Mike Auty
a5cf635fd8
Windows: Fix the vadyarascan sanity check
2024-07-17 17:31:44 +01:00
Mike Auty
cb6929163b
Windows: Fix vadyarascan sanity check and bad documentation
2024-07-15 18:14:50 +01:00
ikelos and GitHub
ccaa473972
Merge pull request #1199 from volatilityfoundation/issues/python-3.8
...
Core: Bump the version and minium python to support pip
2024-07-14 19:12:49 +01:00
Mike Auty
61e3e894ee
Core: Bump the version and minium python to support pip
2024-07-14 19:04:06 +01:00
ikelos and GitHub
d3345259ac
Merge pull request #1157 from branchvincent/full-extra
...
add full and dev extras
2024-07-14 18:58:41 +01:00
ikelos and GitHub
e8dc54a4b8
Merge pull request #1173 from brandon-barnacle/bbarnacle/windows-modscan-modules
...
Windows: Bug fixes and additions to modules and modscan
2024-07-14 18:37:38 +01:00
ikelos and GitHub
d077fa06be
Merge pull request #1192 from volatilityfoundation/issues/issue1162
...
Implement the fix that was reverted as part of #1162 .
2024-07-14 18:20:15 +01:00
ikelos and GitHub
987ecaf5ed
Merge pull request #1193 from volatilityfoundation/issues/issue1155
...
Initial draft of complete-vad vadyarascan
2024-07-14 15:16:35 +01:00
Brandon Barnacle and Brandon Barnacle
8d60e9160f
PR comment changes.
2024-07-08 09:40:19 -04:00
Brandon Barnacle and Brandon Barnacle
b35169d0bc
Windows: Bug fixes and additions to modules and modscan
...
This pull request adds several changes to the modules and modscan
plugins that fix bugs, unify options and operations, and allow for
filtering by name and base address in both plugins. Previously,
modscan and modules had a substantial amount of partially duplicated
code, which led to bugs, such as:
Only one allowed filtering by --name
Only one cycled through the session layers to find the one hosting the kernel module
With the new inheritance and combined implementation, the correct
and complete implementation applies to both.
This PR also addresses the feedback in
https://github.com/volatilityfoundation/volatility3/pull/1099 . In this PR,
--name and –base apply to the processing of modules and determine
both which plugins are displayed in output as well as which are
processed for extraction. This fixes the issue of using --filters, which
only filters the final command line output, but leads to every module
being extracted.
2024-07-08 09:40:02 -04:00
Mike Auty
ac15840fd8
Windows: Fix up yara plugin code scanning warnings
2024-07-07 15:23:48 +01:00
Mike Auty
bb4cfb6e00
Initial draft of complete-vad vadyarascan
2024-07-07 15:13:06 +01:00
Mike Auty
4938195113
Implement the fix that was reverted as part of #1162 .
2024-07-06 17:04:51 +01:00
ikelos and GitHub
1d4a27ea41
Merge pull request #1170 from volatilityfoundation/hollow_process
...
Add new plugin to detect hollowed processes using a variety of techni…
2024-07-05 19:10:28 +01:00
ikelos and GitHub
41c6963cb3
Merge pull request #1183 from hsarkey/hsarkey/windows-dlllist
...
Windows: Adding name & base filtering for --dump on dlllist
2024-07-05 18:50:46 +01:00
atcuno
96a382ed52
Further type information
2024-07-05 09:33:34 -05:00
Hannah Sarkey and GitHub
43fa84d2d1
Update dlllist.py to have more detailed --base description
2024-07-04 21:33:55 -04:00
ikelos and GitHub
4f69638d4d
Merge pull request #1110 from dgmcdona/dgmcdona/windows-callbacks
...
Windows: Add support for missing callback types
2024-07-04 23:04:55 +01:00
ikelos and GitHub
1e58547aa9
Merge pull request #1191 from gcmoreira/fix_text_renderer_hexdump
...
Fix hexdump text render. Set default to 16 bytes width
2024-07-04 19:46:20 +01:00
Gustavo Moreira
52e6812d39
Fix hexdump text render. Set default to 16 bytes width
2024-07-04 14:03:59 +10:00
David McDonald
4d6f4bba0d
Windows: Add version to driverirp.DriverIrp plugin
...
This plugin class was missing a `_version` attribute, so I added one and
set it to (1, 0, 0).
2024-07-03 17:15:16 -05:00
David McDonald
55881535bb
Windows: Callbacks - parse missing callback types
...
Updates the Windows callbacks plugin to support several types of
callbacks that were present in the original volatility framework, but
were missing in volatility3. Adds an extension for `_SHUTDOWN_PACKET`
structures for determining validity of structure.
2024-07-03 17:15:16 -05:00
David McDonald
89b024d8f5
Framework: Fix bad format string
...
Fixes a bad format string inside of a raised exception
2024-07-03 16:54:43 -05:00
David McDonald
acc41c2b86
Windows: Callbacks - update symbol files
...
Updates the windows callbacks symbol files to include structures that
were missing from the original volatility plugin.
2024-07-03 16:54:43 -05:00
ikelos and GitHub
0da48fa23a
Merge pull request #1172 from volatilityfoundation/threads
...
Add threads and suspicious_threads plugins. Condense code for re-use
2024-07-03 21:05:11 +01:00
atcuno
020005f43c
Address feedback from ikelos
2024-07-03 09:55:07 -05:00
atcuno
857cd8df49
Updates from ikelos' feedback
2024-07-02 19:14:15 -05:00
Hannah Sarkey and GitHub
06a2c0c76c
Merge branch 'volatilityfoundation:develop' into hsarkey/windows-dlllist
2024-06-26 12:10:11 -04:00
ikelos and GitHub
ac5769cf86
Merge pull request #1178 from dgmcdona/dgmcdona/windows_poolscan_layer_bug
...
Windows: fixes scanner bug for versions < win10
2024-06-23 11:08:39 +01:00
Mike Auty
7ece5fb1bf
Windows: Improve Virtmap error messages slightly
2024-06-23 00:16:32 +01:00
ikelos and GitHub
351db0e573
Merge pull request #1171 from Abyss-W4tcher/crash_layer_issue_509
...
fix #509 and simplify logic in crash layer _load_segments
2024-06-22 09:30:02 +01:00
David McDonald
898c0844c4
Windows: fixes scanner bug for versions < win10
...
This commit fixes a bug where the `layer_name` gets discarded when
constructing objects. Previously, it was assumed that we would not want
to construct an object for a module with a layer_name different from that
of the module. However, because we switch to scanning the memory layer on
samples where the version is < 10, but still construct kernel executive
objects based on the result of the memory layer scan, we actually do
sometimes need to specify a different layer.
2024-06-21 18:47:48 -05:00
atcuno
ed140e9ac4
placeholder
2024-06-20 13:06:43 -05:00
Abyss Watcher
c688744f66
revert useless for-else
2024-06-20 04:16:32 +02:00
Abyss Watcher
a68a482632
fix #509 and simplify logic in _load_segments
2024-06-20 04:00:20 +02:00
atcuno
178f7c45f7
formatting fixes
2024-06-19 20:13:04 -05:00
atcuno
02bda980d4
formatting fixes
2024-06-19 20:12:07 -05:00
atcuno
3d1b9ef2bc
Add new plugin to detect hollowed processes using a variety of techniques and allowing for easy additions of future detection techniques
2024-06-19 20:09:05 -05:00
ikelos and GitHub
b187dd9686
Merge pull request #1165 from volatilityfoundation/notes_bleed_through
...
The notes variable is not reset for each VAD, allowing bleed through …
2024-06-15 10:51:46 +01:00
atcuno
59f6a05068
The notes variable is not reset for each VAD, allowing bleed through of a previously set note value to VADs enumerated afterwards
2024-06-14 16:45:54 -05:00
ikelos and GitHub
07794c7b29
Merge pull request #1164 from volatilityfoundation/fix_ads_rendering
...
Prevent backtrace in ADS scanning when contents cannot be recovered. …
2024-06-14 00:11:36 +01:00
atcuno
04ca0214eb
Prevent backtrace in ADS scanning when contents cannot be recovered. Fix missing parantheses as well as format_hints call on bad value
2024-06-13 15:24:32 -05:00
Mike Auty
0ee3573be2
Revert "Intel layer: Fix. This if statement will never be executed unless "minimum_address > maximum_address" which doesn't make sense to me."
...
This reverts commit e5a5b89577
2024-06-12 23:14:45 +01:00
ikelos and GitHub
0808e873fa
Merge pull request #1141 from gcmoreira/layers_several_fixes
...
Layers - Several fixes around maximum_address and chunk sizes
2024-06-11 23:15:18 +01:00
ikelos and GitHub
05ba1f9f8f
Merge pull request #1160 from eve-mem/windows_ldrmodules_issue_1158
...
Windows: ldrmodules update exception handling to InvalidAddressException
2024-06-11 23:02:42 +01:00
Eve
e4aac0c976
Windows: ldrmodules update exception handling to InvalidAddressException
2024-06-10 11:30:15 +01:00
Gustavo Moreira
77fb0b7b26
Update the output filename (preferred_filename) so that we can notify it correctly to the user
2024-06-10 18:37:38 +10:00
Gustavo Moreira
ab84070df3
Revert "Store the real/final output filename so that we can notify it correctly to the user"
...
This reverts commit d7aae3a982
2024-06-10 17:25:05 +10:00
Gustavo Moreira
a72062f288
Revert "LayerWriter plugin: Fix --output argument. It's referenced in the code but never mentioned as a requirement"
...
This reverts commit 6d22347ce6
2024-06-10 17:20:47 +10:00
ikelos and GitHub
543a39485b
Merge pull request #1149 from volatilityfoundation/getcellroutine
...
Add a new getcellroutine plugin that reports hooked GetCellRoutine ha…
2024-06-09 23:21:35 +01:00
Mike Auty