WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 12:47:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,667 Commits 80 Branches 17 Tags
a00a59cd235cb18b7dc28ccf2669e2a82368fab5
Commit Graph
4667 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mike Auty 373bf9dfaa Windows: Fix driverirp black issue 2024-03-04 18:33:03 +00:00
ikelosandGitHub fbcaeccf7d Merge pull request #857 from volatilityfoundation/driverirp_hidden_module_support 
Report IRP entries that point inside a hidden module. This is a commo…
 2024-03-04 14:58:45 +00:00
ikelosandGitHub d4b92db446 Merge pull request #960 from RuBublik/poolscanner-thread-support 
Add threads pool tag scanning
 2024-03-04 14:58:04 +00:00
ikelosandGitHub 110d9bef4a Merge pull request #1101 from gcmoreira/linux_library_list_plugin 
Linux: Add linux.library_list.LibraryList plugin
 2024-03-04 12:33:13 +00:00
Gustavo Moreira cb6f8c5072 Rename methods to be private 2024-03-04 20:47:49 +11:00
ikelosandGitHub 0fac32465f Merge branch 'develop' into poolscanner-thread-support 2024-03-03 23:48:24 +00:00
ikelosandGitHub cd81dfc8a5 Merge pull request #1106 from volatilityfoundation/feature/python3.12 
Documentation: Fix up syntax errors involving * character
 2024-03-03 23:21:48 +00:00
Abyss Watcher 2f0bb6b297 do not strip each line 2024-03-02 18:39:48 +01:00
Abyss Watcher 8d79e3211b prefer TypeError to vollog.error 2024-03-02 17:30:51 +01:00
Abyss Watcher caf108b604 macOS dmesg plugin support 2024-03-02 17:17:48 +01:00
Abyss Watcher 2e835099b5 fix wrong list_head comparison + better naming 2024-03-01 20:19:31 +01:00
Abyss Watcher 965ddcb674 make queue_head_t optional, as it might not exist in all ISF 2024-03-01 19:30:46 +01:00
Abyss Watcher 3040bc5fc2 add --dump mechanism, similarly to linux.proc 2024-03-01 14:20:13 +01:00
Abyss Watcher d56ccbfd0b allow specifying integers as 0x in ListRequirement 2024-03-01 14:18:30 +01:00
hsarkey 850b377dcf Updated windows.dlllist plugin to have --name and --base flags for filtering on dll name and base address. 2024-02-29 16:13:27 -05:00
Abyss Watcher a8e1082827 restore pslist, add queue_head_t type class 2024-02-29 14:36:46 +01:00
Gustavo Moreira b681438ddc Remove unnecessary 'pass' statement. 2024-02-29 16:21:34 +11:00
Gustavo Moreira 3c9af096e1 Add missing PAGE_SHIFT replacement 2024-02-29 16:17:47 +11:00
Gustavo Moreira 9b0915dc85 Add logging for unknown ELF types 2024-02-29 15:36:46 +11:00
Gustavo Moreira e6bc0c4100 Update author and modification time 2024-02-29 15:34:48 +11:00
Gustavo Moreira d5a0543a2d Use the ELF class constant instead of hardcoding a value. Fixed some f-strings 2024-02-29 15:34:20 +11:00
Gustavo Moreira 338106dfe8 Move the memory page parameters to the Intel layer 2024-02-29 14:46:35 +11:00
Mike Auty 0899ba8d7f Documentation: Fix up syntax errors involving * character 2024-02-28 23:09:46 +00:00
ikelosandGitHub 887747e3ce Merge pull request #1098 from volatilityfoundation/feature/output-filter 
Implement CLI support for filtering out rows during output
 2024-02-22 11:00:14 +00:00
ikelosandGitHub 90de493f78 Merge pull request #1100 from adiego8/windows-psscan-offset 
Windows: Add filtering by offset to psscan
 2024-02-22 10:59:47 +00:00
ikelosandGitHub 0cfc466924 Merge pull request #1093 from eve-mem/linux_issue_1089_module_memory 
Linux: fix issue 1089 module memory
 2024-02-22 10:56:36 +00:00
ikelosandGitHub 499f70d339 Merge pull request #1103 from eve-mem/linux_psscan_memory_layer_name_optimisation 
Linux: psscan tiny update so that  memory_layer_name is reused
 2024-02-22 10:26:23 +00:00
Eve a82b93523d Linux: psscan tiny update so that memory_layer_name is reused 2024-02-22 09:47:23 +00:00
Eve 77675d584d Update patch version 2024-02-21 14:26:48 +00:00
Eve 3b5fde9420 Linux: update module extension logic for choosing the correct values for different kernel versions 2024-02-21 12:58:24 +00:00
Eve e10cff979a Linux: update module extension with memoization for _mod_mem_type 2024-02-21 12:50:05 +00:00
EveandGitHub abbfa7d295 Merge branch 'volatilityfoundation:develop' into linux_issue_1089_module_memory 2024-02-21 11:51:54 +00:00
Alejandro Diego 42c6a9ede6 Remove unnecessary import and correctly filter_func var 2024-02-20 20:19:02 -05:00
ikelosandGitHub 1ccbf33c04 Merge pull request #1096 from eve-mem/linux_update_mm_extension 
Linux update mm extension
 2024-02-20 21:01:23 +00:00
Alejandro Diego 5e38ffa811 Added support for virtual address filtering and validation of ph/v space 2024-02-20 15:07:15 -05:00
Eve a597ee1776 Linux: update minor version number due to API changes with linux extension for mm_struct 2024-02-20 06:48:16 +00:00
Eve 437a91375d Linux: add TODO for mm_struct for methods that should be removed when moving to version 3.0.0 2024-02-20 06:39:42 +00:00
Alejandro Diego cd08cb95fd Windows: Add filtering by offset to psscan 
Add capability to the psscan plugin to filter by specific offset.
The filter would be used by other plugins to find specific offset using the psscan capabilities, like find
hidden processes as a result of some dkom for example.
The `--offset`  flag argument should represent a physical address space.

The flag is included in the following plugins:
  - dlllist
  - handles
 2024-02-19 13:35:31 -05:00
ikelosandGitHub 3703e119ce Merge pull request #1084 from volatilityfoundation/feature/table-check 
Symbols: Add support for metadata verification of symbol tables
 2024-02-18 22:19:14 +00:00
Gustavo Moreira cf81ceda82 Fix CodeQL suggestion 2024-02-13 20:20:25 +11:00
Gustavo Moreira 6e7b5b5941 Linux: Add linux_library_list test case 2024-02-13 19:41:30 +11:00
Gustavo Moreira cc35fecf91 Linux: Add library_list plugin and other ELF related code enhacements. 
- Add library_list plugin
- Add ELF dynamic table enum types in elf.json
- Update missing program header enum types in elf.json
- Add PAGE constants
- Add ELF ident and class enums
- Replace ELF hardcoded type numbers for enum description matching
- Fix unmanaged ValueError exception issue in Elf64Layer::_load_segments()
 2024-02-13 19:40:37 +11:00
Eve 53d4ec66eb Linux: Remove unnecessary import from linux extension. 2024-02-12 09:36:33 +00:00
Eve 0e75140ec5 Linux: update module extension with mod_mem_type property and add try/except for get methods 2024-02-12 09:35:06 +00:00
Eve 683319bd7f Linux: add deprecation warning for get_maple_tree_iter and get_mmap_iter mm_struct extensions. 2024-02-12 08:47:02 +00:00
Mike Auty 865f004f5c CLI: Ensure no filters still returns results 2024-02-09 00:00:21 +00:00
Mike Auty d8d3e157af CLI: Don't forget the core text filter class 2024-02-08 23:46:30 +00:00
Mike Auty 63a325c515 CLI: Add support for filtering lines from output 2024-02-08 23:44:12 +00:00
ikelosandGitHub 6d34e43667 Merge pull request #754 from volatilityfoundation/feature/cli-config-hierarchy 
CLI: Add support for a configuration options file
 2024-02-08 12:05:24 +00:00
Mike Auty 7b42ef0a9f Documentation: Add in more information about overriding configuration values 2024-02-08 11:59:50 +00:00