Gustavo Moreira
ac27d6663a
Linux: Add two page cache plugins, linux.pagecache.Files and linux.pagecache.InodePages
2024-08-03 21:26:29 +10:00
Gustavo Moreira
41684478ad
Linux: Add page cache support, including abstractions like RadixTree, XArray, and IDR, to support both older and latest kernel versions
2024-08-03 21:21:49 +10:00
Gustavo Moreira
a369a9e23c
Linux: dentry object extension: Add a method to walk dentries subdirectories
2024-08-03 21:05:23 +10:00
Gustavo Moreira
231f682b27
Linux: Improve mount's object extension method docstrings
2024-08-03 21:01:59 +10:00
Gustavo Moreira
0dfb9d8a0f
Linux mountinfo: Add a method to yield all filesystem superblocks
2024-08-03 20:57:23 +10:00
Gustavo Moreira
d4ed07f95b
PR review fixes: Add fixme to remember we should move wintime_to_datetime/unixtime_to_datetime out of renderers
2024-08-03 20:51:32 +10:00
ikelos and GitHub
32c8dc50af
Merge pull request #1229 from volatilityfoundation/feature/argcomplete
...
Feature/argcomplete
2024-08-03 10:37:51 +01:00
k1nd0ne
2e9b5b62fa
removing test code
2024-08-02 18:11:29 +02:00
k1nd0ne
60b1c49e49
removing test code
2024-08-02 18:10:11 +02:00
k1nd0ne
230ea09728
Updating code following #1230 merge
2024-08-02 17:52:51 +02:00
ForensicXlab and GitHub
70675149c3
Merge branch 'volatilityfoundation:develop' into feature/lsof_inodes
2024-08-02 16:21:46 +02:00
ikelos and GitHub
eb757b41cc
Merge pull request #1230 from gcmoreira/linux_inode_timespec_timespec64_obj_extensions
...
Linux: Add inode, timespec, and timespec64 object extensions
2024-08-02 10:56:37 +01:00
Gustavo Moreira
ed20834763
PR review fixes: Remove get_inode_number. It's better to use the type's original member name and handle the casting on the consumer side.
2024-08-02 19:48:09 +10:00
Gustavo Moreira
d34b1ded3e
PR review fixes: Remove get_inode_number. It's better to use the type's original member name and handle the casting on the consumer side.
2024-08-02 19:46:23 +10:00
Gustavo Moreira
933a41fa3a
PR review fixes: Convert inode's is_* functions to properties
2024-08-02 14:22:27 +10:00
Gustavo Moreira
b8d68b9a5e
PR review fixes: Avoid using renderers in core functions.
2024-08-02 14:21:29 +10:00
Gustavo Moreira
efba3a1b73
PR review fixes: Convert inode's is_* functions to properties
2024-08-02 14:17:57 +10:00
Gustavo Moreira
930d29046a
PR review fixes: Avoid using renderers in core functions.
2024-08-02 14:15:01 +10:00
Gustavo Moreira
79529fb815
PR review fixes: Rename method name from private to internal
2024-08-02 13:52:07 +10:00
Gustavo Moreira
1dcaf9c0b1
PR review fixes: Rename method name from private to internal
2024-08-02 13:50:51 +10:00
ikelos and GitHub
af5a743b35
Merge pull request #1219 from qpalzmz112/develop
...
Added psxview plugin
2024-08-02 01:33:59 +01:00
qpalzmz112
98c0094da5
Updated unpacked variable names
2024-08-01 18:51:11 -05:00
Dave Lassalle
fdb131f870
#816 - add cmdscan and bug fixes
2024-08-01 16:27:48 -05:00
qpalzmz112
d19013c852
fixed typo, updated plugin docstring, and updated comment
2024-08-01 16:19:24 -05:00
Mike Auty
0bda154385
Clarify the documentation a little
2024-08-01 21:08:18 +01:00
Mike Auty
e6308a6035
Make suggested changes by gcmoreira
2024-08-01 21:04:24 +01:00
Dave Lassalle
dbc837474c
#816 - initial support for Windows Windows Server 2022 (10.0.20348)
2024-08-01 14:23:22 -05:00
Gustavo Moreira
3017a7d00c
Linux: Add inode, timespec, and timespec64 object extensions to support different kernel versions, ensuring we will get aware datetimes when using them.
2024-08-01 12:23:09 +10:00
Gustavo Moreira
90b8b5340f
Linux: Add inode, timespec, and timespec64 object extensions to support different kernel versions, ensuring we will get aware datetimes when using them.
2024-08-01 11:46:10 +10:00
qpalzmz112
9e8864521c
Added debug log for failed address translation
2024-07-31 18:02:52 -05:00
qpalzmz112
fd6e4bec5c
Updated with feedback from the PR
2024-07-31 17:53:29 -05:00
Mike Auty
d576f8cb48
Fix CodeQL error
2024-07-31 21:49:07 +01:00
Mike Auty
73bc10c283
Wire the argcomplete into volshell too
2024-07-31 21:46:57 +01:00
ikelos and GitHub
16cde44400
Merge pull request #1228 from volatilityfoundation/ldr_fix
...
Remove errant filter on ldrmodule checks
2024-07-30 23:21:57 +01:00
ikelos and GitHub
2743e78481
Merge pull request #1227 from dgmcdona/dgmcdona/windows-netscan-update
...
Windows: Updates netscan with new symbol file
2024-07-30 23:19:56 +01:00
ikelos and GitHub
189f8729e5
Merge pull request #1222 from gcmoreira/renderers_time_conversion_fixes
...
Renderers time conversion fixes
2024-07-30 23:08:11 +01:00
ikelos and GitHub
af7466b353
Merge pull request #1224 from dgmcdona/dgmcdona/windows-callback-symbol-fix
...
Windows: Fixes bad structure member in callbacks
2024-07-30 22:45:50 +01:00
ikelos and GitHub
4e8d64ed86
Merge pull request #1217 from eve-mem/windows_issue_1146
...
Windows: update handles plugin sar warnings to use DEFAULT_SAR_VALUE var
2024-07-30 22:38:36 +01:00
ikelos and GitHub
bee333908b
Merge pull request #1221 from volatilityfoundation/issues/issue1216
...
Renderers: Allow BaseAbsentValues in value results
2024-07-30 22:37:42 +01:00
Andrew Case
a84a3706c5
Remove errant filter on ldrmodule checks
2024-07-30 14:00:41 -05:00
David McDonald
56b618f5c3
Windows: Updates netscan with new symbol file
...
`netscan` was missing coverage for Windows 10 Build 20348, causing
owners and create times for `_TCP_ENDPOINTS` to be missing. This adds a
symbol file and the necessary version check in the netscan plugin.
Testing confirms that this returns the correct creation time and owner
process.
2024-07-30 13:04:53 -05:00
Gustavo Moreira
efc48d5831
Make timeliner able to sort aware datetimes. Otherwise, it will raise an exception when comparing the plugin output data with this naive datetime
2024-07-30 17:18:14 +10:00
Arcuri Davide and GitHub
30217ed36d
Merge branch 'volatilityfoundation:develop' into develop
2024-07-30 09:11:33 +02:00
Andrew Case
896b40bd22
Fix bugs in thrdscan and threads. Add orphan kernel threads plugin
2024-07-29 18:50:55 -05:00
Andrew Case
59fec176aa
Fix bugs in thrdscan and threads. Add orphan kernel threads plugin
2024-07-29 18:49:48 -05:00
David McDonald
d97fd777f3
Windows: Bumps netstat module version requirement
...
This is a bump of the version number for the netstat plugin's `modules`
requirement - it didn't get updated after #1173 was merged.
2024-07-29 18:41:57 -05:00
David McDonald
ba7ec00599
Windows: Fixes bad structure member in callbacks
...
This fixes a bug in the x64 callbacks symbols. The `NotificationRoutine`
is currently an `unsigned int` instead of a void pointer. This prevents
the correct mapping of the notification routine to the kernel module
that contains it.
2024-07-29 17:55:56 -05:00
Gustavo Moreira
b343734bae
Renderers conversion exceptions fix: Even though the documentation states that OverflowError should be raised starting from version 3.3, it has been observed that ValueError is still being triggered. Also, in Linux, we noticed that OSError is also being raised in some cases.
2024-07-29 15:16:34 +10:00
Gustavo Moreira
ece15c914f
Renderers conversion exceptions fix: Since version 3.3 utcfromtimestamp() and fromtimestamp() Python datimetime module raises OverflowError instead of ValueError. As of today, Volatility3 requires Python 3.7.3 so we should only include OverflowError
2024-07-29 14:18:10 +10:00
Gustavo Moreira
76414d3246
Renderers conversion fix: Create aware datetimes to represent times in UTC. Fix Python 3.12 datetime.utcfromtimestamp() deprecation.
...
See warning note on https://docs.python.org/3/library/datetime.html#datetime.datetime.utcfromtimestamp :
Because naive datetime objects are treated by many datetime methods as local times, it is preferred to use aware datetimes to represent times in UTC. As such, the recommended way to create an object representing a specific timestamp in UTC is by calling datetime.fromtimestamp(timestamp, tz=timezone.utc).
Additionaly, datetime.utcfromtimestamp() is deprecated since 3.12
2024-07-29 14:13:54 +10:00
Gustavo Moreira