Mike Auty
7f6378fd5d
Automagic: Changing stacking order for linux/mac
...
The linux/mac stackers are more accurate (based on banners) than the
windows stacker (based on offsets). As such in cases where both would
match, we should go for the more accurate match first (linux/mac) over
windows. In most cases this will make no difference because of the
exclusion lists, so only one stacker will run, but in cases such as
volshell where all stackers are run, this may help with certain edge
cases.
2021-07-12 12:27:53 +01:00
Mike Auty
e28910f670
Windows: Ensure we set the kernel_virtual_offset before other reqs
...
It appears in issue #524 that the step to fulfil symbol requirements
can throw an exception (which then prevents the kernel_virtual_offset
(which is optional) from being set appropriately.
This sets the kvo first and adds a check to where it's set. It doesn't
get to the root of why an exception is thrown, but should ensure it's
easier to spot if it goes wrong.
Fixes #524 .
2021-07-12 12:09:07 +01:00
Mike Auty
c2b290dc42
Windows: Fix up pdb.json for LF_UDT_SRC_LINE
...
It looks like some copypasta snuck in the manual pdb.json.
The offsets for the LF_UDT_SRC_LINE as was the total structure size for
LF_UDT_MOD_SRC_LINE.
Fixes #527
2021-07-12 10:48:43 +01:00
Mike Auty
42ef21fd29
Documentation: Clarify linux ISF generation
2021-07-11 22:37:41 +01:00
ikelos and GitHub
4d9b2517c6
Merge pull request #498 from volatilityfoundation/windows_crashdump_fixes_jxwenger
...
complete windows crash dump support
2021-07-11 00:07:27 +01:00
iMHLv2
f1079e7e9b
fix up required framework version for crashinfo
2021-07-10 08:32:40 -05:00
ikelos and GitHub
af090bf29e
Merge pull request #519 from fgomulka/tty-check-pointer-issue
...
Create a list_head to fix tty_check bug
2021-06-23 20:22:27 +01:00
Frank Gomulka
dbae5d353d
Create a list_head to fix tty_check bug
...
This commit casts `tty_driver` to a `list_head` to fix an
AttributeError in the linux tty_check plugin
2021-06-22 10:43:31 -04:00
Mike Auty
b6165b439f
Mac: Fix minor typo in previous fix
2021-06-07 01:44:21 +01:00
Mike Auty
772083ac75
Mac: Fix unguarded read in automagic #515
2021-06-06 11:50:23 +01:00
Mike Auty
ed1320491c
Poolscan: Further python 3.6 efficiencies
2021-06-04 22:19:12 +01:00
ikelos and GitHub
7aff6f6d8b
Merge pull request #513 from bonafont/develop
...
Fixed CM_KEY_VALUE get_decode method
2021-06-04 22:16:16 +01:00
Anthony Fey
a11c94a82b
Fixed CM_KEY_VALUE get_decode method
2021-06-04 18:52:00 +02:00
ikelos and GitHub
c3107986fc
Merge pull request #401 from volatilityfoundation/issues/issue400
...
Objects: Avoid reconstructing pointed objects
2021-06-02 20:30:42 +01:00
iMHLv2
7d9c66c407
run yapf on the newly added files
2021-06-01 14:27:20 -05:00
iMHLv2
7b73f8d545
fix the copyright date for extensions/crash.py
2021-06-01 14:21:11 -05:00
iMHLv2
d2db22c310
use typing for the layer variable passed to _generator
2021-06-01 14:20:59 -05:00
iMHLv2
d285519ecb
don't assume primary.memory_layer is a crash layer...instead, cycle through the layers until finding the crash layer
2021-06-01 14:17:31 -05:00
iMHLv2
a0adbde994
eliminate confusing single letter variable
2021-06-01 13:55:37 -05:00
iMHLv2
b15e69e11d
ensure the crashinfo plugin gets a crash layer
2021-06-01 13:55:21 -05:00
ikelos and GitHub
7ef7dd88f0
Merge pull request #510 from volatilityfoundation/revert-507-issues/issue505
...
Revert "Windows: Increase self-referential check"
2021-05-26 23:45:00 +01:00
ikelos and GitHub
3bb23b29e3
Revert "Windows: Increase self-referential check"
2021-05-26 23:43:35 +01:00
Mike Auty
0214fa35a1
Core: Increment minimum python version to 3.6
2021-05-26 23:23:27 +01:00
Mike Auty
9e7e82f026
Development: Minor mac extract_kernel updates
2021-05-26 22:14:00 +01:00
ikelos and GitHub
77d0debdac
Merge pull request #507 from volatilityfoundation/issues/issue505
...
Windows: Increase self-referential check
2021-05-26 22:12:33 +01:00
ikelos and GitHub
069a3da751
Merge pull request #504 from doomedraven/patch-1
...
ability to reverse filtering see long description
2021-05-23 16:58:35 +01:00
doomedraven and GitHub
dd6ad75b22
Update pslist.py
2021-05-23 17:10:52 +02:00
Mike Auty
abafa58f1a
Windows: Increase self-referential check
2021-05-23 15:49:28 +01:00
doomedraven and GitHub
ed9c2dd979
ability to reverse filtering see long description
...
Hello, this is very useful to optimize some scans, like in case of sandboxing, imagine:
1 round it scans only all processes that was captured by sandbox aka pid_list
2. round it scans all the rest processes ignoring pid_list from round 1
if you have a better idea how to improve/implement this, let me know, we use our custom function, but i think it might be useful for the rest
2021-05-18 22:37:34 +02:00
Mike Auty
4cb71366c7
Windows: Improve netstat errors
2021-05-16 17:08:56 +01:00
Mike Auty
f873ced04e
Windows: Improve hashdumping plugin errors
2021-05-16 17:01:52 +01:00
Mike Auty
2705614306
Windows: Remove debugging statements from pdbutil
2021-05-13 21:49:25 +01:00
ikelos and GitHub
8f7b0f2c47
Merge pull request #475 from f-block/develop
...
Temporary workaround for changes in transition PTE
2021-05-12 20:22:09 +01:00
iMHLv2
7152ca0ffc
refactor load_segments() to fix 32-bit bitmap crashdumps
2021-05-11 15:59:42 -05:00
ikelos and GitHub
21b33b677c
Merge pull request #496 from volatilityfoundation/feature/faster-pdb-scanning
...
Windows: Improve PDB scanning
2021-05-10 20:24:52 +01:00
Mike Auty
7d408ce0f3
Windows: Make IPI handling of PDBs optional
2021-04-26 01:16:38 +01:00
ikelos and GitHub
a165b1b1cf
Merge pull request #487 from volatilityfoundation/feature/better-windows-identification
...
Automagic: Add a slow scan for kernel identification
2021-04-22 18:00:56 +01:00
Mike Auty
007717590e
Merge branch 'issues/issue495' into develop
2021-04-22 17:21:05 +01:00
Mike Auty
e241ac0ac0
Windows: Fixes missing os import
...
Fixes #495
2021-04-22 17:18:52 +01:00
Mike Auty
c5c726ab28
Windows: Improve PDB scanning
2021-04-21 00:02:36 +01:00
ikelos and GitHub
280c912121
Merge pull request #492 from cstation/fix/qemu-conf
...
Fix reading JSON configration of QEMU-images
2021-04-14 19:47:45 +01:00
cstation
aa26601b34
Fix reading JSON configration of QEMU-images
2021-04-14 20:39:03 +02:00
Mike Auty
88ff4f1d06
Windows: Fix up double import in pdbconv
2021-04-07 22:30:45 +01:00
ikelos and GitHub
9d2c17b79d
Merge pull request #483 from volatilityfoundation/prevent_pslist_backtrace
...
Prevent pslist from backtracing on invalid process. Include a warnin…
2021-04-07 18:19:03 +01:00
Andrew Case
ce3b0fcc0b
Change debug to info for invalid process warning message
2021-04-07 12:04:50 -05:00
Mike Auty
191da08fb3
Automagic: Add a slow scan for kernel identification
2021-04-04 17:46:37 +01:00
Mike Auty
a1c5f5e5e5
Automagic: Improve secondary 64-bit self-ref finder
2021-04-03 13:33:20 +01:00
Mike Auty
087b172148
Automagic: Add secondary 64-bit self-referential value
2021-04-03 13:07:43 +01:00
iMHLv2
00db33e0fe
print human readable dump type in crashinfo, along with bitmap header size, bitmap size, and page count
2021-03-31 09:52:12 -05:00
iMHLv2
fb54a2cade
report segments in the crash layer with LOGLEVEL_VVVV
2021-03-30 21:23:46 -05:00
Mike Auty