Mike Auty
10aa2f7620
Core: Support zip files as plugin paths
2021-09-05 15:49:21 +01:00
Mike Auty
ced2dbe67d
Mac: Remove unused code (LGTM)
2021-09-05 15:44:30 +01:00
Mike Auty
7d7a8e4c2e
Linux: Remove unused code (LGTM)
2021-09-05 15:44:12 +01:00
ikelos and GitHub
d0a963b070
Merge pull request #557 from volatilityfoundation/issues/issue556
...
Windows: Pstree loop protection
2021-09-05 12:58:58 +01:00
ikelos and GitHub
df5df3dbe4
Merge pull request #561 from volatilityfoundation/issues/issue_547_regvaluetype_usage
...
Correct usage for RegValueTypes enum
2021-09-05 12:50:45 +01:00
Mike Auty
17efe7dbdc
Windows: Fix issue #385
2021-09-05 12:48:32 +01:00
Mike Auty
e9e80035eb
Linux: Fixes after the pslist kernel req change
2021-09-04 15:28:57 +01:00
superponible
6492a458db
correct usage for RegValueTypes enum
2021-09-03 17:32:57 -05:00
Mike Auty
be54de140e
Automagic: Better check for bad DTBs
2021-09-03 15:44:36 +01:00
Mike Auty
66ec8ff841
Automagic: Further sections for older windows
2021-09-03 15:27:08 +01:00
Mike Auty
d17ad710f2
Automagic: Remove unused old code
2021-09-02 23:01:26 +01:00
Mike Auty
4b56ee4c73
Automagic: Increase windows self-ref segment for win7
2021-09-02 23:01:05 +01:00
Mike Auty
bb3f411e22
Automagic: Add a section for where old kernels live
2021-09-02 22:54:25 +01:00
Mike Auty
03136d1469
Automagic: Clean up the windows self-referential dtb finder
2021-09-02 22:51:32 +01:00
Mike Auty
5d030263ea
Windows: Totally revert broken merge issue505-2
2021-09-02 21:50:24 +01:00
Mike Auty
3f0f5fb29c
Windows: Reduce the full automagic range *again* 5:\
2021-09-02 17:05:35 +01:00
ikelos and GitHub
3072a584cb
Merge pull request #511 from volatilityfoundation/issues/issue505-2
...
Windows: Ensure DTBs don't have all valid entries
2021-09-02 13:11:41 +01:00
Mike Auty
4634a146c7
Windows: Pstree loop protection
2021-09-02 02:11:32 +01:00
ikelos and GitHub
6b3396f4cc
Merge pull request #555 from shu-tom/develop
...
Fixed an issue where the symbol file download from the Microsoft site failed
2021-08-30 13:48:34 +01:00
shusei tomonaga
b43712f9f4
Fixed an issue where the PDB guid value was not zero padded.
2021-08-30 21:24:47 +09:00
ikelos and GitHub
7626f60bb4
Merge pull request #526 from volatilityfoundation/feature/linux-mac-repo
...
Feature/linux mac repo
2021-08-30 12:42:59 +01:00
Mike Auty
e6547a2d5e
Revert "CLI: Verify improvement for buildbot"
...
This fix for buildbot didn't seem to have any effect
This reverts commit 57e1243932
2021-08-28 00:34:11 +01:00
Mike Auty
57e1243932
CLI: Verify improvement for buildbot
2021-08-27 22:23:33 +01:00
ikelos and GitHub
35713bb6d8
Merge pull request #554 from volatilityfoundation/feature/linux-mac-windows-unify-config
...
Feature/linux mac windows unify config
2021-08-27 22:20:43 +01:00
Mike Auty
f082c1c8cc
Objects: Fix up pointer caching to default to native layer
2021-08-26 17:25:03 +01:00
Mike Auty
b1156fa0a1
Automagic: Remove the superfluous num_entries fields
2021-08-26 16:18:27 +01:00
Mike Auty
1e1b3fda36
Windows: Fix up typo in num_entries parameter
2021-08-26 14:05:53 +01:00
Mike Auty
2371c1158d
Windows: Ensure DTBs don't have all valid entries
...
We were finding that PAE results were being masked by certain pages with
64bit results. The DTBs could be distinguished from good DTBs because
every entry was valid (which for a 64-bit or even 32-bit DTB is
extremely unlikely except on systems with *vast* quanties of memory.
As such, this now tests for all entries being allocated and doesn't return the
DTB if this is the case.
2021-08-26 11:50:04 +01:00
Mike Auty
aa1c24e60a
Core: Make pointer caching more accurate
2021-08-26 11:43:32 +01:00
ikelos and GitHub
2dda3b4946
Merge pull request #549 from volatilityfoundation/feature/intel-coalesce-by-default
...
Layers: Coalesce intel mapping responses
2021-08-25 16:46:43 +01:00
Mike Auty
ece34139db
Mac: Standadize on kernel config name
2021-08-25 16:10:55 +01:00
Mike Auty
ad3560e1bc
Linux: Shift linux plugins to using kernel as their default module
2021-08-25 15:48:53 +01:00
Mike Auty
b90fd6bbb2
Automagic: Only traverse down intel layers
2021-08-24 21:59:18 +01:00
Mike Auty
27c5dfdffd
Plugins: Add in architectures for ModuleRequirement
...
Fixes #553
2021-08-24 21:47:47 +01:00
ikelos and GitHub
7bf3ac4a41
Merge pull request #551 from volatilityfoundation/feature/windows-kernel-module
...
Windows: Update to kernel ModuleRequirement for ease of config
2021-08-22 12:28:47 +01:00
Mike Auty
97da37d968
Windows: Update to kernel module for ease of config
2021-08-20 00:53:03 +01:00
Mike Auty
ab075ac667
Windows: Fix pstree physical/virtual offsets
2021-08-20 00:52:43 +01:00
Mike Auty
0aa59111df
Generic: YaraScanner fail on no rules
2021-08-19 23:06:55 +01:00
Mike Auty
260f879334
Core: Fix caching of pointer objects
2021-08-19 15:32:48 +01:00
Mike Auty
98db5e46d4
Windows: Remove hardcoded parameter in poolscanner
2021-08-19 11:12:05 +01:00
Mike Auty
db2ec8cfb2
Core: Ensure module configuration is recordable
2021-08-16 16:59:11 +01:00
x
ef27d07183
Add missing patch that fixes KERB_ECRYPT structure size
2021-08-13 15:06:48 +00:00
x
70750d2b92
Remove unused variable from plugin
2021-08-12 22:52:08 +00:00
ikelos and GitHub
5f276df35c
Merge pull request #484 from volatilityfoundation/skeleton_key_check_plugin
...
Skeleton key check plugin
2021-08-12 23:39:39 +01:00
x
d86b9b34e4
Fix return types, change confusing use of continue, switch to get_absolute_symbol_address
2021-08-12 15:47:16 +00:00
Mike Auty
19b2a06964
Layers: Coalesce intel mapping responses
2021-08-11 22:02:08 +01:00
Mike Auty
3ad20d566c
Automagic: Minor fixes for jar files and layers
2021-08-11 21:51:41 +01:00
Mike Auty
e7623baf45
Linux: Support None to turn off remote banner locations
2021-08-11 21:24:39 +01:00
Mike Auty
bb40a8a207
Automagic: Catch remote download exceptions
2021-08-11 21:22:03 +01:00
Mike Auty
3b2aae40d2
Automagic: Support remote banner versioning and chaining
2021-08-11 21:22:03 +01:00
Mike Auty