 Mike Auty
|
b659a060bd
|
Renderers: Ensure the version is bumped so plugins can require the format_hints properly
|
2024-07-28 21:57:48 +01:00 |
|
|
Mike Auty
|
0d8fb76b3a
|
Renderers: Allow BaseAbsentValues in value results
Fixes #1216
|
2024-07-28 19:57:23 +01:00 |
|
|
Mike Auty
|
e89e776377
|
Try out argcomplete as well
|
2024-07-28 12:41:31 +01:00 |
|
|
Mike Auty
|
44f26c928e
|
Add in shtab autocompletion
|
2024-07-28 12:35:02 +01:00 |
|
|
qpalzmz112
|
824b0599f2
|
formatted
|
2024-07-27 20:35:08 -05:00 |
|
|
qpalzmz112
|
f44ceb321d
|
Added psxview
|
2024-07-27 20:11:39 -05:00 |
|
|
k1nd0ne
|
815252c9ba
|
Adding watchdogs
|
2024-07-27 16:35:22 +02:00 |
|
|
k1nd0ne
|
7024588076
|
Code clean
|
2024-07-27 16:09:52 +02:00 |
|
|
k1nd0ne
|
650dd06245
|
Modifications following the review
|
2024-07-27 16:03:59 +02:00 |
|
|
ikelosandGitHub
|
438fc79c8c
|
Merge pull request #1197 from eve-mem/issue_1040
Windows: remove size from filescan output as it is not the file size
|
2024-07-26 10:03:50 +01:00 |
|
|
Eve
|
7a03e9deab
|
Windows: Add a _version to the filescan plugin
|
2024-07-25 18:21:12 +01:00 |
|
|
Eve
|
799afe6e51
|
Windows: fix type in handles plugin
|
2024-07-25 18:02:30 +01:00 |
|
|
Eve
|
6f3f645dbc
|
Windows: update handles plugin sar warnings to use DEFAULT_SAR_VALUE var
|
2024-07-25 17:59:10 +01:00 |
|
|
Davide Arcuri
|
dc8dc9b078
|
fix yara depending plugins
|
2024-07-25 14:37:18 +02:00 |
|
|
Davide Arcuri
|
c6727ffb70
|
fix f-string for previous python release
|
2024-07-25 08:43:21 +02:00 |
|
|
Davide Arcuri
|
1616a898ae
|
restore comment
|
2024-07-25 08:37:27 +02:00 |
|
|
Davide Arcuri
|
fceb79ba8b
|
use with context, bump release
|
2024-07-25 08:34:04 +02:00 |
|
|
Arcuri DavideandGitHub
|
c92cd1935e
|
Merge branch 'volatilityfoundation:develop' into develop
|
2024-07-25 08:32:01 +02:00 |
|
|
ikelosandGitHub
|
05aa81b63c
|
Merge pull request #1214 from eve-mem/windows_issue_1146
Windows: update handles plugin to use a default SAR value of 0x10
|
2024-07-24 22:11:42 +01:00 |
|
|
ikelosandGitHub
|
19e1c21cbb
|
Merge pull request #1207 from volatilityfoundation/issues/fix-generator-inheritance
Add in threads that only provides an implmentation method
|
2024-07-24 21:04:36 +01:00 |
|
|
Mike Auty
|
f4cbed856b
|
Fix up missing filter parameter
|
2024-07-24 20:47:05 +01:00 |
|
|
Mike Auty
|
e1065f9e78
|
Fix up a missing super which @atcuno spotted
|
2024-07-24 20:32:36 +01:00 |
|
|
Eve
|
7d52f7992d
|
Windows: Make the default sar value used in handles plugin a variable so if it needs to be changed it gets updated in one place only
|
2024-07-24 11:06:26 +01:00 |
|
|
Eve
|
b8b146a444
|
Windows: update handles plugin to use a default SAR value of 0x10 if decoding fails. Produce warnings when this happens. Ref issue #1147
|
2024-07-24 10:59:52 +01:00 |
|
|
ForensicXlabandGitHub
|
d8970cc606
|
Merge branch 'volatilityfoundation:develop' into feature/lsof_inodes
|
2024-07-23 22:06:08 +02:00 |
|
|
k1nd0ne
|
af2d620676
|
Improving lsof
|
2024-07-23 22:02:34 +02:00 |
|
|
Davide Arcuri
|
ce9832a2b3
|
both yara-python and yara-x support
|
2024-07-22 13:58:33 +02:00 |
|
|
Arcuri DavideandGitHub
|
0b84a5627b
|
Merge branch 'volatilityfoundation:develop' into develop
|
2024-07-22 13:56:34 +02:00 |
|
|
Mike Auty
|
5e96327cb0
|
Add in threads that only provides an implmentation method
|
2024-07-21 22:58:43 +01:00 |
|
|
ikelosandGitHub
|
721971652c
|
Merge pull request #1168 from volatilityfoundation/svcdiff_malware_detection
Add svclist and svcdiff plugins. Make svcscan more modular to support…
|
2024-07-21 18:37:49 +01:00 |
|
|
Andrew Case
|
111873e173
|
Fix class vs static method and leading underscores
|
2024-07-21 11:54:06 -05:00 |
|
|
Andrew Case
|
21396185d0
|
Address feedback
|
2024-07-21 11:10:38 -05:00 |
|
|
ikelosandGitHub
|
fba7255b23
|
Merge pull request #1204 from volatilityfoundation/pedump_v2
Add pedump plugin and unified API for extracting PE files to disk
|
2024-07-21 17:05:42 +01:00 |
|
|
Andrew Case
|
9454181b98
|
Address feedback
|
2024-07-21 09:42:19 -05:00 |
|
|
ikelosandGitHub
|
5645c4ff4b
|
Merge pull request #1167 from volatilityfoundation/process_ghosting
Add processghosting plugin to detect process ghosting and related tec…
|
2024-07-21 13:31:35 +01:00 |
|
|
ikelosandGitHub
|
be10469702
|
Merge pull request #1202 from dgmcdona/dgmcdona/windows-shimcachemem
Windows: ShimcacheMem
|
2024-07-21 13:21:45 +01:00 |
|
|
ikelosandGitHub
|
d494df2673
|
Merge pull request #1201 from volatilityfoundation/issues/issue1200
Windows: Fix vadyarascan sanity check and bad documentation
|
2024-07-21 13:11:51 +01:00 |
|
|
ikelosandGitHub
|
6043e740ca
|
Merge pull request #1177 from volatilityfoundation/118-missing-plugins-threads-timers
118 missing plugins threads timers
|
2024-07-21 12:03:18 +01:00 |
|
|
ikelosandGitHub
|
7aa509b92b
|
Merge pull request #1186 from volatilityfoundation/userassist_timeline
Add timeliner support to userassist
|
2024-07-21 12:00:27 +01:00 |
|
|
Davide Arcuri
|
bca4cdda74
|
replace yara-python with yara-x
|
2024-07-19 11:09:52 +02:00 |
|
|
atcuno
|
12f3beacfc
|
Add dedicated plugin and API for extracting PE files from kernel and process memory
|
2024-07-18 17:56:24 -05:00 |
|
|
atcuno
|
75ccf1bfab
|
Add dedicated plugin and API for extracting PE files from kernel and process memory
|
2024-07-18 17:54:33 -05:00 |
|
|
atcuno
|
920b3ec615
|
Black fix
|
2024-07-18 15:48:21 -05:00 |
|
|
atcuno
|
b0a89f2109
|
Address feedback
|
2024-07-18 15:47:37 -05:00 |
|
|
atcuno
|
2a5e94a094
|
Black fixes
|
2024-07-18 15:01:10 -05:00 |
|
|
atcuno
|
a7af052509
|
Black fixes
|
2024-07-18 14:59:40 -05:00 |
|
|
atcuno
|
8da046530f
|
Address feedback
|
2024-07-18 14:57:31 -05:00 |
|
|
Andrew Case
|
1508a41499
|
Move registry table init into the generator function
|
2024-07-18 11:33:30 -05:00 |
|
|
David McDonald
|
4048d0b122
|
Windows: Adds shimcachemem plugin
|
2024-07-18 11:07:49 -05:00 |
|
|
David McDonald
|
a684e284cc
|
Windows: Adds shimcache symbol files + extensions
|
2024-07-18 11:07:49 -05:00 |
|