WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 09:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,388 Commits 80 Branches 17 Tags
87fe3444ebb0d3bf7595c6cefc24f04145ff8dae
Commit Graph
4388 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Gustavo Moreira 87fe3444eb Linux: Add support for mount namespace in kernels 6.8+. This fixes volatilityfoundation/volatility3#1187 2024-08-14 23:50:39 -07:00
ikelosandGitHub 4578434bbd Merge pull request #1236 from sluke-nuix/issues/truecrypt_module_version 
Update the modules.Modules version requirement.
 2024-08-13 17:06:46 +01:00
Steven Luke 918584537f Update the modules.Modules version requirement. 
This is a response to PR [#1173](https://github.com/volatilityfoundation/volatility3/pull/1173)
 2024-08-13 08:34:35 -04:00
ikelosandGitHub 6b739f6f6c Merge pull request #1234 from dadokkio/patch-1 
add args and kwargs to threads.py init
 2024-08-06 22:20:18 +01:00
Arcuri DavideandGitHub 1e3e9e2c78 add args and kwargs to threads.py init 
Without args and kwargs there were an issue with timeliner plugin that tried to pass additional parameters like progress_callback raising TypeError
 2024-08-06 16:28:59 +02:00
ikelosandGitHub 32c8dc50af Merge pull request #1229 from volatilityfoundation/feature/argcomplete 
Feature/argcomplete
 2024-08-03 10:37:51 +01:00
ikelosandGitHub eb757b41cc Merge pull request #1230 from gcmoreira/linux_inode_timespec_timespec64_obj_extensions 
Linux: Add inode, timespec, and timespec64 object extensions
 2024-08-02 10:56:37 +01:00
Gustavo Moreira ed20834763 PR review fixes: Remove get_inode_number. It's better to use the type's original member name and handle the casting on the consumer side. 2024-08-02 19:48:09 +10:00
Gustavo Moreira 933a41fa3a PR review fixes: Convert inode's is_* functions to properties 2024-08-02 14:22:27 +10:00
Gustavo Moreira b8d68b9a5e PR review fixes: Avoid using renderers in core functions. 2024-08-02 14:21:29 +10:00
Gustavo Moreira 79529fb815 PR review fixes: Rename method name from private to internal 2024-08-02 13:52:07 +10:00
ikelosandGitHub af5a743b35 Merge pull request #1219 from qpalzmz112/develop 
Added psxview plugin
 2024-08-02 01:33:59 +01:00
qpalzmz112 98c0094da5 Updated unpacked variable names 2024-08-01 18:51:11 -05:00
qpalzmz112 d19013c852 fixed typo, updated plugin docstring, and updated comment 2024-08-01 16:19:24 -05:00
Mike Auty 0bda154385 Clarify the documentation a little 2024-08-01 21:08:18 +01:00
Mike Auty e6308a6035 Make suggested changes by gcmoreira 2024-08-01 21:04:24 +01:00
Gustavo Moreira 3017a7d00c Linux: Add inode, timespec, and timespec64 object extensions to support different kernel versions, ensuring we will get aware datetimes when using them. 2024-08-01 12:23:09 +10:00
qpalzmz112 9e8864521c Added debug log for failed address translation 2024-07-31 18:02:52 -05:00
qpalzmz112 fd6e4bec5c Updated with feedback from the PR 2024-07-31 17:53:29 -05:00
Mike Auty d576f8cb48 Fix CodeQL error 2024-07-31 21:49:07 +01:00
Mike Auty 73bc10c283 Wire the argcomplete into volshell too 2024-07-31 21:46:57 +01:00
ikelosandGitHub 16cde44400 Merge pull request #1228 from volatilityfoundation/ldr_fix 
Remove errant filter on ldrmodule checks
 2024-07-30 23:21:57 +01:00
ikelosandGitHub 2743e78481 Merge pull request #1227 from dgmcdona/dgmcdona/windows-netscan-update 
Windows: Updates netscan with new symbol file
 2024-07-30 23:19:56 +01:00
ikelosandGitHub 189f8729e5 Merge pull request #1222 from gcmoreira/renderers_time_conversion_fixes 
Renderers time conversion fixes
 2024-07-30 23:08:11 +01:00
ikelosandGitHub af7466b353 Merge pull request #1224 from dgmcdona/dgmcdona/windows-callback-symbol-fix 
Windows: Fixes bad structure member in callbacks
 2024-07-30 22:45:50 +01:00
ikelosandGitHub 4e8d64ed86 Merge pull request #1217 from eve-mem/windows_issue_1146 
Windows: update handles plugin sar warnings to use DEFAULT_SAR_VALUE var
 2024-07-30 22:38:36 +01:00
ikelosandGitHub bee333908b Merge pull request #1221 from volatilityfoundation/issues/issue1216 
Renderers: Allow BaseAbsentValues in value results
 2024-07-30 22:37:42 +01:00
Andrew Case a84a3706c5 Remove errant filter on ldrmodule checks 2024-07-30 14:00:41 -05:00
David McDonald 56b618f5c3 Windows: Updates netscan with new symbol file 
`netscan` was missing coverage for Windows 10 Build 20348, causing
owners and create times for `_TCP_ENDPOINTS` to be missing. This adds a
symbol file and the necessary version check in the netscan plugin.
Testing confirms that this returns the correct creation time and owner
process.
 2024-07-30 13:04:53 -05:00
Gustavo Moreira efc48d5831 Make timeliner able to sort aware datetimes. Otherwise, it will raise an exception when comparing the plugin output data with this naive datetime 2024-07-30 17:18:14 +10:00
David McDonald d97fd777f3 Windows: Bumps netstat module version requirement 
This is a bump of the version number for the netstat plugin's `modules`
requirement - it didn't get updated after #1173 was merged.
 2024-07-29 18:41:57 -05:00
David McDonald ba7ec00599 Windows: Fixes bad structure member in callbacks 
This fixes a bug in the x64 callbacks symbols. The `NotificationRoutine`
is currently an `unsigned int` instead of a void pointer. This prevents
the correct mapping of the notification routine to the kernel module
that contains it.
 2024-07-29 17:55:56 -05:00
Gustavo Moreira b343734bae Renderers conversion exceptions fix: Even though the documentation states that OverflowError should be raised starting from version 3.3, it has been observed that ValueError is still being triggered. Also, in Linux, we noticed that OSError is also being raised in some cases. 2024-07-29 15:16:34 +10:00
Gustavo Moreira ece15c914f Renderers conversion exceptions fix: Since version 3.3 utcfromtimestamp() and fromtimestamp() Python datimetime module raises OverflowError instead of ValueError. As of today, Volatility3 requires Python 3.7.3 so we should only include OverflowError 2024-07-29 14:18:10 +10:00
Gustavo Moreira 76414d3246 Renderers conversion fix: Create aware datetimes to represent times in UTC. Fix Python 3.12 datetime.utcfromtimestamp() deprecation. 
See warning note on https://docs.python.org/3/library/datetime.html#datetime.datetime.utcfromtimestamp:

Because naive datetime objects are treated by many datetime methods as local times, it is preferred to use aware datetimes to represent times in UTC. As such, the recommended way to create an object representing a specific timestamp in UTC is by calling datetime.fromtimestamp(timestamp, tz=timezone.utc).

Additionaly, datetime.utcfromtimestamp() is deprecated since 3.12
 2024-07-29 14:13:54 +10:00
Mike Auty b659a060bd Renderers: Ensure the version is bumped so plugins can require the format_hints properly 2024-07-28 21:57:48 +01:00
Mike Auty 0d8fb76b3a Renderers: Allow BaseAbsentValues in value results 
Fixes #1216
 2024-07-28 19:57:23 +01:00
Mike Auty e89e776377 Try out argcomplete as well 2024-07-28 12:41:31 +01:00
Mike Auty 44f26c928e Add in shtab autocompletion 2024-07-28 12:35:02 +01:00
qpalzmz112 824b0599f2 formatted 2024-07-27 20:35:08 -05:00
qpalzmz112 f44ceb321d Added psxview 2024-07-27 20:11:39 -05:00
ikelosandGitHub 438fc79c8c Merge pull request #1197 from eve-mem/issue_1040 
Windows: remove size from filescan output as it is not the file size
 2024-07-26 10:03:50 +01:00
Eve 7a03e9deab Windows: Add a _version to the filescan plugin 2024-07-25 18:21:12 +01:00
Eve 799afe6e51 Windows: fix type in handles plugin 2024-07-25 18:02:30 +01:00
Eve 6f3f645dbc Windows: update handles plugin sar warnings to use DEFAULT_SAR_VALUE var 2024-07-25 17:59:10 +01:00
ikelosandGitHub 05aa81b63c Merge pull request #1214 from eve-mem/windows_issue_1146 
Windows: update handles plugin to use a default SAR value of 0x10
 2024-07-24 22:11:42 +01:00
ikelosandGitHub 19e1c21cbb Merge pull request #1207 from volatilityfoundation/issues/fix-generator-inheritance 
Add in threads that only provides an implmentation method
 2024-07-24 21:04:36 +01:00
Mike Auty f4cbed856b Fix up missing filter parameter 2024-07-24 20:47:05 +01:00
Mike Auty e1065f9e78 Fix up a missing super which @atcuno spotted 2024-07-24 20:32:36 +01:00
Eve 7d52f7992d Windows: Make the default sar value used in handles plugin a variable so if it needs to be changed it gets updated in one place only 2024-07-24 11:06:26 +01:00