Gustavo Moreira
a386a7a948
Removed underscore from unused arguments
2021-12-14 15:40:51 +11:00
Gustavo Moreira
86676cf4e8
Changing BPF_PROG_TYPE_UNSPEC constant in favor of a literal 0 and a comment.
2021-12-14 15:37:55 +11:00
Gustavo Moreira
6970776c4c
Renaming function to use single underscore and name from extra to extended
2021-12-14 15:37:48 +11:00
Gustavo Moreira
2e93db9b57
Adding versioning to SockHandlers
2021-12-14 15:37:43 +11:00
Gustavo Moreira
9766327433
Parameterized generator
2021-12-14 15:37:37 +11:00
Gustavo Moreira
5c507f5ae8
Plugins versioning fixes
2021-12-14 15:37:19 +11:00
ikelos and GitHub
3c11099e66
Merge pull request #596 from gcmoreira/assorted-fixes
...
Assorted fixes
2021-12-12 22:54:18 +00:00
Gustavo Moreira
c5c1f355ef
Changing not not for a more explicit if statement
2021-12-13 09:51:25 +11:00
Gustavo Moreira
6456e55ddc
Added Sockstat linux plugin to enumerate all processes sockets.
...
The output format is based on the `ss` tools. It supports:
* Unix socket
* Inet/Inet6 sockets
* Netlink sockets
* VSock sockets
* Packet sockets
* XDP sockets (eBPF)
* Bluetooth sockets (When the respective symbols are present)
Changes to the linux Lsof plugin were required to be able to reuse its filedescriptor listing capability.
2021-12-10 17:51:27 +11:00
Gustavo Moreira
02bf609fd1
Prepare linux.lsof.Lsof plugin to work as a helper library for other plugin.
2021-12-10 17:50:52 +11:00
Gustavo Moreira
d2ad867d1e
my mistake, it should be negated twice to get True when is valid
2021-12-10 13:20:43 +11:00
Gustavo Moreira
e1942976bf
wrong comparison with None
2021-12-10 13:10:47 +11:00
Gustavo Moreira
8e7aff4ad8
not in please
2021-12-10 13:09:41 +11:00
Gustavo Moreira
36ac92c11c
undefined layers module
2021-12-10 13:06:38 +11:00
Gustavo Moreira
17e0b04cb3
undefined glob module
2021-12-10 13:06:15 +11:00
Mike Auty
581251cb05
Linux: Fix long standing typo (thanks to @gcmoreira)
2021-12-08 23:34:53 +00:00
Mike Auty
832bdc2ab1
Linux: Fix long standing typo (thanks to @gcmoreira)
2021-12-08 23:34:23 +00:00
ikelos and GitHub
32ec4afed3
Merge pull request #586 from volatilityfoundation/issues/qemu-speed-up
...
Layers: Speed up qemu by not bisecting
2021-12-08 23:08:32 +00:00
ikelos and GitHub
8f083ed1dd
Merge pull request #476 from japhlange/issues/issue474_netscan_win8sp1x64
...
adds netstat symbols to Win8x64 ISF files
2021-12-06 20:10:25 +00:00
Jan
125658ee0d
re-adds accidentally deleted file
2021-12-06 21:09:39 +01:00
Jan
be4d014f1a
improves decision making when to inspect driver pe header based on version_dict
2021-12-06 17:18:39 +01:00
Jan
6cd2d940f3
adds proper version requirement for verinfo
2021-12-06 17:18:38 +01:00
Jan
3aac7b228e
adds a few clarifying comments and handles errors better
2021-12-06 17:16:23 +01:00
Jan
ee65793fd8
adds new ISF for tcpip.sys 6.3.9600.19935 + distinguisher
2021-12-06 17:16:20 +01:00
Jan
90ad7b1609
reverts pointless createtime offset change
2021-12-06 17:14:40 +01:00
Jan
fffb375909
adds netstat symbols to Win8x64 ISF files
2021-12-06 17:14:40 +01:00
Mike Auty
96820e2804
Plugins: Bump skeleton_key_check to 2.0.0
2021-12-03 16:02:06 +00:00
ikelos and GitHub
da1216a747
Merge pull request #594 from a5hlynx/develop
...
update version to 2.0.0
2021-12-03 15:58:15 +00:00
a5hlynx
680349016e
update version to 2.0.0
2021-12-04 00:29:00 +09:00
Gustavo Moreira
e8fa6e1e7f
Add the Linux mountinfo module.
2021-12-02 18:36:04 +11:00
Gustavo Moreira
ccd4c1bee0
Fixed exceptions.elf reference
2021-12-02 17:38:31 +11:00
Mike Auty
f821ac6072
Layers: Comment out unused code in AVML
2021-11-17 20:42:11 +00:00
Mike Auty
8d48faa0d9
Layers: Close file on layer destruction to prevent ResourceWarning
2021-11-17 13:52:25 +00:00
Mike Auty
3cb2bf9fac
Core: Fix up python 3.10 support
...
Fixes #589
2021-11-17 13:41:09 +00:00
Mike Auty
a1cbea27a8
Layers: Speed up qemu by not bisecting
2021-11-08 22:56:06 +00:00
ikelos and GitHub
23453f5d8c
Merge pull request #580 from volatilityfoundation/issues/large-page-fix
...
Layers: Fix bug where PAT flag is treated as address
2021-11-03 19:20:38 +00:00
ikelos and GitHub
bcdec8a480
Merge pull request #584 from CaptWake/issue-449
...
issue-449 - add --physical flag
2021-10-27 23:21:50 +01:00
ikelos and GitHub
0c603a20ba
Merge pull request #579 from volatilityfoundation/feature/vad-maxsize
...
Windows: Set a 100Gb VAD max size for vadinfo
2021-10-27 23:19:57 +01:00
Mike Auty
20ca165d0f
Windows: Lower the vadlimit on MHL's advice
2021-10-27 23:19:30 +01:00
Stefano
6979a6d2ee
psscan: Remove usage of PHYSICAL_DEFAULT variable
2021-10-25 17:56:33 +02:00
Stefano
2d3d133c0e
issue-449 - add --physical flag
2021-10-24 19:02:14 +02:00
ikelos and GitHub
a7ad0dbc0e
Merge pull request #582 from garanews/develop
...
fix some typo
2021-10-19 09:02:14 +01:00
garanews
449c2aaddf
fix some typo
2021-10-18 14:38:12 +02:00
Mike Auty
2a7831466c
Layers: Fix bug where PAT flag is treated as address
2021-10-17 13:29:32 +01:00
Mike Auty
9b4324adaa
Windows: Stop looking for DTBs when a good one is found
2021-10-17 01:53:41 +01:00
Mike Auty
49fe653d98
Windows: Max pointers at maximum layer address
2021-10-17 01:06:40 +01:00
Mike Auty
fb6610ff48
Windows: Limit pointers to layer maximum address
2021-10-17 00:36:16 +01:00
Mike Auty
865cb92527
Windows: Check only valid page table entries
2021-10-17 00:25:42 +01:00
Mike Auty
441fff0d10
Windows: Reduce DTB false positive rate
2021-10-13 17:00:47 +01:00
Mike Auty
7cac1a98fd
Core: Update documentation for RegExScanner
2021-10-13 15:03:17 +01:00
Gustavo Moreira