: Rename method name from private to internal 2024-08-02 13:50:51 +10:00
ikelosandGitHub af5a743b35 Merge pull request #1219 from qpalzmz112/develop 
Added psxview plugin
 2024-08-02 01:33:59 +01:00
qpalzmz112 98c0094da5 Updated unpacked variable names 2024-08-01 18:51:11 -05:00
qpalzmz112 d19013c852 fixed typo, updated plugin docstring, and updated comment 2024-08-01 16:19:24 -05:00
Mike Auty 0bda154385 Clarify the documentation a little 2024-08-01 21:08:18 +01:00
Mike Auty e6308a6035 Make suggested changes by gcmoreira 2024-08-01 21:04:24 +01:00
Gustavo Moreira 3017a7d00c Linux: Add inode, timespec, and timespec64 object extensions to support different kernel versions, ensuring we will get aware datetimes when using them. 2024-08-01 12:23:09 +10:00
Gustavo Moreira 90b8b5340f Linux: Add inode, timespec, and timespec64 object extensions to support different kernel versions, ensuring we will get aware datetimes when using them. 2024-08-01 11:46:10 +10:00
qpalzmz112 9e8864521c Added debug log for failed address translation 2024-07-31 18:02:52 -05:00
qpalzmz112 fd6e4bec5c Updated with feedback from the PR 2024-07-31 17:53:29 -05:00
Mike Auty d576f8cb48 Fix CodeQL error 2024-07-31 21:49:07 +01:00
Mike Auty 73bc10c283 Wire the argcomplete into volshell too 2024-07-31 21:46:57 +01:00
ikelosandGitHub 16cde44400 Merge pull request #1228 from volatilityfoundation/ldr_fix 
Remove errant filter on ldrmodule checks
 2024-07-30 23:21:57 +01:00
ikelosandGitHub 2743e78481 Merge pull request #1227 from dgmcdona/dgmcdona/windows-netscan-update 
Windows: Updates netscan with new symbol file
 2024-07-30 23:19:56 +01:00
ikelosandGitHub 189f8729e5 Merge pull request #1222 from gcmoreira/renderers_time_conversion_fixes 
Renderers time conversion fixes
 2024-07-30 23:08:11 +01:00
ikelosandGitHub af7466b353 Merge pull request #1224 from dgmcdona/dgmcdona/windows-callback-symbol-fix 
Windows: Fixes bad structure member in callbacks
 2024-07-30 22:45:50 +01:00
ikelosandGitHub 4e8d64ed86 Merge pull request #1217 from eve-mem/windows_issue_1146 
Windows: update handles plugin sar warnings to use DEFAULT_SAR_VALUE var
 2024-07-30 22:38:36 +01:00
ikelosandGitHub bee333908b Merge pull request #1221 from volatilityfoundation/issues/issue1216 
Renderers: Allow BaseAbsentValues in value results
 2024-07-30 22:37:42 +01:00