Mike Auty
5d4c70d517
Documentation: Fix requirements -> get_requirements #993
2023-08-03 15:16:36 +01:00
ikelos and GitHub
b050b108e4
Merge pull request #988 from xabrouck/avml-fix2
...
fix bug in snappy lib loading and make it work on macOS.
2023-07-27 14:08:35 +01:00
xabrouck
a226b90b4d
previous commit would break linux snappy support
2023-07-27 09:37:57 +02:00
xabrouck
d872abaf30
fix bug in snappy lib loading and make it work on macOS.
2023-07-27 09:28:53 +02:00
cstation and GitHub
d53714fac8
Fix linting
2023-07-22 17:03:57 +00:00
cstation and GitHub
fca4c5db4b
Merge branch 'develop' into feature/linux_elf_dump
2023-07-22 17:00:12 +00:00
cstation
8373b5ed5a
Push ELF export limit to a constant
2023-07-22 18:56:51 +02:00
Gustavo Moreira
0a6deae6bd
This will fix #985 . It requires the changes in dwarf2json mentioned in this ticket.
2023-07-21 12:52:21 +02:00
ikelos and GitHub
6f71781405
Merge pull request #984 from gcmoreira/linux_capabilities_fixes
...
Linux capabilities fixes
2023-07-20 11:02:56 +01:00
Gustavo Moreira
90da6298e0
Added further details to the kernel_cap_struct::cap comments
2023-07-20 00:29:52 +02:00
Gustavo Moreira
9ba3d9ba4e
Several fixes:
...
* The capabilities array was to have a 64bit bitwise.
* Capabilities set has to be tested with the kernel maximum. We can't use the plugin capabilities set, otherwise we can have wrong interpretations when we tried to compress the list of capabilities to "all"
* Supports kernels >= 6.3. They changed the kernel_cap_struct::cap type again to a u64 type.
2023-07-19 22:48:06 +02:00
RuBublik
338238c639
fixed build number - resets when MINOR version goes up
2023-07-16 00:10:31 +03:00
ikelos and GitHub
373d769690
Merge pull request #978 from volatilityfoundation/feature/parameterized_object_from_symbol
...
Core: Add type parameter to object_from_symbol
2023-07-12 22:17:53 +01:00
ikelos and GitHub
89b6c090b3
Merge pull request #952 from cpuu/mac_pslist
...
Add more process information to mac.pslist plugin
2023-07-12 22:16:55 +01:00
cpuu and GitHub
f8fc5d5e58
Update pslist.py
...
list modules in code in alphabetical order
2023-07-12 14:43:38 +09:00
cpuu and GitHub
6907575d77
Merge branch 'volatilityfoundation:develop' into mac_pslist
2023-07-12 14:37:30 +09:00
ikelos and GitHub
74e8582360
Merge pull request #957 from gcmoreira/linux_capabilities
...
Linux capabilities plugin
2023-07-10 07:49:44 +01:00
Gustavo Moreira
42fe37ed52
Adjust docstring to the new retuned type.
2023-07-10 01:12:20 +02:00
Gustavo Moreira
38e9b6baa8
Removed Dict type from the imports
2023-07-10 01:08:46 +02:00
Gustavo Moreira
63c7719763
Fixed returned types. An empty string is now returned when no capability is enabled.
2023-07-10 01:01:30 +02:00
Mike Auty
239e164ce6
Windows: Fix strings plugin missing kernel pages
...
@eve-mem spotted that we were only recording the first kernel page in
any contiguous set of kernel pages, thus missing some results. This
should now be fixed.
2023-07-09 23:50:13 +01:00
Gustavo Moreira
241cf832f9
Plugin parameters removed. Instead, it now shows each capability set in their textual representation. The dictionary was replaced by a dataclass.
...
Last but not leas, CAP_FULL moved to constants.
2023-07-10 00:07:40 +02:00
RuBublik
abf1c2e03d
fixed typos
2023-07-07 20:25:02 +03:00
RuBublik
524ff59107
bumped MINOR_VERSION to 2.5.2 after changes, and updated dependent thrdscan plugin's required version to this
2023-07-07 20:22:58 +03:00
Mike Auty
6c0ce1d130
Volshell: Typo Fixes #958
2023-07-01 20:58:36 +01:00
Mike Auty
66598f5b63
Core: Second fix is the charm...
2023-07-01 19:05:22 +01:00
Mike Auty
c8e53ff16a
Core: Fix small typing issue in previous patch
2023-07-01 19:02:51 +01:00
Mike Auty
50b5d2232b
Core: Add type parameter to object_from_symbol
2023-07-01 19:00:03 +01:00
Mike Auty
1ff2d80b44
Documentation: Update basics - memory layer information
2023-07-01 17:02:10 +01:00
Mike Auty
a9698e4e73
Documentation: minor fixes/updates
2023-07-01 17:01:33 +01:00
ikelos and GitHub
5aa0a64cfa
Merge pull request #884 from eve-mem/linux_proc_dump
...
First attempt at adding a --dump option to linux.proc
2023-06-18 15:07:19 +01:00
Eve and GitHub
fa5af08c81
Merge branch 'develop' into linux_proc_dump
2023-06-18 07:34:45 +01:00
ikelos and GitHub
e17cb1532b
Merge pull request #970 from volatilityfoundation/issues/issue969
...
Windows: Fix VAD offset canonicalization
2023-06-16 19:01:21 +01:00
Mike Auty
aa04b8ca3d
Windows: Fix VAD offset canonicalization #969
2023-06-16 18:03:07 +01:00
ikelos and GitHub
2e577790d2
Merge pull request #962 from gcmoreira/fix_dentry_mem_smear_issue_961
...
Fix issue #961 : Prevent potential dentry pointer memory smear
2023-05-30 17:51:05 +01:00
RuBublik
5d32ca542c
fix black formatting
2023-05-28 20:52:26 +03:00
Mike Auty
b9e5cfb393
Core: Protect from clearing a non-existant cache
...
Issue kindly raised by @garanews, thanks! 5:D
2023-05-22 15:05:43 +01:00
RuBublik
5072728e89
formated with black
2023-05-22 15:50:22 +03:00
RuBublik
9bdd249aad
added _version to ThrdScan
2023-05-22 15:39:12 +03:00
RuBublik
c6c501ecb5
implemented generate_timeline method in ThrdScan
2023-05-22 15:31:25 +03:00
RuBublik
bef5149ba6
changed TreeGrid yielded types to specific simpletypes instead of str
2023-05-22 11:39:38 +03:00
RuBublik
950a76d1e0
fixed typo
2023-05-22 11:17:23 +03:00
Gustavo Moreira
0f42f0eaf1
fix typo
2023-05-22 01:39:14 +01:00
Gustavo Moreira
bea981180d
Prevent potential dentry pointer memory smear
2023-05-22 01:32:00 +01:00
RuBublik
5749b3ef52
added test for thrdscan plugin
2023-05-21 19:22:22 +03:00
RuBublik
fab818b48d
added thrdscan plugin to utilize added support for ethread pool tag scanning
2023-05-21 18:24:01 +03:00
RuBublik
046c8e4d1e
fix of is_valid - removed reliace on owning _eprocess and added exclusion for system process (does not have creation time)
2023-05-21 18:18:02 +03:00
RuBublik
601870829e
twicked thread constraint for edge cases
2023-05-21 18:12:46 +03:00
RuBublik
0fd475e10b
added permanent implementation for 'ETHREAD.is_valid'
2023-05-20 15:49:09 +03:00
RuBublik
550d1096eb
temporary fix to ETHREAD class, add 'is_valid' method
2023-05-20 14:20:15 +03:00
Mike Auty