WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-02 14:28:58 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,421 Commits 80 Branches 17 Tags
7efa2210a550d55f356b6ebb35cafcdfd4a58d1f
Commit Graph
4421 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Gustavo Moreira 7efa2210a5 PR review fixes: Adjust LinuxUtilities version since we moved choose_id_storage() back to the IDStorage class. 2024-08-13 01:05:44 -07:00
Gustavo Moreira f804b44ff6 Fix test.yaml, it should remove *.bin and not *.lime. There is no *.lime atm. 2024-08-13 01:00:57 -07:00
Gustavo MoreiraandGitHub b69c2c762c Merge branch 'volatilityfoundation:develop' into linux_page_cache 2024-08-10 06:05:33 -03:00
Gustavo Moreira 8f9d565f63 PR review fixes: Fix minor typo to match verb form from other docstrings 2024-08-10 00:49:18 -07:00
Gustavo Moreira 17861618df PR review fixes: Rename Tree to IDStorage. Move choose_id_storage() form LinuxUtilities to IDStorage. Use context and kernel_module_name instead of vmlinux 2024-08-10 00:13:38 -07:00
Gustavo Moreira 53f3d12341 linuxutilities code improvement. Remove code duplication 2024-08-09 23:35:41 -07:00
Gustavo Moreira 2c85ea525e PR review fixes: Fix page extension object get_content() explicit returns mixed with implicit returns. 2024-08-08 02:03:28 -07:00
Gustavo Moreira 06508a4afb PR review fixes: Fix the IDR's old kernel get_entries 2024-08-08 02:00:27 -07:00
Gustavo Moreira 7a8dea3356 PR review fixes: Code scanning complains about these unused variables. Let's comment them and adapt the FIXME message 2024-08-08 01:57:35 -07:00
Gustavo Moreira 0f3f338633 PR review fixes: Since the IDR, XArray and RadixTree can store any value, it renames the function names to a more generic name 2024-08-08 01:52:57 -07:00
Gustavo Moreira ee10ba8abb PR review fixes: Fix IDR explicit returns mixed with implicit returns and improve and fix code. 2024-08-08 01:46:53 -07:00
Gustavo Moreira de6637c987 PR review fixes: ebpf plugin code improvement. Use the object_from_symbol() instead 2024-08-08 00:52:34 -07:00
Gustavo Moreira 46842981fb PR review fixes: Use contextlib.suppress() instead of an empty exception handler 2024-08-07 00:24:58 -07:00
Gustavo Moreira 805b3514c3 PR review fixes: Fix page flags list method name, this was introduced earlier in another commit of this PR. 2024-08-07 00:23:19 -07:00
Gustavo Moreira f737b88d03 PR review fixes: Improve _walk_dentry() and get_inodes() variable names, arguments and return values 2024-08-06 23:12:01 -07:00
Gustavo Moreira c8cb4465da PR review fixes: Remove filter function, it isn't needed 2024-08-06 23:08:21 -07:00
Gustavo Moreira 339a9a94f5 PR review fixes: pidhashtable plugin add missing typing. 2024-08-06 23:00:09 -07:00
ikelosandGitHub 6b739f6f6c Merge pull request #1234 from dadokkio/patch-1 
add args and kwargs to threads.py init
 2024-08-06 22:20:18 +01:00
Arcuri DavideandGitHub 1e3e9e2c78 add args and kwargs to threads.py init 
Without args and kwargs there were an issue with timeliner plugin that tried to pass additional parameters like progress_callback raising TypeError
 2024-08-06 16:28:59 +02:00
Gustavo Moreira 7df0636f30 PR review fixes: Fix pidhashtable plugin explicit returns mixed with implicit returns 2024-08-06 04:57:33 -07:00
Gustavo Moreira bd37aa3930 PR review fixes: Fix pidhashtable plugin 2024-08-06 04:48:49 -07:00
Gustavo Moreira c9eb81c95f PR review fixes: Improve eBPF extension objects: bpf_prog and added bpf_prog_aux. Apply changes to the EBPF and Sockstat plugins. 2024-08-06 04:40:48 -07:00
ikelosandGitHub 398198042f Merge branch 'develop' into linux_page_cache 2024-08-04 13:44:37 +01:00
Gustavo Moreira 3e75c2ae9d Fix @functools.cache . It's available since Python 3.9 2024-08-04 14:40:45 +10:00
Gustavo Moreira cc04f665e3 Fix inode type 2024-08-03 23:47:28 +10:00
Gustavo Moreira 103537801e Linux: Add a basic eBPF program enumeration plugin to test and demonstrate using the IDR abstraction 2024-08-03 21:44:38 +10:00
Gustavo Moreira 55212008f8 Linux: Add pidhashtable plugin. This is based on the vol2 plugin, removing ancient kernel support, curating code and enhancing comments, while using the new IDR abstraction included also in this effort. 2024-08-03 21:39:51 +10:00
Gustavo Moreira ac27d6663a Linux: Add two page cache plugins, linux.pagecache.Files and linux.pagecache.InodePages 2024-08-03 21:26:29 +10:00
Gustavo Moreira 41684478ad Linux: Add page cache support, including abstractions like RadixTree, XArray, and IDR, to support both older and latest kernel versions 2024-08-03 21:21:49 +10:00
Gustavo Moreira a369a9e23c Linux: dentry object extension: Add a method to walk dentries subdirectories 2024-08-03 21:05:23 +10:00
Gustavo Moreira 231f682b27 Linux: Improve mount's object extension method docstrings 2024-08-03 21:01:59 +10:00
Gustavo Moreira 0dfb9d8a0f Linux mountinfo: Add a method to yield all filesystem superblocks 2024-08-03 20:57:23 +10:00
Gustavo Moreira d4ed07f95b PR review fixes: Add fixme to remember we should move wintime_to_datetime/unixtime_to_datetime out of renderers 2024-08-03 20:51:32 +10:00
ikelosandGitHub 32c8dc50af Merge pull request #1229 from volatilityfoundation/feature/argcomplete 
Feature/argcomplete
 2024-08-03 10:37:51 +01:00
ikelosandGitHub eb757b41cc Merge pull request #1230 from gcmoreira/linux_inode_timespec_timespec64_obj_extensions 
Linux: Add inode, timespec, and timespec64 object extensions
 2024-08-02 10:56:37 +01:00
Gustavo Moreira ed20834763 PR review fixes: Remove get_inode_number. It's better to use the type's original member name and handle the casting on the consumer side. 2024-08-02 19:48:09 +10:00
Gustavo Moreira d34b1ded3e PR review fixes: Remove get_inode_number. It's better to use the type's original member name and handle the casting on the consumer side. 2024-08-02 19:46:23 +10:00
Gustavo Moreira 933a41fa3a PR review fixes: Convert inode's is_* functions to properties 2024-08-02 14:22:27 +10:00
Gustavo Moreira b8d68b9a5e PR review fixes: Avoid using renderers in core functions. 2024-08-02 14:21:29 +10:00
Gustavo Moreira efba3a1b73 PR review fixes: Convert inode's is_* functions to properties 2024-08-02 14:17:57 +10:00
Gustavo Moreira 930d29046a PR review fixes: Avoid using renderers in core functions. 2024-08-02 14:15:01 +10:00
Gustavo Moreira 79529fb815 PR review fixes: Rename method name from private to internal 2024-08-02 13:52:07 +10:00
Gustavo Moreira 1dcaf9c0b1 PR review fixes: Rename method name from private to internal 2024-08-02 13:50:51 +10:00
ikelosandGitHub af5a743b35 Merge pull request #1219 from qpalzmz112/develop 
Added psxview plugin
 2024-08-02 01:33:59 +01:00
qpalzmz112 98c0094da5 Updated unpacked variable names 2024-08-01 18:51:11 -05:00
qpalzmz112 d19013c852 fixed typo, updated plugin docstring, and updated comment 2024-08-01 16:19:24 -05:00
Mike Auty 0bda154385 Clarify the documentation a little 2024-08-01 21:08:18 +01:00
Mike Auty e6308a6035 Make suggested changes by gcmoreira 2024-08-01 21:04:24 +01:00
Gustavo Moreira 3017a7d00c Linux: Add inode, timespec, and timespec64 object extensions to support different kernel versions, ensuring we will get aware datetimes when using them. 2024-08-01 12:23:09 +10:00
Gustavo Moreira 90b8b5340f Linux: Add inode, timespec, and timespec64 object extensions to support different kernel versions, ensuring we will get aware datetimes when using them. 2024-08-01 11:46:10 +10:00