WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-21 22:12:23 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,203 Commits 80 Branches 17 Tags
87ff6dd87c19a65e59847700525c7fc2efccdb4c
Commit Graph
182 Commits
Author SHA1 Message Date
Michael Lighandikelos 87ff6dd87c refs #200 raise ValueError if an object doesn't have a name 2020-07-01 20:51:22 +01:00
Mike Auty 0ffe318cb0 Project: Update copyright headers for files added in 2020. 2020-06-10 21:13:37 +01:00
superponibleandikelos 69be2157fb fix typo 2020-05-27 23:16:18 +01:00
superponibleandikelos 48e33c2b98 create property for HiveGenerator invalid member 2020-05-27 23:16:18 +01:00
Mike Auty a0da5fef83 Issue #186: Rebase and apply yapf 2020-05-27 23:16:18 +01:00
superponibleandikelos 36c19735ee issue #186 - hivelist with new hivescan/bigpools 2020-05-27 23:16:18 +01:00
superponibleandikelos 002758c7f2 issue #186 - hivescan and hivelist with bigpools 2020-05-27 23:16:18 +01:00
superponibleandikelos a21ab89019 issue #186 - add bigpools plugin 2020-05-27 23:16:18 +01:00
superponibleandikelos 054d144f9b issue #186 - walk forward, backward, scan if needed 2020-05-27 23:16:18 +01:00
superponibleandikelos a4301afe22 issue #186 - skip type check on CMHIVE 2020-05-27 23:16:18 +01:00
Mike Auty 0c43beb42d Core: Apply yapf across all files again. 2020-05-05 22:14:33 +01:00
Mike Auty edecd64703 Yarascan: Fixes #209 by returning matched strings 2020-04-14 23:45:08 +01:00
Michael Ligh d5bdf9633d refs #204 fix modscan, _LDR_DATA_TABLE_ENTRY is not an executive object and doesn't have an object_type 2020-04-07 09:22:52 -05:00
Mike Auty bd2a382d88 CLI & windows.handles: Improve exception handling 2020-03-16 22:34:03 +00:00
Mike Auty 77be83edc4 Layers: Change mapping signature to return domain length 2020-03-04 20:29:42 +00:00
Mike Auty f00453e366 Procdump: Remove redundant line as caught by @iMHLv2 2020-01-22 19:49:11 +00:00
Michael Lighandikelos 1d7da6402b svcscan cleanup: win10 before 15063 uses win8 types 2020-01-22 19:23:30 +00:00
Mike Auty 9fe6e6ba37 registry: Add the hivedump plugin 2020-01-17 17:22:04 +00:00
Mike Auty 2d408491bd Printkey: Slightly improve subkey name determination. 2020-01-15 02:19:12 +00:00
Mike Auty 3f5b96f3c7 Yapf: Clean-up the whole codebase. 2020-01-14 15:44:07 +00:00
Mike Auty b7ba877727 procdump: Enure proc_id is defined. 2020-01-14 15:36:54 +00:00
doomedravenandikelos 07b94abc1e Update procdump.py 2020-01-14 10:52:05 +00:00
doomedravenandikelos cdc0835863 Update procdump.py 2020-01-14 10:52:05 +00:00
doomedravenandikelos e4d7b7975f expose process_dump to other plugins 2020-01-14 10:52:05 +00:00
iMHLv2andGitHub f7cc94a244 Merge pull request #168 from volatilityfoundation/issue-10-vad-protection-layer 
Use a kernel layer to read vad protection constants
 2020-01-04 10:02:59 -06:00
Michael Ligh b7b6c44eab remove unused variable in vaddump.py 2020-01-04 09:35:51 -06:00
Mike Auty d2daa12564 Malfind: Rename the layer_name parameter to be more descripttive 2020-01-03 22:12:04 +00:00
William LIN e6656c96af VadDump: Fix incorrect variable out_of_range in vad_dump 2019-12-26 19:51:13 +01:00
Michael Ligh cd841616af refs #144 use a kernel layer to read vad protection constants 2019-12-08 07:46:02 -06:00
Mike Auty f34958a16d Poolscanner: Add necessary exception handling. 2019-12-04 22:11:42 +00:00
Mike Auty 386f94d9ee Pool: Make object_header type checking the plugin's responsibility. 2019-12-04 22:11:42 +00:00
Mike Auty 8691c68604 Pool: Refactor pool extension to its own file. 2019-12-04 22:11:42 +00:00
Michael Lighandikelos d0f9cf9a2f refs #139 use _EPROCESS.ControlFlowGuardEnabled to distinguish between windows 10 <= 15063 versus >= 16299 2019-12-04 21:19:19 +00:00
Mike Auty b6d807ff51 Poolscanner: Document the typing issue of python3.5's IntEnum over IntFlag 2019-11-27 11:30:14 +00:00
Mike Auty b0b868d79c Typing: General typing fixes across the tree 2019-11-27 11:30:14 +00:00
Mike Auty 31ddbaaa2e Typing: Fix python3 format string/byte output issues 2019-11-27 11:30:14 +00:00
Mike Auty 249c3ec223 Svcscan: Ensure or later checks are done in order. 
Relates to issue 139.
 2019-11-18 20:57:34 +00:00
Mike Auty b99ace86fb Tidy up exceptions to be more accurate. 2019-11-13 19:58:14 +00:00
Mike Auty 40fcdf9469 exceptions: SymbolErrors now contain specific information 2019-11-13 19:27:00 +00:00
doomedravenandikelos 4543b0af33 Update vaddump.py 2019-11-13 18:54:19 +00:00
doomedravenandikelos 97f670ec79 simplify vad dump to be used by other plugins 2019-11-13 18:54:19 +00:00
Mike Auty face38436e layers: Fix up uses of is_valid. 2019-11-12 09:09:51 +00:00
Mike Auty 23b14b772a Poolscanner: Fix error in index checking. 2019-11-09 00:17:07 +00:00
Mike Auty ee31ece006 Fix a logging on add_process_layer exceptions. 
There were a number of issues with commit 3df5e995 that was applied in
haste (notably, that exceptions wasn't imported in several cases, which
would break the code if it were ever run).

We now give debugging output when a process can't be constructed and
provide as much available information as possible.

Two unused lines were also removed from verinfo.
 2019-11-03 23:15:38 +00:00
Mike Auty 73aa73f30e Ensure we test None using is rather than ==. 2019-11-03 22:46:20 +00:00
Mike Auty 4457bcaee0 vadyarascan: Ensure we scan the right layer 
This patch ensures we scan the vad segments within the correct layer
(the process layer, not the kernel layer) and lists the pid in the
output.
 2019-10-31 19:15:02 +00:00
Mike Auty 27a291cf61 Remove the erronious print statement, which should be a vollog message if needed. 2019-10-18 08:39:56 -04:00
Mike Auty 0be9061989 Tidy up commit e0097ac. 2019-10-18 08:38:17 -04:00
atcuno 3df5e9957e Windows - add missing add_process_layer exception handling in a few plugins 2019-10-17 11:47:19 -04:00
atcuno e0097ac9c1 Windows - protect handles from smear 2019-10-17 11:03:48 -04:00