WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-25 07:32:23 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,117 Commits 80 Branches 17 Tags
a5c19abe877789b7ecac8ab003ffde5ef6ec8ed2
Commit Graph
2117 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ilya Chukhmanandikelos a5c19abe87 add mac metadata object to 6.2.0 schema 2020-03-26 13:32:30 +00:00
Mike Auty be1faa91a5 Initial attempt at resolving anonymoous fields. 2020-03-26 13:32:30 +00:00
Mike Auty bd2a382d88 CLI & windows.handles: Improve exception handling 2020-03-16 22:34:03 +00:00
Mike Auty b8bc0f0ed6 mac.netstat: Fix up typing and interface imports 2020-03-12 19:53:51 +00:00
Andrew Caseandikelos 7d6d74bc91 Update order of arguments 2020-03-12 19:47:15 +00:00
Andrew Caseandikelos 722700d2dc Add docstrings 2020-03-12 19:47:15 +00:00
Andrew Caseandikelos 7b21e83b07 Mac - convert socket gathering to class method and clean up associated code 2020-03-12 19:47:15 +00:00
Mike Auty 640afdda2c Layers: Add in NonLinear Segmented layers 2020-03-04 20:29:42 +00:00
Mike Auty a745503b72 Layers: Make the linear/non-linear changes minimal 2020-03-04 20:29:42 +00:00
Mike Auty df804928b5 Layers: Alter the decode method to take data directly 2020-03-04 20:29:42 +00:00
Mike Auty 87dc98655b Layers: Fix up an intel inaccuracy in mapping sizes 2020-03-04 20:29:42 +00:00
Mike Auty e089314898 Layers: Add pad option to the decode/encode steps 2020-03-04 20:29:42 +00:00
Mike Auty ca9d7075d3 Layers: Refactor the decode/encode methods 2020-03-04 20:29:42 +00:00
Mike Auty 77be83edc4 Layers: Change mapping signature to return domain length 2020-03-04 20:29:42 +00:00
Mike Auty a2ac55ba0b Wintel: Reorder the DTB tests 
Reorder the DTB tests, since 64-bits have more to match and are likely
more common these days.  We've had an instance where a 32-bit DTB was
detected because of a self-referential pointer over a 64-bit DTB leading
to an inaccessible image.

This fixes issue #193.
 2020-03-04 20:28:52 +00:00
Mike Auty 7c260ce4bd Crashdump: Ensure the number of runs is reflected in the array length 2020-02-29 18:47:34 +00:00
Mike Auty 3a824b519e CLI: Show choices options when no argument provided 
Fixes issue #191.
 2020-02-15 13:23:19 +00:00
Tamas K Lengyelandikelos 6a6cf37b02 pdbconv: save _imp functions in JSON 2020-02-14 09:20:15 +00:00
Andrew Caseandikelos a60bef3283 Mac - update queue walking code 2020-02-12 21:04:23 +00:00
Andrew Caseandikelos 5a99d35a9e update timer code 2020-02-12 19:56:37 +00:00
Michael Lighandikelos 4c7f2a3762 catch InvalidAddressException when traversing left and right child VADs (triggered on terminated processes) 2020-02-12 19:19:27 +00:00
Andrew Caseandikelos ab42f0941c Add sysctl docstrings and return types 2020-02-12 19:17:19 +00:00
Andrew Caseandikelos 29cc435b5e update sysctl v2 2020-02-12 19:17:19 +00:00
Mike Auty 7873a65999 Procdump: Don't loop through twice without good reason. 2020-02-12 19:07:24 +00:00
Mike Auty 920b85743b Revert "Automagic: Add excessive debugging to symbol cache" 
This reverts commit db8ba4029c.
 2020-01-30 01:58:07 +00:00
Mike Auty c4829ccca3 Caching: Add clear-cache option (except hashcaches) 2020-01-30 01:57:48 +00:00
Mike Auty db8ba4029c Automagic: Add excessive debugging to symbol cache 2020-01-30 01:34:30 +00:00
Mike Auty 6e38727ffe Mac: Refactor/optimize repeated code. 2020-01-28 01:37:21 +00:00
Mike Auty f111e9e051 Mac: Ensure queues error check all entries, not just the first. 2020-01-28 01:37:21 +00:00
cometandikelos beed68b8bf update 2020-01-27 23:31:05 +00:00
Mike Auty f00453e366 Procdump: Remove redundant line as caught by @iMHLv2 2020-01-22 19:49:11 +00:00
Michael Lighandikelos 1d7da6402b svcscan cleanup: win10 before 15063 uses win8 types 2020-01-22 19:23:30 +00:00
Mike Auty b664e38c66 Resources: Add a comment about removing the old python code. 2020-01-22 19:22:02 +00:00
Michael Lighandikelos d6c8ac87d7 try unverified retrieval if ssl.SSLCertVerificationError or ssl.SSLError with CERTIFICATE_VERIFY_FAILED 2020-01-22 19:19:48 +00:00
Mike Auty ddfd5ec2d2 Framework: Refactor where the python version check happens. 
Fixes issue #181.
 2020-01-22 19:05:06 +00:00
Mike Auty 9fe6e6ba37 registry: Add the hivedump plugin 2020-01-17 17:22:04 +00:00
Mike Auty fe999aa9e2 registry: Fix up previous naive mapping method 2020-01-17 17:14:16 +00:00
Mike Auty 5b9c8feba6 General: Improve import warning for volatility.framework.plugins 2020-01-17 02:14:22 +00:00
Mike Auty 81653dba6d Registry: Ignore errors if ignore_errors is set. 2020-01-17 01:14:09 +00:00
Mike Auty 8f71c61440 layerwriter: Fix mistaken hardcoded layer name. 2020-01-16 23:07:27 +00:00
Mike Auty 99af98f639 layerwiter: Refactor to classmethod. 2020-01-16 22:57:47 +00:00
Mike Auty 572313cc34 Objects: Make sure bytes provide a template size. 2020-01-16 11:06:16 +00:00
Mike Auty a3def09a13 Registry: Optimize calls to DataLength and improve documentation. 2020-01-15 22:59:58 +00:00
Mike Auty cedca0bb84 Objects: Document void size a little more. 2020-01-15 21:55:30 +00:00
Mike Auty 2d408491bd Printkey: Slightly improve subkey name determination. 2020-01-15 02:19:12 +00:00
Mike Auty 3f5b96f3c7 Yapf: Clean-up the whole codebase. 2020-01-14 15:44:07 +00:00
Mike Auty b7ba877727 procdump: Enure proc_id is defined. 2020-01-14 15:36:54 +00:00
doomedravenandikelos 07b94abc1e Update procdump.py 2020-01-14 10:52:05 +00:00
doomedravenandikelos cdc0835863 Update procdump.py 2020-01-14 10:52:05 +00:00
doomedravenandikelos e4d7b7975f expose process_dump to other plugins 2020-01-14 10:52:05 +00:00