4667 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Dave Lassalle	146baab14c	#118 - refactor get_dpc	2024-06-21 15:54:16 -05:00
Dave Lassalle	2d7789f850	#118 - fix black issues	2024-06-21 15:49:03 -05:00
Dave Lassalle	7065446e8a	#118 - fix black issues	2024-06-21 15:17:40 -05:00
Dave Lassalle	c79dc52a85	#118 - black formatted	2024-06-21 15:09:21 -05:00
Dave Lassalle	e172676d3c	#118 - initial timers plugin	2024-06-21 15:07:18 -05:00
Dave Lassalle	b601250279	#1175 - initial unloadedmodules plugin	2024-06-21 08:29:50 -05:00
atcuno	ed140e9ac4	placeholder	2024-06-20 13:06:43 -05:00
Abyss Watcher	c688744f66	revert useless for-else	2024-06-20 04:16:32 +02:00
Abyss Watcher	a68a482632	fix #509 and simplify logic in _load_segments	2024-06-20 04:00:20 +02:00
atcuno	178f7c45f7	formatting fixes	2024-06-19 20:13:04 -05:00
atcuno	02bda980d4	formatting fixes	2024-06-19 20:12:07 -05:00
atcuno	3d1b9ef2bc	Add new plugin to detect hollowed processes using a variety of techniques and allowing for easy additions of future detection techniques	2024-06-19 20:09:05 -05:00
atcuno	f6a053d7b3	Format fixes	2024-06-19 14:58:05 -05:00
atcuno	d42fb0a145	Format fixes	2024-06-19 14:56:57 -05:00
atcuno	91184c7d92	Format fixes	2024-06-19 14:54:20 -05:00
atcuno	c4e7e50180	Add svclist and svcdiff plugins. Make svcscan more modular to support inheritance and cleaner code	2024-06-19 14:42:23 -05:00
atcuno	4e15019c46	Fixes for black	2024-06-19 11:34:06 -05:00
atcuno	6c42c51a8a	Fixes for black	2024-06-19 11:31:43 -05:00
atcuno	aee81276a2	Add processghosting plugin to detect process ghosting and related techniques. Add process filter that gathers only active, non-smeared userland processes	2024-06-19 11:27:32 -05:00
ikelosandGitHub	b187dd9686	Merge pull request #1165 from volatilityfoundation/notes_bleed_through ... The notes variable is not reset for each VAD, allowing bleed through …	2024-06-15 10:51:46 +01:00
atcuno	59f6a05068	The notes variable is not reset for each VAD, allowing bleed through of a previously set note value to VADs enumerated afterwards	2024-06-14 16:45:54 -05:00
ikelosandGitHub	07794c7b29	Merge pull request #1164 from volatilityfoundation/fix_ads_rendering ... Prevent backtrace in ADS scanning when contents cannot be recovered. …	2024-06-14 00:11:36 +01:00
atcuno	04ca0214eb	Prevent backtrace in ADS scanning when contents cannot be recovered. Fix missing parantheses as well as format_hints call on bad value	2024-06-13 15:24:32 -05:00
Mike Auty	0ee3573be2	Revert "Intel layer: Fix. This if statement will never be executed unless "minimum_address > maximum_address" which doesn't make sense to me." ... This reverts commit e5a5b89577.	2024-06-12 23:14:45 +01:00
ikelosandGitHub	0808e873fa	Merge pull request #1141 from gcmoreira/layers_several_fixes ... Layers - Several fixes around maximum_address and chunk sizes	2024-06-11 23:15:18 +01:00
ikelosandGitHub	05ba1f9f8f	Merge pull request #1160 from eve-mem/windows_ldrmodules_issue_1158 ... Windows: ldrmodules update exception handling to InvalidAddressException	2024-06-11 23:02:42 +01:00
Eve	e4aac0c976	Windows: ldrmodules update exception handling to InvalidAddressException	2024-06-10 11:30:15 +01:00
Gustavo Moreira	77fb0b7b26	Update the output filename (preferred_filename) so that we can notify it correctly to the user	2024-06-10 18:37:38 +10:00
Gustavo Moreira	ab84070df3	Revert "Store the real/final output filename so that we can notify it correctly to the user" ... This reverts commit d7aae3a982.	2024-06-10 17:25:05 +10:00
Gustavo Moreira	a72062f288	Revert "LayerWriter plugin: Fix --output argument. It's referenced in the code but never mentioned as a requirement" ... This reverts commit 6d22347ce6.	2024-06-10 17:20:47 +10:00
ikelosandGitHub	543a39485b	Merge pull request #1149 from volatilityfoundation/getcellroutine ... Add a new getcellroutine plugin that reports hooked GetCellRoutine ha…	2024-06-09 23:21:35 +01:00
ikelosandGitHub	faadfab481	Merge pull request #1151 from volatilityfoundation/feature/linux-replace-intunsignedlong ... Linux: Replace uses of specific types with the more generic pointer	2024-06-09 23:20:04 +01:00
ikelosandGitHub	7c2eca4932	Merge pull request #1150 from volatilityfoundation/feature/vmscan ... Generic: Add vmscan plugin	2024-06-09 23:17:57 +01:00
Gustavo Moreira	23b9ed8c0c	Extend the changes in fefc6c4a to the run_all() class method	2024-06-09 22:02:41 +10:00
Gustavo Moreira	9d5636b03a	Move the data size setter to the __init__()	2024-06-09 21:43:11 +10:00
Gustavo Moreira	3793510f59	Add VersionRequirement for LinuxUtilities	2024-06-09 21:36:20 +10:00
Gustavo Moreira	0962f26382	class_subclasses is a function, soit's better import the volatility.framework to avoid people accidentally thinking it's defined here and then importing it from here.	2024-06-09 21:33:59 +10:00
Gustavo Moreira	fefc6c4a4b	Pass just the kernel module name instead of the whole config	2024-06-09 21:27:27 +10:00
Gustavo Moreira	0defe0f07e	Rename symbol_table to kernel_module_name	2024-06-09 21:08:22 +10:00
Branch Vincent	693eebc34b	migrate to pyproject.toml	2024-06-01 16:16:44 -07:00
Branch Vincent	76c8067b21	add full and dev extras	2024-06-01 16:16:38 -07:00
Mike Auty	771ed10b44	Core: Bump to 2.7.1	2024-05-29 20:44:04 +01:00
Mike Auty	35122df27d	Infra: Upgrade deprecated githubs actions 2	2024-05-29 20:42:25 +01:00
Mike Auty	57b3a99a1e	Infra: Upgrade deprecated githubs actions	2024-05-29 20:40:44 +01:00
Mike Auty	08493e9c3a	Automagic: Do some slight gymnastics to get the true value of the pointer	2024-05-21 23:13:31 +01:00
Mike Auty	c6d207d170	Generic: Fix code scanning issue with vmscan	2024-05-21 09:06:01 +01:00
Mike Auty	c5a45f91fc	Linux: Replace uses of specific types with the more generic pointer	2024-05-20 21:09:00 +01:00
Mike Auty	3eab0671b4	Generic: Add vmscan plugin	2024-05-20 20:47:12 +01:00
atcuno	901b0fd6ba	Fix year in header	2024-05-19 15:11:06 -05:00
atcuno	bc8666b64a	Fixes for black	2024-05-19 14:24:53 -05:00