WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-25 23:52:23 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,424 Commits 80 Branches 17 Tags
96b68b9cdc44a3f5e4ce151c16ca062f98f004e2
Commit Graph
1901 Commits
Author SHA1 Message Date
Mike Auty 96b68b9cdc Plugins: Don't ever insert an invalid value 2020-09-02 11:13:39 +01:00
memoryforensics1andikelos 37de4d45e7 fix 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 74f1492097 fix 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 2408f26f1f fix, add cross_thread_flags to ETHREAD struct 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 6be5716195 Add FILE_OBJECT and EPROCESS extestions, kthread, token struct 
add functionality to:
FILE_OBJECT:
         access_string function
EPROCESS:
         environment_variables function

new structs:
TOKEN:
         get_sids function
         privileges funciton
KTHREAD:
         get_state function
         get_wait_reason function
 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 489dd0cf77 add KTHREAD struct 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 6487eb5596 Add FILE_OBJECT and EPROCESS extestions, kthread, token struct 
add functionality to:
FILE_OBJECT:
         access_string function
EPROCESS:
         environment_variables function

new structs:
TOKEN:
         get_sids function
         privileges funciton
KTHREAD:
         get_state function
         get_wait_reason function
 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 8a3ee4f0b7 add token object 
_TOKEN struct added
 2020-09-02 10:52:53 +01:00
Mike Auty 6c3176b32c Linux: Improve lengths for name_as_str 2020-09-01 23:36:21 +01:00
Mike Auty eb02ee1b81 Configuration: Give PluginRequirements simple type values 2020-09-01 15:44:57 +01:00
Mike Auty 7ea2340d31 Automagic: Refactor valid kernels to valid kernel 2020-09-01 09:02:13 +01:00
Mike Auty 4610be52f0 Automagic: PDBscan use one codepath for kvo setting 2020-09-01 09:02:13 +01:00
Mike Auty 1fc0a9d8d5 Automagic: PDBscan condensing of methods 2020-09-01 09:02:13 +01:00
Mike Auty 88214527ab PdbUtility: Fixes from npetroni (and restore progress) 2020-09-01 09:02:13 +01:00
Mike Auty b9e0670e90 PDBUtility: Refactor this to a more central place 2020-09-01 09:02:13 +01:00
Mike Auty c61edb54fb PDBUtility: Minor fixes 2020-09-01 09:02:13 +01:00
Mike Auty 613ae30893 Automagic: Heavily refactor pdbscan 
This separates out a new PDBUtility class that can take a (contiguous) layer and MZ
offset, and produce identify, download if necessary and load the
appropriate symbol table (if any).
 2020-09-01 09:02:13 +01:00
Mike Auty 6caebee079 Plugins: Populate optional defaults in plugin initialization 
Fixes issue #324.
 2020-08-31 23:10:22 +01:00
AsafEitaniandikelos 7ab72a1066 yapf and some corrections 2020-08-31 17:05:20 +01:00
AsafEitaniandikelos 81d346438a Revert "changed config['dump'] to config.get('dump')" 
This reverts commit 0d3017f16c.
 2020-08-31 17:05:20 +01:00
AsafEitaniandikelos 5a20f7e5bf Update dlllist.py 2020-08-31 17:05:20 +01:00
AsafEitaniandikelos c29f384f55 changed config['dump'] to config.get('dump') 
The config['dump'] caused some trouble in dlllist.
 2020-08-31 17:05:20 +01:00
AsafEitaniandikelos 29e2f4485f Added dlllist and netscan to timline 2020-08-31 17:05:20 +01:00
Mike Auty 9c74f0bc88 Windows: Clear-up some extra whitespace in certain plugins 2020-08-31 13:55:48 +01:00
cesareandikelos ffbe4e0d1a added pid filter to psscan. 2020-08-31 13:52:04 +01:00
cesareandikelos 0c90fbaae6 added to psscan the pid/dump option 2020-08-31 13:52:04 +01:00
cesareandikelos c5464dce03 - version added 
- "proc_id" moved into try/except and default value added
 2020-08-31 13:52:04 +01:00
cesareandikelos 4cea3372b6 - moved the exception handling back to generator (followed the same approach used in procdump.py) 
- changed "self" to "cls"
 2020-08-31 13:52:04 +01:00
AsafEitaniandikelos fe2b2ccaeb moved vad_dump to vadinfo 2020-08-29 10:59:22 +01:00
AsafEitaniandikelos 86a7b55229 Update malfind.py 2020-08-29 10:59:22 +01:00
AsafEitaniandikelos 1c7f818c72 Update malfind.py 2020-08-29 10:59:22 +01:00
Mike Auty ebad953a74 Windows: Refactor winver to versions. 2020-08-29 10:58:16 +01:00
Mike Auty 13a3054238 Windows: Add in recently added plugins 2020-08-29 10:58:16 +01:00
Mike Auty 567cded35f Windows: Fix OsDistinguisher typo 2020-08-29 10:58:16 +01:00
Mike Auty 6e816c2f20 Windows: Convert os_distinguisher to callable class 2020-08-29 10:58:16 +01:00
Mike Auty 71366cde33 Windows: Refactor the location of os_distinguisher 2020-08-29 10:58:16 +01:00
Mike Auty 8143f75054 Plugin: Clarify the isfinfo filter parameter 2020-08-29 10:57:39 +01:00
Mike Auty 94c0307373 Plugin: Change the file parameter to isf 2020-08-29 10:57:39 +01:00
Mike Auty c2762dc6fa Plugin: Add initial version of ISFinfo plugin 2020-08-29 10:57:39 +01:00
Mike Auty 5bd0cf0e2e Windows: Fix wrote attribute in cmdline plugin 
Fixes #316.
 2020-08-28 01:43:41 +01:00
Mike Auty b41658e71f Windows: Fix issue with extensions.pe 2020-08-27 00:23:16 +01:00
Mike Auty 7b9375832f Windows: Don't forget to clear out moddump 2020-08-26 22:15:24 +01:00
Mike Auty 7afc4bfec7 Core: Fix verison typos 2020-08-26 22:04:50 +01:00
Mike Auty 8ed5767c92 Windows: Clean up memmap based on @imhlv2's suggestion 2020-08-26 20:36:52 +01:00
Mike Auty 89b466c8ac Plugins: Fixes for good spots by IMHLv2 2020-08-26 20:36:52 +01:00
Mike Auty 5bc6c4a33b Plugins: Bump versions for plugin with new features 2020-08-26 20:36:52 +01:00
Mike Auty 1459bdda39 Plugins: Change most *dump plugins to --dump 2020-08-26 20:36:52 +01:00
cesareandikelos f78820faf7 - version added 
- "proc_id" moved into try/except and default value added
 2020-08-25 12:16:38 +01:00
cesareandikelos e16953c7f9 - moved the exception handling back to generator (followed the same approach used in procdump.py) 
- changed "self" to "cls"
 2020-08-25 12:16:38 +01:00
cesareandikelos 64c0d1f43b Added method "get_cmdline" to be able to call the plugin on a single process. 
The general plugin behaviour is exactly the same, just moved the "query" part in a
single method, callable from outside
 2020-08-25 12:16:38 +01:00