WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-30 03:39:51 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,022 Commits 80 Branches 17 Tags
7c8f4ca4ac5c23da3afa1d0ec6404c3fada69a27
Commit Graph
4022 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mike Auty 7c8f4ca4ac Schemas: As of 6.3.0 we require a producer metadata, not just format 2024-01-14 23:05:12 +00:00
Mike Auty 62366d4f6f Symbols: Add support for metadata verification of symbol tables 2024-01-14 23:05:10 +00:00
ikelosandGitHub 66a4fc92bb Merge pull request #1075 from gcmoreira/linux_kmsg_older_kernels_support 
Linux: Add support for kernels earlier than version 3.11 in `linux.kmsg.Kmsg` plugin
 2024-01-02 19:08:03 +00:00
Gustavo Moreira 66b408d6e8 Fix minor docstring typos 2024-01-02 11:37:10 -03:00
Gustavo Moreira 8e58815c11 Bump plugin's patch version 2024-01-02 11:25:35 -03:00
Gustavo Moreira 02a389a61b Improve docstrings 2024-01-02 11:17:18 -03:00
Gustavo Moreira e4c44698f8 Reduce imports 2024-01-02 11:14:43 -03:00
Gustavo Moreira 0d934d4991 Fix error and comment 2023-12-26 16:13:47 -03:00
Gustavo Moreira 3848fc69a6 Add support for kernels earlier than version 3.11. 
* Add support for older ring buffer kernel implementation:
  - 3.5 < kernels
  - 3.5 <= kernels < 3.11
 * Enabled support for wrapped-around ring buffers in all four kernel implementations.
 * Bugfix: wrapped around buffer issue with 3.11 <= kernel < 5.10.
 2023-12-25 21:32:14 -03:00
ikelosandGitHub fdf93f502f Merge pull request #1062 from vobst/handle-duplicate-enum-value 
tolerate duplicate enum values, keep first name that was seen
 2023-12-20 19:42:50 +00:00
ikelosandGitHub a4b927f478 Merge pull request #1068 from vobst/remove-kernel_cap_struct-requirement 
remove kernel_cap_struct requirement
 2023-12-20 11:26:18 +00:00
Valentin Obst aa624b0339 remove kernel_cap_struct requirement 2023-12-19 10:25:26 +01:00
Valentin Obst bd96357e33 tolerate duplicate enum values, keep first name that was seen 2023-12-19 09:32:25 +01:00
ikelosandGitHub 18e5d7a7f2 Merge pull request #1061 from eve-mem/linux_kmsg_issue_1055 
Linux: Update kmsg issue 1055
 2023-12-18 18:59:30 +00:00
ikelosandGitHub 4ac261c7bf Merge pull request #1057 from eve-mem/linux_fix_pstree 
Linux: Update pslist to fix pstree
 2023-12-14 11:10:49 +00:00
EveandGitHub e2f7e7ec54 Merge branch 'volatilityfoundation:develop' into linux_fix_pstree 2023-12-14 09:52:28 +00:00
Eve 9b85342673 Linux: bump version for linux kmsg 2023-12-14 09:24:51 +00:00
Eve fda3cedaba Linux: update kmsg to create objects via context rather than module 2023-12-14 09:18:01 +00:00
ikelosandGitHub 713b5f96dd Merge pull request #997 from gcmoreira/issue_985 
Issue 985
 2023-12-12 23:35:54 +00:00
ikelosandGitHub 298570aba4 Merge branch 'develop' into issue_985 2023-12-12 23:06:45 +00:00
Eve 3d9b0208cb Linux: change pstree to a basic plugin rather than inheriting from pslist 2023-12-12 06:56:14 +00:00
Eve 19499d5113 Linux: update pslist with classmethod for get_task_fields 2023-12-11 06:39:09 +00:00
Eve c08dda88de Linux: Update pslist plugin so that it can be used from pstree, and update pstree to support dumping of processes 2023-12-08 22:56:17 +00:00
EveandGitHub b9c60a5545 Merge branch 'volatilityfoundation:develop' into linux_kmsg_issue_1055 2023-12-07 09:07:15 +00:00
Eve 831e6cf341 Linux: update kmsg KmsgFiveTen class to handle symbol shift and create objects with absolute addresses 2023-12-07 09:06:13 +00:00
ikelosandGitHub a08b7809b5 Merge pull request #1050 from eve-mem/windows_vadyarascan_issue_1047 
Windows: update vadyarascan to use generic yarascan requirements
 2023-12-05 18:46:07 +00:00
ikelosandGitHub 8262737912 Merge pull request #1010 from eve-mem/linux_elf_padded_magic_read 
Linux: Add error handling to elf extension magic bytes check
 2023-12-03 15:22:33 +00:00
ikelosandGitHub 799c7edf66 Merge pull request #1044 from forensicxlab/feature/ADS 
Feature: Alternate Data Streams.
 2023-12-03 15:20:53 +00:00
k1nd0ne acb088dbcd Better code reading 2023-12-03 13:05:45 +01:00
k1nd0ne ed2db939d6 Better exception handling. Fetching data using objects 2023-12-03 12:24:11 +01:00
ikelosandGitHub 42a89cf027 Merge pull request #1037 from forensicxlab/feature/bucket-s3 
Feature: Remote analysis on cloud object-storage.
 2023-12-01 14:07:52 +00:00
ikelosandGitHub 21af01ddd2 Merge pull request #1034 from eve-mem/linux_maple_tree_seen_parameter_fix 
Linux: update maple tree extension to fix issue #1032
 2023-12-01 13:57:45 +00:00
Eve 276e695237 Linux: update maple tree extension comment around the seen set. 2023-12-01 13:46:00 +00:00
Eve 7fe086f64f Linux: update maple tree extension to fix issue #1032 correcting the mutable type used as a default parameter. 2023-12-01 13:37:09 +00:00
k1nd0ne 1f5a18d679 patch running black 2023-11-30 11:54:55 +01:00
k1nd0ne ed98d453f6 Changing requirements + formating 2023-11-30 11:50:04 +01:00
ikelosandGitHub 292bef9fcc Merge pull request #1051 from eve-mem/linux_iomem_absolute_address_bugfix 
Linux: fix bug with iomem plugin due to absolute address misuse
 2023-11-29 21:04:44 +00:00
Eve 099403d07c Linux: fix bug with iomem plugin where an absolute address is used to make an object but the absolute flag is not set 2023-11-29 20:47:14 +00:00
Mike Auty b20643d5e0 Linux: Tidy up the elf symbol table name 2023-11-29 12:03:43 +00:00
ikelosandGitHub 0769df4b3c Merge pull request #1039 from Abyss-W4tcher/linux_extensions_patches 
Linux extensions patches
 2023-11-29 12:02:46 +00:00
Abyss Watcher 39144ff45f type hint get_symbols_names_and_addresses 2023-11-29 12:51:08 +01:00
Eve c610497fa0 Windows: update vadyarascan to use generic yarascan requirements 2023-11-29 09:28:34 +00:00
ikelosandGitHub 4ce42fcac4 Merge pull request #1049 from volatilityfoundation/issues/improve-mftscan 
Simplify attribute object accesses
 2023-11-28 21:45:13 +00:00
k1nd0ne 7624c494e8 Simplify attribute object accesses like #1049 + custom class (MFTAttribute) 2023-11-28 13:57:02 +01:00
Mike Auty 8d5877e904 Simplify attribute object accesses 
This is a very small percentage slower, for some reason, than the
previous mechanism, probably overhead from object creation/member
access.  However, it vastly simplifies the code and makes better use of
the volatility object model.
 2023-11-27 01:00:00 +00:00
ikelosandGitHub 9f9afbf90f Merge pull request #1048 from volatilityfoundation/issues/issue922 
Issues/issue922
 2023-11-26 12:53:49 +00:00
Mike Auty 8b6ab44310 Core: Fix array_of_pointers to act only on those pointers 2023-11-26 12:30:06 +00:00
Mike Auty 62506aece6 Core: Fix up github security issues 
This fixes an unused import, an improper use of self and lots and lots
of places where we implicitly return None.  This now explicitly returns
None to improve readability and prevent mixed implicit and explicit
return values.  This should also somewhat aid type checking by humans.
 2023-11-26 11:24:53 +00:00
k1nd0ne 24609856de Fixing: unused import, typo, ISF enhancement 2023-11-25 17:04:47 +01:00
ikelosandGitHub 7012edb815 Merge pull request #885 from eve-mem/vmayarascan 
add linux.vmayarascan
 2023-11-23 09:08:17 +00:00