Andrew Case
92db0e3f08
Address feedback
2025-02-14 20:42:00 +00:00
Andrew Case
9b78099a08
Enforce kernel boundaries correctly. Fix bugs. Closes #1474
2025-02-14 19:24:26 +00:00
ikelos and GitHub
575e645f4f
Merge pull request #1615 from volatilityfoundation/dgmcdona/envars_unbound_locals
...
Windows Envars: Fix unbound locals
2025-02-13 22:49:19 +00:00
ikelos and GitHub
3f2a514cc2
Merge pull request #1616 from volatilityfoundation/dgmcdona/windows_cmdline_output
...
Windows Cmdline: Clean up output
2025-02-13 22:47:40 +00:00
ikelos and GitHub
4172a574d5
Merge pull request #1617 from volatilityfoundation/dgmcdona/windows_envars_silent_vars
...
Windows Envars: Remove extra config check
2025-02-13 22:36:45 +00:00
David McDonald
4712cafa4b
Windows Envars: Remove extra config check
...
Tiny bit of cleanup here - there's no need to re-check the config for
`SILENT` for each variable. We can just initialize it once as either an
empty list or the calculated list of silent vars depending on the config
value.
2025-02-12 10:23:46 -06:00
David McDonald
bcbfc27d4f
Windows Cmdline: Clean up output
...
The strings being used as return values here would (IMO) be better as
debug statements, with the plugin returning
`renderers.UnreadableValue()` for any of the `InvalidAddressException`
code paths.
2025-02-12 10:11:23 -06:00
David McDonald
443cfd2515
Windows Envars: Fix unbound locals
...
Technically, these were protected against `UnboundLocalError` exceptions
through the use of the `sys` and `ntuser` boolean variables, but this
really isn't the best way to prevent that from happening, and
type-checkers still warn about the potentially unbound locals. This fix
instead uses the `sys` and `ntuser` variables to hold the registry keys,
preinitializing them to `None` and checking their value before
attempting to access instance methods.
2025-02-12 10:02:31 -06:00
ikelos and GitHub
8dceeb2144
Merge pull request #1611 from Abyss-W4tcher/pre_linux_pagecache_recoverfs_2
...
Re-apply "Pre linux.pagecache.recoverfs support"
2025-02-09 18:14:24 +00:00
ikelos and GitHub
7e94d76283
Merge pull request #1601 from volatilityfoundation/issues/kvo-optional
...
Issues/kvo optional
2025-02-09 15:53:48 +00:00
Mike Auty
444376cbba
Fix typos and try setting back requirement change
2025-02-09 15:39:49 +00:00
ikelos and GitHub
f744d03ecc
Merge pull request #1610 from Abyss-W4tcher/linux_tracing_tracepoints
...
New plugin: linux.tracing.tracepoints
2025-02-09 13:04:00 +00:00
Abyss Watcher
f1b34df26b
2.0.2 -> 3.0.0 InodePages bump
2025-02-09 13:49:24 +01:00
Abyss Watcher
826281b3b9
add and use write_inode_content_to_stream
2025-02-09 13:48:59 +01:00
Abyss Watcher
223f2d69bb
switch to context and layer_name calling convention
2025-02-09 13:47:37 +01:00
Abyss Watcher
03f6fa9533
1.0.3 -> 1.1.0 Files bump
2025-02-09 13:45:46 +01:00
Abyss Watcher
8d9d0f5689
add and use follow_symlinks parameter
2025-02-09 13:45:23 +01:00
Abyss Watcher
b9d4605b8a
switch to InodeUser.format_symlink
2025-02-09 13:44:16 +01:00
Abyss Watcher
cd9ba823a1
add inode_size and format_symlink to InodeUser
2025-02-09 13:42:47 +01:00
Abyss Watcher
8d23d5b808
use architectures.LINUX_ARCHS
2025-02-09 13:41:46 +01:00
Abyss Watcher
a9691fbe77
remove unnecessary object creation
2025-02-09 12:41:23 +01:00
Abyss Watcher
83dde6aec3
improve prel32 comments
2025-02-09 12:26:42 +01:00
ikelos and GitHub
ca420d9a5d
Merge pull request #1607 from volatilityfoundation/issue_1475_ldrmodules
...
Make a generic DLL enumeration function that ensures the base address…
2025-02-08 19:40:56 +00:00
Abyss Watcher
0abe258765
initial linux.tracing.tracepoints.CheckTracepoints
2025-02-08 15:41:02 +01:00
ikelos and GitHub
7719d29881
Merge pull request #1609 from volatilityfoundation/unloaded_modules_valid_modules_only
...
Prevent yielding smeared/broken modules from the unloaded module list
2025-02-08 00:17:07 +00:00
Andrew Case
df55b7890d
Prevent yielding smeared/broken modules from the unloaded module list
2025-02-07 18:05:16 -06:00
Andrew Case
67c001ab50
Update for black
2025-02-07 15:12:06 -06:00
Andrew Case
8c617d6b3f
Make a generic DLL enumeration function that ensures the base address is set and we return as many entries as possible #1475
2025-02-07 15:06:32 -06:00
ikelos and GitHub
789081e971
Merge pull request #1606 from volatilityfoundation/issue_1594_dname
...
Catch symbolerror for when a kernel does not have ns_common #1594
2025-02-07 19:44:04 +00:00
ikelos and GitHub
44ae4f137e
Merge pull request #1596 from volatilityfoundation/vma_get_name_fixes
...
Fix get_name API, fix malfind
2025-02-07 19:35:18 +00:00
ikelos and GitHub
e5e4d30a46
Merge pull request #1514 from volatilityfoundation/file_descriptors_exception_handling
...
Add proper exception handling in file descriptor enumeration
2025-02-07 19:35:07 +00:00
Andrew Case
13278121e3
Catch symbolerror for when a kernel does not have ns_common #1594
2025-02-07 13:33:33 -06:00
Andrew Case
ac8eeec52e
Fixes for black
2025-02-07 13:17:10 -06:00
Andrew Case
4c2d21d086
bump patch number
2025-02-07 13:15:31 -06:00
Andrew Case
9c5b016932
Move all initial access into try/except block
2025-02-07 13:14:11 -06:00
Andrew Case
968241aedd
Address feedback
2025-02-07 13:14:11 -06:00
Andrew Case
d372f04eff
Add proper exception handling in file descriptor enumeration
2025-02-07 13:14:11 -06:00
Andrew Case
6100d7756f
Add function typing
2025-02-07 13:05:41 -06:00
ikelos and GitHub
bf03ecda2c
Merge pull request #1564 from Abyss-W4tcher/linux_tracing_ftrace
...
New Linux plugin: linux.tracing.ftrace
2025-02-05 21:49:15 +00:00
Abyss Watcher
f5e8ed2457
use a list comprehension for flags parsing
2025-02-05 21:42:13 +01:00
ikelos and GitHub
eadd6d229e
Merge pull request #1572 from hsarkey/hsarkey/wow64-dlllist
...
Windows: Allow windows.dlllist to report back DLLs from wow64 processes
2025-02-05 20:23:50 +00:00
hsarkey
29567a777b
Updates to address the dlllist wow64 upgrades
2025-02-05 15:10:36 -05:00
Abyss Watcher
637ff68035
make ftrace flags parsing more readable
2025-02-05 19:19:26 +01:00
Abyss Watcher
c01f3c5556
non inclusive upper bound address check
2025-02-05 19:17:25 +01:00
ikelos and GitHub
a4987b39d9
Merge pull request #1598 from volatilityfoundation/issue_1573_handle_iteration_traceback
...
Windows: Handles - catch exception in handle iteration
2025-02-03 22:42:27 +00:00
ikelos and GitHub
b3760ce7e5
Merge pull request #1599 from gcmoreira/linux_kallsyms
...
Linux - Introduce the Linux kallsyms API and related plugins
2025-02-02 23:32:01 +00:00
Gustavo Moreira
cef87e014c
linux: kernel_symbol object extension: move properties to getters
2025-02-03 07:59:57 +11:00
Gustavo Moreira
348720c89a
linux: module extension object: add docstring to get_symbol_type()
2025-02-03 07:55:11 +11:00
Gustavo Moreira
e222b069ef
linux: module extension object: add typing info to _get_sect_count()
2025-02-03 07:50:21 +11:00
Gustavo Moreira
13b8526206
linux: kallsyms API: reuse module_name variable
2025-02-03 07:40:17 +11:00
Andrew Case