WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 12:47:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,667 Commits 80 Branches 17 Tags
a00a59cd235cb18b7dc28ccf2669e2a82368fab5
Commit Graph
4667 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Gustavo Moreira f0bd978716 Fix typo 2023-05-20 12:17:09 +02:00
RuBublik 7469872c8b added 'PoolConstraint' of Thread objects to 'PoolScanner.default_constraints' as part of adding support for thread pool tag scanning 2023-05-17 21:41:37 +03:00
Gustavo Moreira 4f5ca6116c Add black recommendations 2023-05-17 16:07:56 +01:00
Gustavo Moreira d5d318d3cf Fix wrong constants module 2023-05-17 15:26:24 +01:00
Gustavo Moreira 3d9efc3b34 Added linux capabilities plugin 2023-05-17 14:14:33 +01:00
Eve cd03c52fd3 Linux: Update linux.vmayarascan to use task.mm.get_vma_iter() which means it will work on linux kernels 6.1 and above 2023-05-12 13:37:15 +01:00
Eve 09b0c8e406 Linux: Update linux.vmayarascan and yarascan so that command line options are taken from the base yarascan plugin 2023-05-12 13:30:32 +01:00
Eve 860c947e17 Merge branch 'vmayarascan' of github.com:eve-mem/volatility3 into vmayarascan 2023-05-12 11:10:02 +01:00
EveandGitHub d0d30dc87f Merge branch 'volatilityfoundation:develop' into vmayarascan 2023-05-12 11:09:51 +01:00
Eve 8624e01644 Merge branch 'vmayarascan' of github.com:eve-mem/volatility3 into vmayarascan 2023-05-12 11:08:41 +01:00
Eve b54bbfb88f Update linux.vmayarascan to pull requirements from the generic yarascan plugin 2023-05-12 11:08:32 +01:00
Eve 57e8234e6c remove unused variable in linux.vmayarascan 2023-05-12 11:08:32 +01:00
Eve 2279a83e3b liniting for linux.vmayarascan 2023-05-12 11:08:32 +01:00
Eve 1a7ec07c28 add linux.vmayarascan based on windows.vadtarascan 2023-05-12 11:08:32 +01:00
Mike Auty 8e56cb39d1 Docs: Fix the documentation dependencies 2023-05-10 22:07:38 +01:00
Mike Auty 3f1797f7e5 Core: Change readthedocs build platform 
Fixes #953
 2023-05-10 21:57:59 +01:00
Mike Auty e28b42731e Core: Change readthedocs python version 
Attempting to fix #953
 2023-05-10 21:55:23 +01:00
ikelosandGitHub 2149231bb7 Merge pull request #949 from cpuu/mac-tutorial 
Add tutorial for macOS Analysis
 2023-05-10 11:11:21 +01:00
ikelosandGitHub 534f9be127 Merge pull request #928 from eve-mem/linux_maple_tree 
Add basic support for Linux maple tree struct
 2023-05-10 11:06:44 +01:00
ikelosandGitHub e4db77d20a Merge pull request #942 from gcmoreira/mountinfo_fixes 
Mountinfo fixes
 2023-05-10 11:03:32 +01:00
Gustavo Moreira 7516346b64 Adjust framework versioning 2023-05-10 10:55:19 +02:00
Eve b3c348820f Linux: apply black v23.3.0 formating to volatility3/framework/symbols/linux/__init__.py 2023-05-10 09:18:05 +01:00
Eve 834372a6f8 Linux: apply black v23.3.0 formating to volatility3/framework/symbols/linux/extensions/__init__.py 2023-05-10 09:12:03 +01:00
Eve 7f9afccf6f Linux: apply black formating to maple tree parsing 2023-05-10 08:49:46 +01:00
cpuu 396daa528c Apply Black Python linter to mac.pslist plugin 
Applied the Black Python linter to the mac PsList plugin, resulting in more readable and consistent code formatting.
 2023-05-10 10:07:09 +09:00
cpuu 186b1ed1c2 Add more process information to mac.pslist plugin 
Enhance the PsList plugin by including additional process information such as offset, UID, GID, and start time in the output. Update the TreeGrid columns to display the new information.
 2023-05-10 09:49:11 +09:00
Gustavo Moreira 89ed65cc56 Improve filter warning implementation 2023-05-09 09:59:21 +02:00
Gustavo Moreira 6c5db21ae7 Undo mnt_ns_id cast to str 2023-05-09 09:22:02 +02:00
Gustavo Moreira d367b973a5 Renamed get_vmlinux_from_volobj() to get_module_from_volobj_type() 2023-05-09 09:05:37 +02:00
Eve a2906ad270 Linux: Update comments and var names for maple tree depth warnings 2023-05-09 07:07:39 +01:00
Eve 8594824459 Linux: Ensure that objects made when parsing maple tree use the native_layer_name 2023-05-09 06:47:07 +01:00
Gustavo Moreira de28b5ab70 Rollback explicit context 2023-05-08 19:59:53 +02:00
Gustavo Moreira 7d65c20cc0 Fix f-string 2023-05-08 14:59:58 +02:00
Gustavo Moreira 200099f8b3 Improve support for socket filters in kernels < 4.1.52 2023-05-08 14:58:51 +02:00
Gustavo Moreira ced6ff346c Apply 'Black' suggestions 2023-05-08 11:54:48 +02:00
cpuuandGitHub 6b2ae6bd65 Update getting-started-mac-tutorial.rst 2023-05-08 17:44:17 +09:00
cpuuandGitHub e86ff963e2 Update getting-started-mac-tutorial.rst 2023-05-08 17:43:24 +09:00
cpuuandGitHub ea09c47328 Update getting-started-mac-tutorial.rst 2023-05-08 17:32:14 +09:00
ikelosandGitHub 778df1a550 Merge pull request #948 from paulkermann/feature/modules_name_flag 
Added modules name flag
 2023-05-08 08:47:05 +01:00
Paul Kermann c40b3a043f CR fixes 2023-05-08 05:07:19 +03:00
Gustavo Moreira a09f77897b sockstat improvements: 
+ Fixes issues with netlink sockets for older kernels, supporting now kernels < 3.7.10
+ Fixes issue with network namespace id for older kernels.
 2023-05-06 14:21:58 +02:00
Gustavo Moreira 2d922a8cd6 Improves the way the mount points and the namespaces are filtered. 
Previously, it was filtering by mount namespaces id. Even that approach was working as expected, it's not viable for older kernels were there was not a mount namespace ID. With this changes we filtered the mount points individually by the mount ID which is unique system wide, no mather the namespace to which it belongs to.
 2023-05-06 14:18:33 +02:00
Gustavo Moreira 7063e60944 mountinfo improvements: 
+ Fixes issue with repeated path suffixes.
+ Adds support for older kernels (<3.3.8) and
+ Adds a function which simplify the way the framework internally can gets a context and a vmlinux.
This is obtaining the context and symbol space from the same vol object instead of drag a context everywhere.
This changes also affects other plugins such as elfs, malfind and proc.maps.
It also adds doc strings to some of the existent functions.
 2023-05-06 14:12:09 +02:00
cpuu 093fc9ab79 Add tutorial for macOS Analysis 
Add tutorial for macOS Analysis
 2023-05-05 23:39:33 +09:00
Paul Kermann 8952c6c985 formatting 2023-05-04 15:18:37 +03:00
Paul Kermann 9249758dde formatting 2023-05-04 15:15:23 +03:00
Paul Kermann 1ad8c950da Added modules name flag 2023-05-04 13:47:57 +03:00
ikelosandGitHub 8788390424 Merge pull request #947 from cpuu/bug-fix 
Bug fix (2.4.2 / URIRequirement)
 2023-05-04 10:00:44 +01:00
cpuuandGitHub c9e0b6695f Update index.rst 2023-05-04 12:52:16 +09:00
cpuuandGitHub 14f449367d Delete getting-started-macos-tutorial.rst 2023-05-04 12:52:00 +09:00