ikelos and GitHub
7ef7dd88f0
Merge pull request #510 from volatilityfoundation/revert-507-issues/issue505
...
Revert "Windows: Increase self-referential check"
2021-05-26 23:45:00 +01:00
ikelos and GitHub
3bb23b29e3
Revert "Windows: Increase self-referential check"
2021-05-26 23:43:35 +01:00
Mike Auty
0214fa35a1
Core: Increment minimum python version to 3.6
2021-05-26 23:23:27 +01:00
Mike Auty
9e7e82f026
Development: Minor mac extract_kernel updates
2021-05-26 22:14:00 +01:00
ikelos and GitHub
77d0debdac
Merge pull request #507 from volatilityfoundation/issues/issue505
...
Windows: Increase self-referential check
2021-05-26 22:12:33 +01:00
ikelos and GitHub
069a3da751
Merge pull request #504 from doomedraven/patch-1
...
ability to reverse filtering see long description
2021-05-23 16:58:35 +01:00
doomedraven and GitHub
dd6ad75b22
Update pslist.py
2021-05-23 17:10:52 +02:00
Mike Auty
abafa58f1a
Windows: Increase self-referential check
2021-05-23 15:49:28 +01:00
doomedraven and GitHub
ed9c2dd979
ability to reverse filtering see long description
...
Hello, this is very useful to optimize some scans, like in case of sandboxing, imagine:
1 round it scans only all processes that was captured by sandbox aka pid_list
2. round it scans all the rest processes ignoring pid_list from round 1
if you have a better idea how to improve/implement this, let me know, we use our custom function, but i think it might be useful for the rest
2021-05-18 22:37:34 +02:00
Mike Auty
4cb71366c7
Windows: Improve netstat errors
2021-05-16 17:08:56 +01:00
Mike Auty
f873ced04e
Windows: Improve hashdumping plugin errors
2021-05-16 17:01:52 +01:00
Mike Auty
2705614306
Windows: Remove debugging statements from pdbutil
2021-05-13 21:49:25 +01:00
ikelos and GitHub
8f7b0f2c47
Merge pull request #475 from f-block/develop
...
Temporary workaround for changes in transition PTE
2021-05-12 20:22:09 +01:00
ikelos and GitHub
21b33b677c
Merge pull request #496 from volatilityfoundation/feature/faster-pdb-scanning
...
Windows: Improve PDB scanning
2021-05-10 20:24:52 +01:00
Mike Auty
7d408ce0f3
Windows: Make IPI handling of PDBs optional
2021-04-26 01:16:38 +01:00
ikelos and GitHub
a165b1b1cf
Merge pull request #487 from volatilityfoundation/feature/better-windows-identification
...
Automagic: Add a slow scan for kernel identification
2021-04-22 18:00:56 +01:00
Mike Auty
007717590e
Merge branch 'issues/issue495' into develop
2021-04-22 17:21:05 +01:00
Mike Auty
e241ac0ac0
Windows: Fixes missing os import
...
Fixes #495
2021-04-22 17:18:52 +01:00
Mike Auty
c5c726ab28
Windows: Improve PDB scanning
2021-04-21 00:02:36 +01:00
ikelos and GitHub
280c912121
Merge pull request #492 from cstation/fix/qemu-conf
...
Fix reading JSON configration of QEMU-images
2021-04-14 19:47:45 +01:00
cstation
aa26601b34
Fix reading JSON configration of QEMU-images
2021-04-14 20:39:03 +02:00
Mike Auty
88ff4f1d06
Windows: Fix up double import in pdbconv
2021-04-07 22:30:45 +01:00
ikelos and GitHub
9d2c17b79d
Merge pull request #483 from volatilityfoundation/prevent_pslist_backtrace
...
Prevent pslist from backtracing on invalid process. Include a warnin…
2021-04-07 18:19:03 +01:00
Andrew Case
ce3b0fcc0b
Change debug to info for invalid process warning message
2021-04-07 12:04:50 -05:00
Mike Auty
191da08fb3
Automagic: Add a slow scan for kernel identification
2021-04-04 17:46:37 +01:00
Mike Auty
a1c5f5e5e5
Automagic: Improve secondary 64-bit self-ref finder
2021-04-03 13:33:20 +01:00
Mike Auty
087b172148
Automagic: Add secondary 64-bit self-referential value
2021-04-03 13:07:43 +01:00
Mike Auty
f3c3e2c4f9
Windows: Don't try to delete URLs
2021-03-29 17:50:35 +01:00
ikelos and GitHub
ef258ec010
Merge pull request #417 from volatilityfoundation/issues/optional-symbol-shift
...
Issues/optional symbol shift
2021-03-21 00:43:04 +00:00
Mike Auty
792fb7080c
Symbols: Set symbol_shift default rather than None
...
Since all the checks for symbol_shift use essentially "if not
config['symbol_shift']" is doesn't matter whether 0 or None is
returned. I'd like to test this on an ASLR image, but I think it should
be fine and I'd feel much happier about everything if we could give it a
numeric default.
2021-03-21 00:21:13 +00:00
Mike Auty
2402a51c60
Symbols: Make the symbol shift optional
...
The symbol_shift isn't quite as nice as it could be, because we use None
to demark an unset state, which is different than a value of 0 (because
unset will trip linux to try to identify, whereas 0 will not).
Every where we use the value, we get it from the dictionary and use 0 if
it's not found (essentially forcing a default), but ideally, the default
would be set. As such, it's safe to set optional to true (and thus not
require it for configuration files), but it's not ideal that the linux
symbol finder can't determine whether to run or not without knowing
whether the value's been intentionally set...
2021-03-21 00:21:13 +00:00
ikelos and GitHub
6702595ebe
Merge pull request #482 from volatilityfoundation/feature/better-strings-checking
...
Feature/better strings checking
2021-03-21 00:13:37 +00:00
ikelos and GitHub
de78763e32
Merge pull request #480 from volatilityfoundation/feature/better-version-info
...
Windows: Add additional version info finding method
2021-03-21 00:11:40 +00:00
ikelos and GitHub
63101e6d0a
Merge pull request #479 from volatilityfoundation/feature/directory-restructure
...
Windows: Group JSON symbols under directories
2021-03-21 00:10:43 +00:00
atcuno
0be5dad2bd
Prevent pslist from backtracing on invalid process. Include a warning with the offset.
2021-03-19 11:51:23 -05:00
ikelos and GitHub
8e420dec41
Merge pull request #481 from volatilityfoundation/feature/version-pdbutility
...
Windows: Generalize symbol_table_from_pdb
2021-03-18 14:42:09 +00:00
Mike Auty
ea71cbe9c9
Windows: Fix the verinfo versioning
...
This should already have been versioned because it had a classmethod.
Since it wasn't, we can start at (1, 0, 0) but it should only need
framrwork version (1, 0, 0) as well.
2021-03-17 21:02:55 +00:00
Mike Auty
9c30ed19ef
Windows: Deprecate netstat create_tcpip_symbol_table
2021-03-17 20:07:29 +00:00
Mike Auty
8d8b2ea2dd
Windows: Fix up hardcoded filename in pdbutil
2021-03-17 15:31:58 +00:00
Mike Auty
180087e746
Windows: Update vadyarascan with compiled file option
2021-03-15 22:58:48 +00:00
Mike Auty
88bddbd596
Windows: Clarify separate yara compiled method
2021-03-15 22:56:40 +00:00
ikelos and GitHub
c75bef2b05
Merge pull request #477 from dadokkio/develop
...
enable support for compiled rules in Yara
2021-03-15 22:54:55 +00:00
Mike Auty
05ffab9108
Windows: Make generate_mapping externally visible
2021-03-15 22:39:24 +00:00
Mike Auty
0890a96249
Windows: Check strings file before use
...
This will cause the strings plugin to exit early if the strings file has
formatting issues.
2021-03-15 22:16:49 +00:00
Mike Auty
0a7a749667
Documentation: Add text about banners and isfinfo
2021-03-15 11:15:44 +00:00
Mike Auty
95a9effbe3
Windows: Generalize symbol_table_from_pdb
2021-03-14 23:28:00 +00:00
Mike Auty
970d15a82e
Documentation: Document volshell
2021-03-14 21:47:53 +00:00
Mike Auty
4e50402f11
Windows: Add additional version info finding method
2021-03-14 20:17:06 +00:00
Mike Auty
f41c75775a
Windows: Group JSON symbols under directories
2021-03-14 19:24:45 +00:00
Mike Auty
5d77a7ca6b
PDB: Don't bump the version unnecessarily
...
The version field of the producer should be enough to determine the
difference
2021-03-13 18:50:29 +00:00
