Dave Lassalle
fcaba2d95a
issue #1017 - black updates
2023-10-18 14:08:50 -05:00
616c696365
7323bd3a59
windows.pslist process name added to dumped file by default
2023-10-18 19:16:10 +01:00
Mike Auty and 616c696365
5d43071f57
Core: Add (optional) sanitization to the FileHandler class
2023-10-18 19:16:10 +01:00
616c696365 and GitHub
f2f412d555
Merge branch 'volatilityfoundation:develop' into fix-issue-895
2023-10-18 18:44:24 +01:00
Eve and GitHub
604218816d
Merge branch 'volatilityfoundation:develop' into linux_elf_padded_magic_read
2023-10-18 08:59:01 +01:00
Mike Auty
14fa5ad771
Documentation: Add in a CITATION.cff file
...
Initial addition of a CITATION file, no version information was included
because keeping it up to date with the version in the repo automatically
would be tricky and not doing so would lead it to becoming out of sync.
Fixes #1013 .
2023-10-17 16:27:29 +01:00
Mike Auty
63ace60995
Core: Add (optional) sanitization to the FileHandler class
2023-10-17 15:54:10 +01:00
ikelos and GitHub
57924c5da1
Merge pull request #1001 from xabrouck/oldkernel
...
Making cred optional as it didn't exist in old 2.6 kernels
2023-10-17 15:34:10 +01:00
ikelos and GitHub
15ad1db01b
Merge pull request #1016 from eve-mem/vmem_warnings
...
vmware: Add warning when no metadata file is found for a vmem file.
2023-10-17 15:02:11 +01:00
Eve
e45380f4f5
Update vmware layer metadata file warning to be less doom and gloom.
2023-10-13 09:29:46 +01:00
Dave Lassalle
95c468c4f8
issue #1019 - for subkeys, return the modified time of the subkey itself, not its parent key
2023-10-12 10:16:56 -05:00
Dave Lassalle
9cc73b6a03
issue #1017 - check for valid root node type
2023-10-12 09:57:24 -05:00
Eve
310b6508db
vmware: Add warning when no metadata file is found for a vmem file.
2023-10-11 09:09:15 +01:00
Eve and GitHub
faa8b2eaa9
Merge branch 'volatilityfoundation:develop' into vmayarascan
2023-10-09 17:16:56 +01:00
Mike Auty
93b2972832
Renderers: Allow nodes to be turned into dictionaries
2023-10-08 22:19:17 +01:00
Abyss Watcher
6e5d41c38b
manually instantiate queue_entry for tasks symbol
2023-10-08 03:37:17 +02:00
Abyss Watcher
57d995a81d
manually instantiate queue_entry for tasks symbol
2023-10-08 03:15:23 +02:00
RuBublik
62466c7953
fixed merge conflicts with 'volatilityfoundation:develop' branch - bumped VERSION_PATCH
2023-10-03 21:37:41 +03:00
Eve and GitHub
40d993b1a0
Merge branch 'volatilityfoundation:develop' into layer_debug_info
2023-10-03 07:43:13 +01:00
Eve
41a02fbf5b
Linux: use try/except in linux elf extension to catch paged and invalid addresses rather than crashing
2023-10-03 07:13:28 +01:00
Eve
a46c9d9d8e
Linux: add padded read when getting magic for elf extension to help with smear and missing pages
2023-09-29 10:16:20 +01:00
ikelos and GitHub
87cdf87100
Merge pull request #1004 from ShutdownRepo/test-workflow
...
Adding test install workflow for GitHub Actions pipelines
2023-09-28 17:17:48 +01:00
ikelos and GitHub
cb6d6e3a8e
Merge pull request #1008 from volatilityfoundation/release/v2.5.0
...
Release/v2.5.0
2023-09-27 20:45:48 +01:00
Mike Auty
56cb5ea93b
Revert "Linux: Rename linux.envars to linux.envvars"
...
This reverts commit d9a365d96f
2023-09-27 20:37:51 +01:00
Mike Auty
43bef641dc
Revert "Linux: Fix slight issue in envvars renaming"
...
This reverts commit 60292c2da1
2023-09-27 20:37:38 +01:00
Shutdown
370b6774ea
Remove macOS from matrix hosts
2023-09-17 23:21:56 +02:00
Mike Auty
47ddf5d0e5
Core: Bump the version after 2.5.0 release branch
2023-09-06 20:34:13 +01:00
ikelos and GitHub
b5b9c8ac41
Merge pull request #1003 from volatilityfoundation/issues/issue1002
...
Core: Fix missing packages in setup.py
2023-09-06 00:54:04 +01:00
ikelos and GitHub
5e8dfc0af2
Merge branch 'develop' into issues/issue1002
2023-09-06 00:50:32 +01:00
Mike Auty
803c56e3c4
Core: include the volatility3 package and all volatility3 subpackages
2023-09-05 23:51:17 +01:00
Mike Auty
9d2fd40517
Revert "Core: Include only volatility3 in distributions packages"
...
This reverts commit b4c6b661f0
2023-09-05 23:07:57 +01:00
Shutdown
ef341d54d6
Fixing fail-fast strategy
2023-09-05 22:37:45 +02:00
Shutdown
9982a44131
Adding matrix strategy for hosts and python version
2023-09-05 22:36:40 +02:00
Shutdown
2a67aa639a
Removing Python version
2023-09-05 22:29:25 +02:00
Shutdown
627e2fbab9
Adding install.yml workflow
2023-09-05 22:27:53 +02:00
Mike Auty
05df365936
Core: Fix missing packages in setup.py
...
Fixes #1002 .
2023-09-05 18:23:54 +01:00
xabrouck
455487dbb6
Making cred optional as it didn't exist in old 2.6 kernels
2023-09-05 16:20:46 +02:00
Eve
52207e0933
Add extra debug information for layer stacker to show file size of the physical file
2023-09-04 17:44:24 +01:00
Mike Auty
da203f7d68
Documentation: Improve library documentation
...
Fixes #993 .
2023-09-03 22:07:20 +01:00
ikelos and GitHub
3ff4f015c4
Merge pull request #899 from cstation/feature/linux_elf_dump
...
Dump ELFs to file
2023-09-03 21:59:36 +01:00
ikelos and GitHub
c8a85e11b2
Merge pull request #995 from xabrouck/dirty
...
Check IoC of dirty bit in PTEs from executable VMAs.
2023-09-03 21:56:25 +01:00
ikelos and GitHub
c72129203b
Merge pull request #996 from eve-mem/Linux-Change-get_process_memory_sections-to-use-get_vma_iter
...
Linux: fix bug where get_process_memory_sections fails with 6.1+ kernels
2023-09-03 21:41:43 +01:00
Mike Auty
b4c6b661f0
Core: Include only volatility3 in distributions packages
...
Fixes #951
2023-09-03 21:13:37 +01:00
616c696365
5c80a66d6d
Windows: Update pslist.py, add friendly option
2023-08-30 20:12:12 +01:00
Gustavo Moreira
9b5c4b0415
fix comment typo
2023-08-22 15:59:45 +10:00
gcmoreira and GitHub
7dc74f14b6
Merge branch 'volatilityfoundation:develop' into issue_985
2023-08-22 15:51:42 +10:00
xabrouck
6f7f1284ad
Fix bug with PAGE_SHIFT that wasn't shifted, also greatly increases performance
...
Use black
Better logging
2023-08-18 11:37:04 +02:00
Eve and GitHub
804d68d94d
Linux: fix bug where get_process_memory_sections fails with 6.1+ kernels
2023-08-17 13:38:23 +01:00
Mike Auty
581c493f4f
Add in action to make old tickets stale.
2023-08-16 21:35:11 +01:00
xabrouck
7c82da4f50
check IoC of dirty bit in PTEs from executable VMAs.
...
this can for example detect code injected using ptrace().
this can also detect injected code that was reset to the original code (malware uninstalled before memory dump happened).
2023-08-14 11:53:14 +02:00
Dave Lassalle