 ikelosandGitHub
|
a1cab3438e
|
Merge pull request #1849 from volatilityfoundation/issues/issue1848
Windows: Fix pe_symbols type checking
|
2025-12-28 13:48:56 +00:00 |
|
|
ikelosandGitHub
|
3a953262e6
|
Merge pull request #1924 from volatilityfoundation/issues/issue1923
Document the reason for skipping entirely duplicated page tables
|
2025-12-22 09:35:40 +00:00 |
|
|
ikelosandGitHub
|
674996ffcd
|
Merge pull request #1921 from Abyss-W4tcher/issue_1920_slow_addrspace_scan
Improve Intel layer's address space scanning
|
2025-12-03 15:36:30 +00:00 |
|
|
ikelosandGitHub
|
493950c634
|
Merge pull request #1902 from Abyss-W4tcher/issue_1889_low_stub_scan_fix
[issue #1889] Fix missing address increment in low stub scanner
|
2025-11-30 22:14:12 +00:00 |
|
|
ikelosandGitHub
|
a17281a214
|
Merge pull request #1868 from Abyss-W4tcher/fix_broken_mount_enum_after_6_13
Linux: Fix broken mount enumeration on 6.13+
|
2025-11-24 09:05:18 +00:00 |
|
|
ikelosandGitHub
|
a94436d478
|
Merge pull request #1801 from volatilityfoundation/issues/do-not-inherit-pseudoplugins
Issues/do not inherit pseudoplugins
|
2025-11-20 09:26:59 +00:00 |
|
|
ikelosandGitHub
|
c54daae32a
|
Update volatility3/framework/plugins/linux/malware/check_modules.py
|
2025-11-19 16:35:35 +00:00 |
|
|
ikelosandGitHub
|
83bf743a27
|
Update volatility3/framework/plugins/linux/malware/hidden_modules.py
|
2025-11-19 16:35:28 +00:00 |
|
|
ikelosandGitHub
|
9bfb1bed35
|
Update volatility3/framework/plugins/linux/malware/hidden_modules.py
|
2025-11-19 16:35:22 +00:00 |
|
|
ikelosandGitHub
|
dfd6282f17
|
Update volatility3/framework/plugins/linux/malware/hidden_modules.py
|
2025-11-19 16:35:15 +00:00 |
|
|
ikelosandGitHub
|
393abb2a2f
|
Update volatility3/framework/plugins/linux/malware/hidden_modules.py
|
2025-11-19 16:35:08 +00:00 |
|
|
ikelosandGitHub
|
9454fe1f27
|
Update volatility3/framework/symbols/linux/utilities/modules.py
|
2025-11-19 16:35:01 +00:00 |
|
|
ikelosandGitHub
|
5c9c763f64
|
Update volatility3/framework/plugins/linux/lsmod.py
|
2025-11-19 16:34:53 +00:00 |
|
|
ikelosandGitHub
|
3e2d831be3
|
Merge pull request #1890 from volatilityfoundation/issues/registry-plugin-expiry-date
Update Registry plugin expiry date
|
2025-11-09 17:56:53 +00:00 |
|
|
ikelosandGitHub
|
e8a23cc39b
|
Merge pull request #1884 from volatilityfoundation/issues/ruff-formatter
Apply changes that ruff formatter would make which black doesn't mind
|
2025-10-16 20:15:17 +01:00 |
|
|
ikelosandGitHub
|
4541a6e987
|
Merge pull request #1877 from volatilityfoundation/issues/issue1874
Convert ObjectInfo form NamedTuple to Dataclass to attempt to work better with pypy3
|
2025-10-16 20:15:00 +01:00 |
|
|
ikelosandGitHub
|
1718dc77e3
|
Merge pull request #1853 from tvanegro/dump_dirty_pages
Add dumping dirty pages to Linux Malfind
|
2025-09-28 23:05:56 +01:00 |
|
|
ikelosandGitHub
|
0dd8d3a8e9
|
Merge pull request #1827 from SolitudePy/lsof_deleted
Lsof improvements (show deleted as in lsof output) + files_only argument
|
2025-09-28 22:19:10 +01:00 |
|
|
ikelosandGitHub
|
f72b8ee21d
|
Update volatility3/framework/plugins/linux/malware/malfind.py
|
2025-09-28 22:11:48 +01:00 |
|
|
ikelosandGitHub
|
d41afc444e
|
Update volatility3/framework/plugins/linux/malware/malfind.py
|
2025-09-28 22:11:40 +01:00 |
|
|
ikelosandGitHub
|
16412537c0
|
Update volatility3/framework/plugins/linux/malware/malfind.py
|
2025-09-28 22:11:33 +01:00 |
|
|
ikelosandGitHub
|
438acddab6
|
Update volatility3/framework/plugins/linux/malware/malfind.py
|
2025-09-28 22:11:26 +01:00 |
|
|
ikelosandGitHub
|
2dbc06f995
|
Merge pull request #1825 from SolitudePy/pebmasq
pebmasquerade plugin
|
2025-09-23 20:18:38 +01:00 |
|
|
ikelosandGitHub
|
78e05f9c8f
|
Merge pull request #1861 from kyrre/feature/parquet-arrow-renderer
Feature/parquet arrow renderer
|
2025-09-15 10:00:03 +01:00 |
|
|
ikelosandGitHub
|
81f2e7376a
|
Update test/renderers/test_parquet_renderers.py
|
2025-09-15 08:58:04 +01:00 |
|
|
ikelosandGitHub
|
50b3c22b7d
|
Merge pull request #1871 from blitztide/develop
Feature: vadyarascan enrichment
|
2025-09-15 08:54:38 +01:00 |
|
|
ikelosandGitHub
|
2b092bf32f
|
Merge pull request #1873 from j-t-1/README
Add newlines to README.md
|
2025-09-14 22:33:49 +01:00 |
|
|
ikelosandGitHub
|
9ad82876e0
|
Merge pull request #1781 from volatilityfoundation/1780-dlllist-loadcount-missing
1780 dlllist loadcount missing
|
2025-09-06 00:52:12 +01:00 |
|
|
ikelosandGitHub
|
1eb87178b8
|
Merge pull request #1854 from cpuu/develop
Update Linux tutorial: remove outdated info and add plugin examples
|
2025-07-07 19:49:20 +01:00 |
|
|
ikelosandGitHub
|
29e210bd33
|
Merge pull request #1837 from SolitudePy/svcdiff_malware
Malware categorization: windows.svcdiff
|
2025-07-07 19:12:40 +01:00 |
|
|
ikelosandGitHub
|
385192acd0
|
Merge pull request #1863 from volatilityfoundation/malfind_warning
Change warning to debug to not break plugin output and to conform to …
|
2025-07-01 00:59:18 +01:00 |
|
|
ikelosandGitHub
|
997f2a4f4c
|
Merge pull request #1856 from SolitudePy/sockstat_remove_unix
Plugins: remove unused unix argument in linux.sockstat
|
2025-06-29 16:24:05 +01:00 |
|
|
ikelosandGitHub
|
a2ebe6006e
|
Merge pull request #1852 from SolitudePy/syscalls_malware_plugin
Malware categorization: categorize EDR evading plugins with in/direct_syscall
|
2025-06-29 16:20:06 +01:00 |
|
|
ikelosandGitHub
|
9440075e52
|
Merge pull request #1851 from SolitudePy/ldr_modules_malware
Plugins: categorize ldrmodules as a malware plugin
|
2025-06-29 16:18:01 +01:00 |
|
|
ikelosandGitHub
|
308a4668b7
|
Merge pull request #1829 from SolitudePy/regexscan
Regexscan fixes
|
2025-06-22 23:10:38 +01:00 |
|
|
ikelosandGitHub
|
f5feee842d
|
Merge pull request #1841 from SolitudePy/check_creds_malware
Malware categorization: linux.check_creds
|
2025-06-12 08:05:01 +01:00 |
|
|
ikelosandGitHub
|
470c53c5f7
|
Merge branch 'develop' into check_creds_malware
|
2025-06-11 22:21:59 +01:00 |
|
|
ikelosandGitHub
|
63019c0988
|
Merge pull request #1833 from SolitudePy/psxview_malware
Malware categorization: windows.psxview
|
2025-06-11 22:18:32 +01:00 |
|
|
ikelosandGitHub
|
76db04c494
|
Merge pull request #1807 from volatilityfoundation/bugfix/windows_thrdscan_tuple_unpacking
Windows Thrdscan: Fix broken tuple unpacking
|
2025-06-11 14:06:43 +01:00 |
|
|
ikelosandGitHub
|
58f441186c
|
Merge pull request #1850 from SolitudePy/malware_plugins_category
Malware categorization: linux.tty_check, linux.netfilter, linux.modxview
|
2025-06-10 21:20:12 +01:00 |
|
|
ikelosandGitHub
|
43ed10a4f8
|
Merge pull request #1846 from SolitudePy/linux_malware_plugins
Malware categorization: linux.malfind & linux.keyboard_notifiers
|
2025-06-10 21:07:42 +01:00 |
|
|
ikelosandGitHub
|
58e41d754a
|
Merge pull request #1845 from SolitudePy/categorize_linux_malware
Malware categorization: linux.check_afinfo & linux.hidden_modules
|
2025-06-10 21:05:41 +01:00 |
|
|
ikelosandGitHub
|
9596893f1b
|
Merge pull request #1844 from SolitudePy/check_syscall_malware
Malware categorization: linux.check_syscall
|
2025-06-10 21:02:34 +01:00 |
|
|
ikelosandGitHub
|
e06910c763
|
Merge pull request #1843 from SolitudePy/check_modules_malware
Malware categorization: linux.check_modules
|
2025-06-10 21:00:02 +01:00 |
|
|
ikelosandGitHub
|
c62d77e4e2
|
Merge pull request #1842 from SolitudePy/check_idt_malware
Malware categorization: linux.check_idt
|
2025-06-10 20:58:04 +01:00 |
|
|
ikelosandGitHub
|
f2f83f5ce1
|
Merge pull request #1838 from SolitudePy/unhooked_syscalls_malware
Malware categorization: windows.unhooked_system_calls
|
2025-06-10 20:54:33 +01:00 |
|
|
ikelosandGitHub
|
ebd6c8719a
|
Merge pull request #1840 from SolitudePy/drivermodule_malware
Malware categorization: windows.drivermodule
|
2025-06-07 18:09:57 +01:00 |
|
|
ikelosandGitHub
|
2fbb872c9a
|
Merge pull request #1834 from SolitudePy/skel_key_malware
Malware categorization: windows.skeleton_key_check
|
2025-06-07 15:12:37 +01:00 |
|
|
ikelosandGitHub
|
84c33916df
|
Merge pull request #1835 from SolitudePy/suspicious_threads_malware
Malware categorization: windows.suspicious_threads
|
2025-06-07 15:10:02 +01:00 |
|
|
ikelosandGitHub
|
9c84152eea
|
Merge pull request #1832 from SolitudePy/processghosting_malware
Malware categorization: windows.processghosting
|
2025-06-07 15:07:36 +01:00 |
|
|
ikelosandGitHub
|
2bd9a0e710
|
Merge pull request #1831 from SolitudePy/hollowprocesses_malware
Malware categorization: windows.hollowprocesses
|
2025-06-07 15:05:59 +01:00 |
|
|
ikelosandGitHub
|
3f9794b3dc
|
Merge pull request #1830 from SolitudePy/malfind_malware
Malware categorization: windows.malfind
|
2025-06-07 15:04:23 +01:00 |
|
|
ikelosandGitHub
|
1571e65ad8
|
Merge pull request #1821 from eve-mem/deprecation_warning_for_PluginRequirement
Add a deprecation warning for PluginRequirement
|
2025-05-29 19:48:50 +01:00 |
|
|
ikelosandGitHub
|
9fd734762b
|
Merge pull request #1823 from j-t-1/malfind
Tweak comments
|
2025-05-29 19:48:37 +01:00 |
|
|
ikelosandGitHub
|
8e9e2d6f08
|
Merge pull request #1822 from eve-mem/linux_perf_events_VersionRequirement
Linux: update PerfEvents plugin to use VersionRequirement for pslist
|
2025-05-29 09:47:05 +01:00 |
|
|
ikelosandGitHub
|
1206b69abd
|
Update volatility3/framework/plugins/windows/malfind.py
|
2025-05-29 09:45:26 +01:00 |
|
|
ikelosandGitHub
|
c9e25a3f86
|
Merge pull request #1815 from ddogfoodd/fix-typos
fix: typos
|
2025-05-26 10:00:50 +01:00 |
|
|
ikelosandGitHub
|
a8f9c9449d
|
Merge pull request #1813 from geekscrapy/enablenocase
Make nocase accessible in yarascan.YaraScan yara_string
|
2025-05-19 14:14:13 +01:00 |
|
|
ikelosandGitHub
|
b3c53fde26
|
Merge pull request #1812 from JakePeralta7/develop
Minor fix to Hashdump.get_user_keys()
|
2025-05-19 12:42:46 +01:00 |
|
|
ikelosandGitHub
|
b414ee3ba2
|
Merge pull request #1794 from volatilityfoundation/feature/volshell-breakpoints
Volshell breakpointing
|
2025-05-19 12:41:26 +01:00 |
|
|
ikelosandGitHub
|
b3e770dd0c
|
Merge pull request #1811 from j-t-1/the
Remove extra word in comment
|
2025-05-18 20:20:36 +01:00 |
|
|
ikelosandGitHub
|
a413c44b00
|
Merge pull request #1810 from j-t-1/align
Align SeCreateTokenPrivilege with the other privileges
|
2025-05-16 22:29:00 +01:00 |
|
|
ikelosandGitHub
|
1a71b03b8d
|
Merge pull request #1791 from volatilityfoundation/feature/code-coverage
Add in coverage recording to the test process
|
2025-05-11 13:55:45 +01:00 |
|
|
ikelosandGitHub
|
28a72b8dd8
|
Merge pull request #1802 from eve-mem/linux_lsof_smear_comment
Linux: Add comment for explaining the behaviour with smear
|
2025-05-10 15:10:25 +01:00 |
|
|
ikelosandGitHub
|
ff6de6eab4
|
Merge pull request #1795 from Abyss-W4tcher/dentry_names_forward_slashes
Linux: prevent "forward slashes only" dentry names
|
2025-05-08 23:12:11 +01:00 |
|
|
ikelosandGitHub
|
686057d806
|
Merge pull request #1800 from SolitudePy/develop
add functions to etwpatch
|
2025-05-07 22:03:37 +01:00 |
|
|
ikelosandGitHub
|
57b28e5fa2
|
Merge pull request #1798 from volatilityfoundation/issues/fix-exe-build
Reformat and install volatility package deps before build
|
2025-05-06 23:06:43 +01:00 |
|
|
ikelosandGitHub
|
142add17a5
|
Merge pull request #1799 from volatilityfoundation/stable
Stable
|
2025-05-06 22:41:52 +01:00 |
|
|
ikelosandGitHub
|
606fecf5f8
|
Update volatility3/framework/plugins/windows/vadyarascan.py
|
2025-05-06 22:41:33 +01:00 |
|
|
ikelosandGitHub
|
c0c7119c38
|
Update volatility3/framework/plugins/windows/thrdscan.py
|
2025-05-06 22:41:27 +01:00 |
|
|
ikelosandGitHub
|
718f8ca2b5
|
Update volatility3/framework/plugins/linux/vmayarascan.py
|
2025-05-06 22:41:21 +01:00 |
|
|
ikelosandGitHub
|
65d3ff63bc
|
Merge branch 'develop' into stable
|
2025-05-06 22:37:47 +01:00 |
|
|
ikelosandGitHub
|
a7d64ad39d
|
Merge pull request #1796 from volatilityfoundation/release/v2.26.0
Release/v2.26.0
|
2025-05-06 21:27:58 +01:00 |
|
|
ikelosandGitHub
|
bb65fa31a6
|
Merge branch 'stable' into release/v2.26.0
|
2025-05-06 21:09:27 +01:00 |
|
|
ikelosandGitHub
|
51f0a3081d
|
Merge pull request #1786 from volatilityfoundation/dgmcdona/handles_interface
Windows Handles: Refactor plugin
|
2025-05-01 17:49:58 +01:00 |
|
|
ikelosandGitHub
|
e22e82dcc2
|
Merge pull request #1787 from JakePeralta7/develop
Detect ETW Patching
|
2025-04-29 12:42:24 +01:00 |
|
|
ikelosandGitHub
|
0c08b94547
|
Merge pull request #1793 from eve-mem/issue_1685
cli: add debug log of plugin version when the plugin is successfully constructed
|
2025-04-28 09:10:57 +01:00 |
|
|
ikelosandGitHub
|
8807e35cab
|
Merge pull request #1792 from volatilityfoundation/issues/update-codeql
Update codeql action from v2 to v3
|
2025-04-27 18:29:41 +01:00 |
|
|
ikelosandGitHub
|
c6e8c0d4e8
|
Merge pull request #1783 from volatilityfoundation/bugfix/shimcache_tracebacks
Windows Shimcachemem: Fix tracebacks
|
2025-04-26 21:33:39 +01:00 |
|
|
ikelosandGitHub
|
577747f22c
|
Merge pull request #1789 from eve-mem/linux_issue_1603
Linux: update extensions used by kallsyms plugin to use utility.pointer_to_string fix issue #1603
|
2025-04-26 20:30:34 +01:00 |
|
|
ikelosandGitHub
|
63f7cbd447
|
Merge pull request #1779 from j-t-1/svcdiff
Amend SvcDiff comments at top of file
|
2025-04-17 21:10:31 +01:00 |
|
|
ikelosandGitHub
|
fa73298e0f
|
Merge pull request #1579 from volatilityfoundation/feature/coding-style
Feature/coding style
|
2025-04-16 10:19:26 +01:00 |
|
|
ikelosandGitHub
|
65a02d961e
|
Merge pull request #1764 from volatilityfoundation/issues/make-quickstart-quicker
Documentation: Improve the readme to make quickstart the first thing …
|
2025-04-16 10:18:22 +01:00 |
|
|
ikelosandGitHub
|
6eb95ca4dc
|
Merge pull request #1778 from Abyss-W4tcher/qemu_layer_incomplete_requirements
Make QEMU layer call parent's requirements
|
2025-04-15 23:50:44 +01:00 |
|
|
ikelosandGitHub
|
2a16bf19d1
|
Merge pull request #1777 from volatilityfoundation/fix_thrdscan_tracebacks
ThrdScan: Fix tracebacks + filtering
|
2025-04-15 20:08:42 +01:00 |
|
|
ikelosandGitHub
|
923ea92cf3
|
Merge pull request #1772 from volatilityfoundation/fix_symlink_scanning
Poolscanners: Fix symlink pool types
|
2025-04-15 18:06:17 +01:00 |
|
|
ikelosandGitHub
|
8dae65ee3c
|
Merge pull request #1769 from volatilityfoundation/inodepages/memory_usage
Linux pagecache.Files: Memory Usage
|
2025-04-15 17:18:00 +01:00 |
|
|
ikelosandGitHub
|
df03d2220a
|
Merge pull request #1771 from volatilityfoundation/framework/process_traversal_bugfix
Bugfix: Linux/Windows process traversal
|
2025-04-14 23:43:04 +01:00 |
|
|
ikelosandGitHub
|
745e148aba
|
Merge pull request #1770 from volatilityfoundation/shimcachemem/bugfixes
ShimcacheMem: Various bugfixes
|
2025-04-14 18:24:52 +01:00 |
|
|
ikelosandGitHub
|
4e0beda020
|
Merge pull request #1768 from volatilityfoundation/extensions/process_layer_caching
Extensions: Add cache decorators as appropriate
|
2025-04-14 17:31:54 +01:00 |
|
|
ikelosandGitHub
|
1b31357665
|
Merge pull request #1766 from volatilityfoundation/thrdscan/filtering_and_tracebacks
Windows ThrdScan: Thread filtering, type-hints and tracebacks
|
2025-04-13 15:55:43 +01:00 |
|
|
ikelosandGitHub
|
e00f0961c2
|
Merge pull request #1767 from volatilityfoundation/bugfix/layer_deletion_exception_msg
Layers: Fix exception message
|
2025-04-10 09:51:26 +01:00 |
|
|
ikelosandMike Auty
|
1ab8ddcb7f
|
Merge pull request #1765 from Abyss-W4tcher/minimum_alignment_adjustment
[Parity/modules] Adjust module alignment for scanners
|
2025-04-09 20:38:50 +01:00 |
|
|
ikelosandGitHub
|
58c8de6bf7
|
Merge pull request #1765 from Abyss-W4tcher/minimum_alignment_adjustment
[Parity/modules] Adjust module alignment for scanners
|
2025-04-09 20:35:19 +01:00 |
|
|
ikelosandGitHub
|
ac8a1101ce
|
Update README.md
|
2025-04-08 20:18:10 +01:00 |
|
|
ikelosandGitHub
|
842d0e7703
|
Merge pull request #1763 from volatilityfoundation/inodepages/dump_files_output
InodePages: Add output column and render when dumped
|
2025-04-08 16:07:41 +01:00 |
|
|
ikelosandGitHub
|
01dd867542
|
Merge pull request #1760 from volatilityfoundation/bugfix/volshell_dt_traceback
Fix traceback in volshell's `dt()`
|
2025-04-08 08:09:37 +01:00 |
|
|
ikelosandGitHub
|
b3d1ce319c
|
Merge pull request #1758 from volatilityfoundation/bugfix/mftscan_memory_usage
Windows MFTScan: Memory usage performance fixes
|
2025-04-07 14:53:29 +01:00 |
|
|
ikelosandGitHub
|
6ddb0fef29
|
Merge pull request #1748 from eve-mem/volshell_display_types_pointer_upgrade_2025
Volshell: Display types pointer upgrade
|
2025-04-03 17:21:30 +01:00 |
|
|
ikelosandGitHub
|
0fb721e219
|
Merge pull request #1757 from volatilityfoundation/fix_tests
Tests: Fix Userassist and MFTScan testdata
|
2025-04-02 21:04:46 +01:00 |
|