Gustavo Moreira
8f8e04da97
vfs_inode is not being used nor required
2021-12-21 15:52:22 +11:00
Gustavo Moreira
fe105dc4a7
Add doc strings and typing info everywhere.
...
Improve some variable names
2021-12-21 15:01:29 +11:00
Gustavo Moreira
7099a7a52e
Fix. We should call the net type method here.
2021-12-21 14:54:38 +11:00
Gustavo Moreira
a7520a377d
Supporting socket and reuseport filters in all the socket families.
2021-12-21 14:53:13 +11:00
Gustavo Moreira
7dc33b8314
fix typo
2021-12-14 17:28:38 +11:00
Gustavo Moreira
a1ff8d7809
Fix comment. This was related to netlink_sock not packer_sock
2021-12-14 17:25:58 +11:00
Gustavo Moreira
34176a8066
Moving log lines from warning to LOGLEVEL_V
2021-12-14 17:10:45 +11:00
Gustavo Moreira
f4e1f4729f
Added type annotations
2021-12-14 16:56:27 +11:00
Gustavo Moreira
8af7422928
Parameterized generator
2021-12-14 16:52:47 +11:00
Gustavo Moreira
b4bcdd0856
Minor changes
2021-12-14 16:51:02 +11:00
Gustavo Moreira
7ed5739e24
socket is no longer imported in this file. Remove the underscore
2021-12-14 16:24:57 +11:00
Gustavo Moreira
52181c7e8f
Improvements to the parameterized generator changes
2021-12-14 16:22:30 +11:00
Gustavo Moreira
c54818e630
Remove redundancies around array_to_string(). It returns a str() already.
2021-12-14 16:00:11 +11:00
Gustavo Moreira
a386a7a948
Removed underscore from unused arguments
2021-12-14 15:40:51 +11:00
Gustavo Moreira
86676cf4e8
Changing BPF_PROG_TYPE_UNSPEC constant in favor of a literal 0 and a comment.
2021-12-14 15:37:55 +11:00
Gustavo Moreira
6970776c4c
Renaming function to use single underscore and name from extra to extended
2021-12-14 15:37:48 +11:00
Gustavo Moreira
2e93db9b57
Adding versioning to SockHandlers
2021-12-14 15:37:43 +11:00
Gustavo Moreira
9766327433
Parameterized generator
2021-12-14 15:37:37 +11:00
Gustavo Moreira
5c507f5ae8
Plugins versioning fixes
2021-12-14 15:37:19 +11:00
Gustavo Moreira
6456e55ddc
Added Sockstat linux plugin to enumerate all processes sockets.
...
The output format is based on the `ss` tools. It supports:
* Unix socket
* Inet/Inet6 sockets
* Netlink sockets
* VSock sockets
* Packet sockets
* XDP sockets (eBPF)
* Bluetooth sockets (When the respective symbols are present)
Changes to the linux Lsof plugin were required to be able to reuse its filedescriptor listing capability.
2021-12-10 17:51:27 +11:00
Gustavo Moreira
02bf609fd1
Prepare linux.lsof.Lsof plugin to work as a helper library for other plugin.
2021-12-10 17:50:52 +11:00
Mike Auty
581251cb05
Linux: Fix long standing typo (thanks to @gcmoreira)
2021-12-08 23:34:53 +00:00
ikelos and GitHub
32ec4afed3
Merge pull request #586 from volatilityfoundation/issues/qemu-speed-up
...
Layers: Speed up qemu by not bisecting
2021-12-08 23:08:32 +00:00
ikelos and GitHub
8f083ed1dd
Merge pull request #476 from japhlange/issues/issue474_netscan_win8sp1x64
...
adds netstat symbols to Win8x64 ISF files
2021-12-06 20:10:25 +00:00
Jan
125658ee0d
re-adds accidentally deleted file
2021-12-06 21:09:39 +01:00
Jan
be4d014f1a
improves decision making when to inspect driver pe header based on version_dict
2021-12-06 17:18:39 +01:00
Jan
6cd2d940f3
adds proper version requirement for verinfo
2021-12-06 17:18:38 +01:00
Jan
3aac7b228e
adds a few clarifying comments and handles errors better
2021-12-06 17:16:23 +01:00
Jan
ee65793fd8
adds new ISF for tcpip.sys 6.3.9600.19935 + distinguisher
2021-12-06 17:16:20 +01:00
Jan
90ad7b1609
reverts pointless createtime offset change
2021-12-06 17:14:40 +01:00
Jan
fffb375909
adds netstat symbols to Win8x64 ISF files
2021-12-06 17:14:40 +01:00
Mike Auty
96820e2804
Plugins: Bump skeleton_key_check to 2.0.0
2021-12-03 16:02:06 +00:00
ikelos and GitHub
da1216a747
Merge pull request #594 from a5hlynx/develop
...
update version to 2.0.0
2021-12-03 15:58:15 +00:00
a5hlynx
680349016e
update version to 2.0.0
2021-12-04 00:29:00 +09:00
Mike Auty
f821ac6072
Layers: Comment out unused code in AVML
2021-11-17 20:42:11 +00:00
Mike Auty
8d48faa0d9
Layers: Close file on layer destruction to prevent ResourceWarning
2021-11-17 13:52:25 +00:00
Mike Auty
3cb2bf9fac
Core: Fix up python 3.10 support
...
Fixes #589
2021-11-17 13:41:09 +00:00
Mike Auty
a1cbea27a8
Layers: Speed up qemu by not bisecting
2021-11-08 22:56:06 +00:00
ikelos and GitHub
23453f5d8c
Merge pull request #580 from volatilityfoundation/issues/large-page-fix
...
Layers: Fix bug where PAT flag is treated as address
2021-11-03 19:20:38 +00:00
ikelos and GitHub
bcdec8a480
Merge pull request #584 from CaptWake/issue-449
...
issue-449 - add --physical flag
2021-10-27 23:21:50 +01:00
ikelos and GitHub
0c603a20ba
Merge pull request #579 from volatilityfoundation/feature/vad-maxsize
...
Windows: Set a 100Gb VAD max size for vadinfo
2021-10-27 23:19:57 +01:00
Mike Auty
20ca165d0f
Windows: Lower the vadlimit on MHL's advice
2021-10-27 23:19:30 +01:00
Stefano
6979a6d2ee
psscan: Remove usage of PHYSICAL_DEFAULT variable
2021-10-25 17:56:33 +02:00
Stefano
2d3d133c0e
issue-449 - add --physical flag
2021-10-24 19:02:14 +02:00
ikelos and GitHub
a7ad0dbc0e
Merge pull request #582 from garanews/develop
...
fix some typo
2021-10-19 09:02:14 +01:00
garanews
449c2aaddf
fix some typo
2021-10-18 14:38:12 +02:00
Mike Auty
2a7831466c
Layers: Fix bug where PAT flag is treated as address
2021-10-17 13:29:32 +01:00
Mike Auty
7cac1a98fd
Core: Update documentation for RegExScanner
2021-10-13 15:03:17 +01:00
Mike Auty
5f3e519cae
Core: Make the regex scanner default to DOTALL
...
This will have no impact on the existing core use of the regex scanner,
and therefore does not require a version bump.
2021-10-13 15:00:27 +01:00
Mike Auty
adfb0de187
Windows: Set a 100Gb VAD max size for vadinfo
2021-10-13 14:50:42 +01:00
Gustavo Moreira