WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 04:37:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,667 Commits 80 Branches 17 Tags
a00a59cd235cb18b7dc28ccf2669e2a82368fab5
Commit Graph
4667 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Gustavo Moreira 695635199e PR review fixes: Avoid saving state in the pidhashtable plugin 2024-08-24 01:14:09 +10:00
Gustavo Moreira 3c70c1b9f7 PR review fixes: Use context and module_name instead of vmlinux in ebpf plugin 2024-08-24 00:58:04 +10:00
Gustavo Moreira feae6a9aa0 PR review fixes: Use plugin's open method instead of the builtin open() 2024-08-24 00:42:52 +10:00
ikelosandGitHub 9bba6287a2 Merge pull request #1213 from forensicxlab/feature/lsof_inodes 
Improvement: Linux/lsof
 2024-08-22 23:45:20 +01:00
k1nd0ne 71cdca5883 Updating version + docstring 2024-08-22 16:45:04 +02:00
Mike Auty 8d7edfdca6 Bump as the release branch has been cut 2024-08-21 20:36:09 +01:00
Gustavo Moreira 4513806a7e Move RBTree to the rb_root extension object for better integration 2024-08-15 07:55:45 -07:00
Gustavo Moreira 87fe3444eb Linux: Add support for mount namespace in kernels 6.8+. This fixes volatilityfoundation/volatility3#1187 2024-08-14 23:50:39 -07:00
ikelosandGitHub 4578434bbd Merge pull request #1236 from sluke-nuix/issues/truecrypt_module_version 
Update the modules.Modules version requirement.
 2024-08-13 17:06:46 +01:00
Steven Luke 918584537f Update the modules.Modules version requirement. 
This is a response to PR [#1173](https://github.com/volatilityfoundation/volatility3/pull/1173)
 2024-08-13 08:34:35 -04:00
Gustavo Moreira 7efa2210a5 PR review fixes: Adjust LinuxUtilities version since we moved choose_id_storage() back to the IDStorage class. 2024-08-13 01:05:44 -07:00
Gustavo Moreira f804b44ff6 Fix test.yaml, it should remove *.bin and not *.lime. There is no *.lime atm. 2024-08-13 01:00:57 -07:00
Gustavo MoreiraandGitHub b69c2c762c Merge branch 'volatilityfoundation:develop' into linux_page_cache 2024-08-10 06:05:33 -03:00
Gustavo Moreira 8f9d565f63 PR review fixes: Fix minor typo to match verb form from other docstrings 2024-08-10 00:49:18 -07:00
Gustavo Moreira 17861618df PR review fixes: Rename Tree to IDStorage. Move choose_id_storage() form LinuxUtilities to IDStorage. Use context and kernel_module_name instead of vmlinux 2024-08-10 00:13:38 -07:00
Gustavo Moreira 53f3d12341 linuxutilities code improvement. Remove code duplication 2024-08-09 23:35:41 -07:00
k1nd0ne f22575669a Modifications following the review 2024-08-09 10:20:28 +02:00
Gustavo Moreira 2c85ea525e PR review fixes: Fix page extension object get_content() explicit returns mixed with implicit returns. 2024-08-08 02:03:28 -07:00
Gustavo Moreira 06508a4afb PR review fixes: Fix the IDR's old kernel get_entries 2024-08-08 02:00:27 -07:00
Gustavo Moreira 7a8dea3356 PR review fixes: Code scanning complains about these unused variables. Let's comment them and adapt the FIXME message 2024-08-08 01:57:35 -07:00
Gustavo Moreira 0f3f338633 PR review fixes: Since the IDR, XArray and RadixTree can store any value, it renames the function names to a more generic name 2024-08-08 01:52:57 -07:00
Gustavo Moreira ee10ba8abb PR review fixes: Fix IDR explicit returns mixed with implicit returns and improve and fix code. 2024-08-08 01:46:53 -07:00
Gustavo Moreira de6637c987 PR review fixes: ebpf plugin code improvement. Use the object_from_symbol() instead 2024-08-08 00:52:34 -07:00
Dave Lassalle 131fb21e1e Merge branch 'develop' into 816-port-cmdscan-and-console-plugins-from-vol2-to-vol3-please 2024-08-07 11:17:05 -07:00
Davide Arcuri 10376a2687 use one class with flag 2024-08-07 10:38:29 +02:00
Gustavo Moreira 46842981fb PR review fixes: Use contextlib.suppress() instead of an empty exception handler 2024-08-07 00:24:58 -07:00
Gustavo Moreira 805b3514c3 PR review fixes: Fix page flags list method name, this was introduced earlier in another commit of this PR. 2024-08-07 00:23:19 -07:00
Gustavo Moreira f737b88d03 PR review fixes: Improve _walk_dentry() and get_inodes() variable names, arguments and return values 2024-08-06 23:12:01 -07:00
Gustavo Moreira c8cb4465da PR review fixes: Remove filter function, it isn't needed 2024-08-06 23:08:21 -07:00
Gustavo Moreira 339a9a94f5 PR review fixes: pidhashtable plugin add missing typing. 2024-08-06 23:00:09 -07:00
Dave Lassalle ac08f42cfd #816 - fix invalid json 2024-08-06 15:35:02 -07:00
Dave Lassalle 1d43eb305d fix invalid json on all files 2024-08-06 15:33:50 -07:00
ikelosandGitHub 6b739f6f6c Merge pull request #1234 from dadokkio/patch-1 
add args and kwargs to threads.py init
 2024-08-06 22:20:18 +01:00
Arcuri DavideandGitHub 1e3e9e2c78 add args and kwargs to threads.py init 
Without args and kwargs there were an issue with timeliner plugin that tried to pass additional parameters like progress_callback raising TypeError
 2024-08-06 16:28:59 +02:00
Gustavo Moreira 7df0636f30 PR review fixes: Fix pidhashtable plugin explicit returns mixed with implicit returns 2024-08-06 04:57:33 -07:00
Gustavo Moreira bd37aa3930 PR review fixes: Fix pidhashtable plugin 2024-08-06 04:48:49 -07:00
Gustavo Moreira c9eb81c95f PR review fixes: Improve eBPF extension objects: bpf_prog and added bpf_prog_aux. Apply changes to the EBPF and Sockstat plugins. 2024-08-06 04:40:48 -07:00
Arcuri DavideandGitHub f740146f69 Merge branch 'volatilityfoundation:develop' into develop 2024-08-06 11:04:12 +02:00
k1nd0ne 8d6fd3cd78 Moved get_inode_metadata, separated inode and FD processing, error handling precision 2024-08-05 14:28:43 +02:00
Dave Lassalle 9b9535d8d7 #816 - other 20348 symbols 2024-08-04 10:14:36 -07:00
Dave Lassalle f8c25176f3 #816 - add 17763, 18362, 19041 x64 support 2024-08-04 09:30:37 -07:00
ikelosandGitHub 398198042f Merge branch 'develop' into linux_page_cache 2024-08-04 13:44:37 +01:00
Gustavo Moreira 3e75c2ae9d Fix @functools.cache . It's available since Python 3.9 2024-08-04 14:40:45 +10:00
Dave Lassalle 60f14478e2 #816 - black fixes 2024-08-03 14:30:27 -07:00
Dave Lassalle a3c50e8221 #816 - black fixes 2024-08-03 14:27:42 -07:00
Dave Lassalle 583cffe960 #816 - next console properties for better readability in treegrid 2024-08-03 14:24:17 -07:00
Dave Lassalle a515e571dc add Win10x64 17763 2024-08-03 12:03:20 -07:00
Gustavo Moreira cc04f665e3 Fix inode type 2024-08-03 23:47:28 +10:00
Gustavo Moreira 103537801e Linux: Add a basic eBPF program enumeration plugin to test and demonstrate using the IDR abstraction 2024-08-03 21:44:38 +10:00
Gustavo Moreira 55212008f8 Linux: Add pidhashtable plugin. This is based on the vol2 plugin, removing ancient kernel support, curating code and enhancing comments, while using the new IDR abstraction included also in this effort. 2024-08-03 21:39:51 +10:00