doomedraven and ikelos
97f670ec79
simplify vad dump to be used by other plugins
2019-11-13 18:54:19 +00:00
Mike Auty
648cded5e1
Objects: Fix incorrect Bitfield maths
...
Turns out that #133 exposed a mistake in how we were using the end_bit
field (and it should have been picked up in review, my bad).
Essentially we were masking based on the length of the end_bit after
*already* shifting by the start_bit. We should mask then shift, not the
other way around.
May well fix issue #135 (pdb generation will have been affected by
this).
2019-11-13 16:48:14 +00:00
Mike Auty
d0a5d4ba3f
layers: Ensure the new registry check doesn't throw an exception.
2019-11-12 09:09:51 +00:00
Mike Auty
face38436e
layers: Fix up uses of is_valid.
2019-11-12 09:09:51 +00:00
xabiugarte and ikelos
5b04492463
Fix on 'end_bit' computation
2019-11-11 17:03:04 +00:00
Mike Auty
989f08eff2
Revert "EPROCESS: Fix is_valid check missing cast."
...
This reverts commit 60eda0a52b#110 , only done worse.
2019-11-09 16:06:30 +00:00
Mike Auty
60eda0a52b
EPROCESS: Fix is_valid check missing cast.
2019-11-09 15:56:19 +00:00
Mike Auty
23b14b772a
Poolscanner: Fix error in index checking.
2019-11-09 00:17:07 +00:00
Mike Auty
373442ac24
pdbscan: Fix up permission error creating directories
2019-11-04 10:57:30 +00:00
Mike Auty
ee31ece006
Fix a logging on add_process_layer exceptions.
...
There were a number of issues with commit 3df5e995
2019-11-03 23:15:38 +00:00
Mike Auty
73aa73f30e
Ensure we test None using is rather than ==.
2019-11-03 22:46:20 +00:00
Mike Auty
9d453ff916
Elf64: Ensure volatility objects aren't stored as part of the layer.
2019-11-03 20:37:12 +00:00
Mike Auty
bb04c3b882
Improvements to logging and support for virtualbox.
2019-11-03 20:37:12 +00:00
Mike Auty
6f73310d88
Add in initial Elf64 support.
2019-11-03 20:37:12 +00:00
Mike Auty
dd3e09f1e2
frameworkinfo: Make this a core plugin, not an optional extra.
2019-10-31 22:14:43 +00:00
Mike Auty
4457bcaee0
vadyarascan: Ensure we scan the right layer
...
This patch ensures we scan the vad segments within the correct layer
(the process layer, not the kernel layer) and lists the pid in the
output.
2019-10-31 19:15:02 +00:00
xabiugarte and ikelos
bdee51fef0
Check progress_callback is not None before call
...
Followed the same approach as in
volatility/framework/symbols/windows/pdbconv.py
2019-10-23 09:56:55 +01:00
Mike Auty
ce2b83fc34
Add in support for sizing LF_ARGLISTs. Fixes issue #99 .
2019-10-23 00:09:45 +01:00
Mike Auty
27a291cf61
Remove the erronious print statement, which should be a vollog message if needed.
2019-10-18 08:39:56 -04:00
Mike Auty
0be9061989
Tidy up commit e0097ac.
2019-10-18 08:38:17 -04:00
atcuno
545376d725
Mac - update trustedbsd
2019-10-17 15:30:13 -04:00
atcuno
3df5e9957e
Windows - add missing add_process_layer exception handling in a few plugins
2019-10-17 11:47:19 -04:00
atcuno
e0097ac9c1
Windows - protect handles from smear
2019-10-17 11:03:48 -04:00
atcuno
2cad54ea6b
Windows - prevent LIST_ENTRY enumeration code from returning objects on invalid/not mapped pages
2019-10-17 10:27:14 -04:00
atcuno
2e329d1106
Windows - add exception handling around is_valid in callbacks
2019-10-17 10:22:06 -04:00
Mike Auty
97e41e21e4
Volatility 3 1.0.0-beta.1 release
2019-10-13 11:28:09 +01:00
Mike Auty
48f2c78a7d
Update versioning to support appropriate version checks.
2019-10-13 11:12:28 +01:00
Mike Auty
2229c50de8
Remove executable bit from data files.
2019-10-13 10:09:10 +01:00
Mike Auty
9b0a910d7e
Update typing and documentation on renderers.
2019-10-07 10:35:17 +01:00
Mike Auty
71e082f25f
Ensure the layers are loaded on layer stacker run, not just when a layer is stacked.
2019-10-07 01:52:58 +01:00
Mike Auty
d3f1a396da
Handle JSON errors when caching banners.
2019-10-04 22:50:25 +01:00
Mike Auty
3784c9aff6
Fix up missing/inaccurate plugin description strings.
2019-10-03 01:05:57 +01:00
Mike Auty
3b656e337a
Update windows extensions to ensure they're documented.
2019-10-02 20:25:54 +01:00
Mike Auty
10a379b0ee
Make 'import as' consistent and ensure proper plugin dependencies.
2019-10-02 01:25:03 +01:00
Mike Auty
9a17beb77f
Ensure consistency of importing interfaces.
2019-10-02 01:18:46 +01:00
Mike Auty
8e10f4e3d1
Clarify handles error message.
2019-10-02 00:06:25 +01:00
Mike Auty
9ac622afa0
Fix up import style to be consistent.
2019-10-01 23:46:02 +01:00
Mike Auty
ba14e10d00
pdbconv: Ensure voids do not have a size
...
This partially reverts e17427b9a0
2019-09-29 15:36:26 +01:00
Andrew Case and ikelos
a4a918ea58
Suggested changes from ikelos
2019-09-27 20:50:21 +01:00
Andrew Case and ikelos
bf29e23e1c
add updated mac ifconfig support
2019-09-27 20:50:21 +01:00
Mike Auty
c00b820f74
Fix up recent Mac PagedInvalidAddress additions.
2019-09-27 11:21:49 +01:00
Mike Auty
81be3c0d66
Make InvalidAddressException a LayerException as it should be.
2019-09-27 11:19:53 +01:00
Mike Auty
153b3b7d39
Make sure we catch the most general exception for what we mean.
2019-09-27 11:19:53 +01:00
Andrew Case
2a98227306
Mac - have pstree inherit from tasks
2019-09-26 23:11:26 -05:00
Andrew Case
b1d07396a0
Mac - have psaux inherit from tasks
2019-09-26 23:08:33 -05:00
Andrew Case
49c4ae2aa4
Mac - have bash inherit from tasks
2019-09-26 23:05:49 -05:00
Andrew Case
a6e7c7a919
Mac - have malfind inherit from tasks
2019-09-26 23:01:37 -05:00
Andrew Case
7339c12eaa
Mac - have proc maps inherit from tasks
2019-09-26 22:52:45 -05:00
Andrew Case
eeb04655e6
Mac - smear protection in network address enumeration
2019-09-26 22:08:47 -05:00
Andrew Case
3af593c16a
Mac - switch netstat to inherit from tasks
2019-09-26 22:07:41 -05:00
