WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-05 17:27:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
1,990 Commits 80 Branches 17 Tags
97f670ec79ed7c143e6f976a360ea88583ccaf9e
Commit Graph
1990 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
doomedravenandikelos 97f670ec79 simplify vad dump to be used by other plugins 2019-11-13 18:54:19 +00:00
Mike Auty 648cded5e1 Objects: Fix incorrect Bitfield maths 
Turns out that #133 exposed a mistake in how we were using the end_bit
field (and it should have been picked up in review, my bad).
Essentially we were masking based on the length of the end_bit after
*already* shifting by the start_bit.  We should mask then shift, not the
other way around.

May well fix issue #135 (pdb generation will have been affected by
this).
 2019-11-13 16:48:14 +00:00
Mike Auty d0a5d4ba3f layers: Ensure the new registry check doesn't throw an exception. 2019-11-12 09:09:51 +00:00
Mike Auty face38436e layers: Fix up uses of is_valid. 2019-11-12 09:09:51 +00:00
xabiugarteandikelos 5b04492463 Fix on 'end_bit' computation 2019-11-11 17:03:04 +00:00
Mike Auty 989f08eff2 Revert "EPROCESS: Fix is_valid check missing cast." 
This reverts commit 60eda0a52b.

Turns out, this is pull request #110, only done worse.
 2019-11-09 16:06:30 +00:00
Mike Auty 60eda0a52b EPROCESS: Fix is_valid check missing cast. 2019-11-09 15:56:19 +00:00
Mike Auty 23b14b772a Poolscanner: Fix error in index checking. 2019-11-09 00:17:07 +00:00
Mike Auty 082b556f43 CLI: Ensure the QuickRenderer flushes after each line. 2019-11-05 23:15:45 +00:00
Daniel Milnesandikelos 2532bb59e3 Revert copyright symbol change 2019-11-04 20:16:04 +00:00
Daniel Milnesandikelos 5ba9c9d83d GitHub Markdown is weird 2019-11-04 20:16:04 +00:00
Daniel Milnesandikelos fd64b14690 Add missing word 2019-11-04 20:16:04 +00:00
Daniel Milnesandikelos 2435355094 Markdown all the things 2019-11-04 20:16:04 +00:00
Mike Auty 9e042ad1ce Ensure we use configured paths at import. 
Previously if submodules were imported after the plugin/symbol __path__s had
been set, it would only use the __path__s from the constants module.

We now use the parent module's __path__s to ensure we get the right
sub__path__s.

This seems better/more flexible than changing the original constants
(since they'd no longer be constant) and allows people more chance to
override things.  It brings with it potential confusion as a local
plugin directory will need __init__ files with this magic to allow the
core modules to run (since they come first in the path list).
 2019-11-04 19:42:24 +00:00
Mike Auty 373442ac24 pdbscan: Fix up permission error creating directories 2019-11-04 10:57:30 +00:00
Mike Auty ee31ece006 Fix a logging on add_process_layer exceptions. 
There were a number of issues with commit 3df5e995 that was applied in
haste (notably, that exceptions wasn't imported in several cases, which
would break the code if it were ever run).

We now give debugging output when a process can't be constructed and
provide as much available information as possible.

Two unused lines were also removed from verinfo.
 2019-11-03 23:15:38 +00:00
Mike Auty 73aa73f30e Ensure we test None using is rather than ==. 2019-11-03 22:46:20 +00:00
Mike Auty 9d453ff916 Elf64: Ensure volatility objects aren't stored as part of the layer. 2019-11-03 20:37:12 +00:00
Mike Auty bb04c3b882 Improvements to logging and support for virtualbox. 2019-11-03 20:37:12 +00:00
Mike Auty 6f73310d88 Add in initial Elf64 support. 2019-11-03 20:37:12 +00:00
Mike Auty 83f5771a44 setup.py: Fix a typo that included development files. 2019-11-02 12:51:52 +00:00
Mike Auty bf1a57ffb5 MANIFEST: Improve the manifest file for different distutil versions 2019-11-01 11:39:54 +00:00
Mike Auty acc74af06f pdbparse-to-json: Fix missing HRESULT type. 2019-10-31 23:04:37 +00:00
Mike Auty dd3e09f1e2 frameworkinfo: Make this a core plugin, not an optional extra. 2019-10-31 22:14:43 +00:00
Mike Auty 24e6d7c658 Ensure the documentation doesn't get stale. 2019-10-31 22:14:43 +00:00
Mike Auty 8a5196bc60 Add in framework information plugin to list vol components. 2019-10-31 22:14:43 +00:00
Mike Auty 4457bcaee0 vadyarascan: Ensure we scan the right layer 
This patch ensures we scan the vad segments within the correct layer
(the process layer, not the kernel layer) and lists the pid in the
output.
 2019-10-31 19:15:02 +00:00
Mike Auty 41f25656d0 CLI: Add a little spacing to tree quick renderer. 2019-10-28 10:46:40 +00:00
Mike Auty 337d2ee016 CLI: Move progress output to stderr from stdout. 
Fixes issue #104.
 2019-10-27 16:12:12 +00:00
Mike Auty 2603c29ff7 Statistics: Record unexpected page errors. Fixes issue #102. 2019-10-24 20:59:12 +01:00
Yohannandikelos c88da2a16a Update some style in the README 2019-10-23 09:59:22 +01:00
Yohannandikelos d220c7cdec Delete old README file 2019-10-23 09:59:22 +01:00
Yohannandikelos 5a4ddad043 Update README from txt to markdown so the preview looks better on github 2019-10-23 09:59:22 +01:00
xabiugarteandikelos bdee51fef0 Check progress_callback is not None before call 
Followed the same approach as in
    volatility/framework/symbols/windows/pdbconv.py
 2019-10-23 09:56:55 +01:00
Mike Auty ce2b83fc34 Add in support for sizing LF_ARGLISTs. Fixes issue #99. 2019-10-23 00:09:45 +01:00
Mike Auty 27a291cf61 Remove the erronious print statement, which should be a vollog message if needed. 2019-10-18 08:39:56 -04:00
Mike Auty 0be9061989 Tidy up commit e0097ac. 2019-10-18 08:38:17 -04:00
atcuno 545376d725 Mac - update trustedbsd 2019-10-17 15:30:13 -04:00
atcuno 3df5e9957e Windows - add missing add_process_layer exception handling in a few plugins 2019-10-17 11:47:19 -04:00
atcuno e0097ac9c1 Windows - protect handles from smear 2019-10-17 11:03:48 -04:00
atcuno 2cad54ea6b Windows - prevent LIST_ENTRY enumeration code from returning objects on invalid/not mapped pages 2019-10-17 10:27:14 -04:00
atcuno 2e329d1106 Windows - add exception handling around is_valid in callbacks 2019-10-17 10:22:06 -04:00
Mike Auty 191daf156d Update the README to include some base symbol table packs. 2019-10-16 23:27:01 -04:00
Mike Auty 9af7fbb48d Update the slack URL. 2019-10-14 22:10:43 +01:00
Nick L. Petroni, Jrandikelos cf08fef6ad enable readthedocs support 2019-10-14 22:07:28 +01:00
Mike Auty 97e41e21e4 Volatility 3 1.0.0-beta.1 release v1.0.0-beta.1 2019-10-13 11:28:09 +01:00
Mike Auty d7b1855099 Ensure the documentation versioning is consistent too. 2019-10-13 11:20:53 +01:00
Mike Auty 48f2c78a7d Update versioning to support appropriate version checks. 2019-10-13 11:12:28 +01:00
Mike Auty 2229c50de8 Remove executable bit from data files. 2019-10-13 10:09:10 +01:00
Mike Auty 34ec787fa0 Add in the documentation URL. 2019-10-13 01:59:57 +01:00