 Gustavo Moreira
|
7e4b548e17
|
linux: task_struct object extension: Add method to get the task address space layer, even if its a kernel thread
|
2025-02-01 17:55:13 +11:00 |
|
|
Gustavo Moreira
|
e2431eebdf
|
linux: bpf_prog: Add methods to get the program address and its memory regions
|
2025-02-01 17:55:05 +11:00 |
|
|
Gustavo Moreira
|
0e0daffc45
|
linux: Add kernel_symbol object extension
|
2025-02-01 17:54:55 +11:00 |
|
|
Gustavo Moreira
|
88b32b0803
|
linux: task_struct object extension: Add helper to obtain the task state
|
2025-02-01 17:54:47 +11:00 |
|
|
Gustavo Moreira
|
dba90ac217
|
linux: Add support for module symbol types
|
2025-02-01 17:54:41 +11:00 |
|
|
Gustavo Moreira
|
18a69b9417
|
linux: add latched RB-trees implementation
|
2025-02-01 17:54:27 +11:00 |
|
|
ikelosandGitHub
|
5a046ea0e4
|
Merge pull request #1590 from volatilityfoundation/mnt_parent_missing
Add mnt_parent check to kernel version validation
|
2025-02-01 01:46:46 +00:00 |
|
|
ikelosandGitHub
|
75b55c3b30
|
Merge pull request #1593 from volatilityfoundation/mountinfo_superblock_check
Add missing pointer validation check in mountinfo
|
2025-02-01 01:43:13 +00:00 |
|
|
ikelosandGitHub
|
346a5d98da
|
Merge pull request #1592 from volatilityfoundation/kthread_name_smear
Prevent backtraces when kthread full name is smeared
|
2025-02-01 00:56:10 +00:00 |
|
|
ikelosandGitHub
|
4df047beac
|
Merge pull request #1591 from volatilityfoundation/check_sock_access
Fix broken socket retrieval that causes backtrace
|
2025-02-01 00:55:08 +00:00 |
|
|
Andrew Case
|
efbc410c4d
|
Add missing pointer validation check in mountinfo
|
2025-01-31 21:43:32 +00:00 |
|
|
Andrew Case
|
644b967c62
|
Prevent backtraces when kthread full name is smeared
|
2025-01-31 21:31:07 +00:00 |
|
|
Andrew Case
|
4d43ac9a6d
|
Catch invalid address exception for invalid sock values
|
2025-01-31 20:46:16 +00:00 |
|
|
Andrew Case
|
cb3542f76a
|
Catch invalid address exception for invalid sock values
|
2025-01-31 20:40:51 +00:00 |
|
|
Andrew Case
|
1132bd9830
|
Add mnt_parent check to kernel version validation
|
2025-01-31 18:11:22 +00:00 |
|
|
Andrew Case
|
55b27a68d5
|
Add mnt_parent check to kernel version validation
|
2025-01-31 18:10:12 +00:00 |
|
|
ikelosandGitHub
|
1f983aca73
|
Merge pull request #1585 from volatilityfoundation/issues/issue1577
Expose and use `get_pefile_obj` rather than having local copies
|
2025-01-31 17:30:22 +00:00 |
|
|
ikelosandGitHub
|
b51acfd3fb
|
Merge pull request #1407 from eve-mem/WindowsCommitCharge_issue1400
Windows: Update get_commit_charge extension to handle Core.CommitCharge case
|
2025-01-31 16:44:24 +00:00 |
|
|
eve
|
e9d1831a7c
|
Windows: update get_commit_charge with CommitCharge fix by BeanBagKing
|
2025-01-31 14:45:28 +00:00 |
|
|
Mike Auty
|
68c8b2389a
|
Make error messages a little more descriptive
|
2025-01-31 10:00:16 +00:00 |
|
|
ikelosandGitHub
|
b81105f508
|
Merge pull request #1587 from gcmoreira/intel_translation_performance_improvement
intel: address translation: performance improvements caching by page address
|
2025-01-31 09:55:06 +00:00 |
|
|
ikelosandGitHub
|
702257fb4e
|
Merge pull request #1586 from gcmoreira/framework_improve_conversion_to_strings
Framework improve conversion to strings
|
2025-01-31 09:04:33 +00:00 |
|
|
Gustavo Moreira
|
815b2fe918
|
Fix bug in address_to_string() helper
|
2025-01-31 19:49:04 +11:00 |
|
|
Gustavo Moreira
|
c82ef0cfd2
|
intel: address translation: performance improvements caching by page address
|
2025-01-31 19:29:33 +11:00 |
|
|
Gustavo Moreira
|
b91724c3ef
|
Replace *_to_string() for a block reader implementation for better performance. Add new address_to_string() helper
|
2025-01-31 18:48:52 +11:00 |
|
|
Gustavo Moreira
|
9218e0e07f
|
fix double null-termination search
|
2025-01-31 18:47:11 +11:00 |
|
|
ikelosandGitHub
|
ad0000e36a
|
Merge pull request #1509 from gcmoreira/linux_module_symbols_improvements
linux: module symbols: Fixes and code improvements
|
2025-01-30 10:48:28 +00:00 |
|
|
ikelosandGitHub
|
9b532ad307
|
Merge branch 'develop' into linux_module_symbols_improvements
|
2025-01-30 10:37:46 +00:00 |
|
|
ikelosandGitHub
|
8a4f344c26
|
Merge pull request #1332 from gcmoreira/linux_vmcoreinfo_aslr_and_plugin
Linux: Address limitations in determining KASLR shifts by introducing VMCoreInfo support
|
2025-01-30 10:25:25 +00:00 |
|
|
Gustavo Moreira
|
981e097567
|
linux: module object extension: Revert the changes to get the ELF symbol index
|
2025-01-30 21:03:33 +11:00 |
|
|
Gustavo Moreira
|
67a83871ad
|
linux: module object extension: Add a function to return the extended ELF symbol information (symbol object and its index) so that doesn't change the get_symbols() interface
|
2025-01-30 20:54:38 +11:00 |
|
|
Gustavo Moreira
|
f3095513a1
|
linux: elf_sym: use a class attribute for the symbol max length
|
2025-01-30 20:26:51 +11:00 |
|
|
Gustavo Moreira
|
5d2819a98d
|
linux: elf: fix imports
|
2025-01-30 20:25:22 +11:00 |
|
|
Gustavo Moreira
|
e8934e94ce
|
Merge branch 'develop' into linux_module_symbols_improvements
|
2025-01-30 19:53:50 +11:00 |
|
|
Gustavo Moreira
|
8b6c00e64f
|
linux: vmcoreinfo plugin: simplify hex conversion
|
2025-01-30 18:48:42 +11:00 |
|
|
Gustavo Moreira
|
f6a22eed05
|
linux: vmcoreinfo API: significantly improve the performance when validating each character, from O(n) to O(1).. where n is 100 chars long
|
2025-01-30 18:44:18 +11:00 |
|
|
Gustavo Moreira
|
c2f2fc6b42
|
linux: vmcoreinfo API: fix single letter variable
|
2025-01-30 18:25:58 +11:00 |
|
|
Gustavo Moreira
|
cdfa85570a
|
Merge branch 'develop' into linux_vmcoreinfo_aslr_and_plugin
|
2025-01-30 18:12:19 +11:00 |
|
|
ikelosandGitHub
|
825fd8eb6a
|
Merge pull request #1557 from gcmoreira/linux_parity_release_harden_pointer_validation
Linux - Parity release - Harden pointer validation in several plugins and APIs
|
2025-01-30 01:00:36 +00:00 |
|
|
Gustavo Moreira
|
4466d9accd
|
linux: kmsg plugin: log warning instead of error
|
2025-01-30 11:47:17 +11:00 |
|
|
ikelosandGitHub
|
2d0856f58b
|
Merge branch 'develop' into issues/issue1577
|
2025-01-30 00:34:41 +00:00 |
|
|
Gustavo Moreira
|
3bd1c70a9b
|
linux: kmsg plugin: improve return types
|
2025-01-30 11:33:28 +11:00 |
|
|
ikelosandGitHub
|
1b554b40e4
|
Merge pull request #1578 from volatilityfoundation/issues/issue1575
Shift exposed staticmethods to classmethods
|
2025-01-30 00:32:14 +00:00 |
|
|
ikelosandGitHub
|
8125b0d6fa
|
Merge pull request #1545 from gcmoreira/linux_parity_release_harden_mountinfo_api_and_related_fixes
Linux - Harden mountinfo API and several related fixes
|
2025-01-30 00:31:56 +00:00 |
|
|
Gustavo Moreira
|
53364f7dab
|
linux: LinuxUtilities: Revert do_get_path() typing
|
2025-01-30 10:41:44 +11:00 |
|
|
Gustavo Moreira
|
74a834b6de
|
linux: vfsmount: improve kernel implementation detection
|
2025-01-30 09:34:07 +11:00 |
|
|
Gustavo MoreiraandGitHub
|
d077ec3488
|
Merge branch 'develop' into linux_parity_release_harden_mountinfo_api_and_related_fixes
|
2025-01-30 08:39:44 +11:00 |
|
|
Mike Auty
|
10743b1019
|
Windows: Fix ruff issues in skeleton_key_check
|
2025-01-27 23:14:02 +00:00 |
|
|
Mike Auty
|
6ef57d1e89
|
Windows: Allow get_pefile_obj to be shared
|
2025-01-27 23:12:28 +00:00 |
|
|
ikelosandGitHub
|
ad90804af0
|
Merge pull request #1584 from volatilityfoundation/issues/issue1583
Windows: Fix vadyarascan typo
|
2025-01-27 22:40:54 +00:00 |
|