Gustavo Moreira
a6d8ba8bfa
windows eprocess validation: Make the creation and exit year checks dynamic
2024-07-15 20:22:40 +10:00
Gustavo Moreira
fcc9eab471
Improve smear protection on windows processes validation
2024-07-04 13:09:12 +10:00
Gustavo Moreira
b36fd84ab5
Handle virtual_process_from_physical() invalid address exceptions to prevent psscan from breaking
2024-07-04 13:07:17 +10:00
ikelos and GitHub
0da48fa23a
Merge pull request #1172 from volatilityfoundation/threads
...
Add threads and suspicious_threads plugins. Condense code for re-use
2024-07-03 21:05:11 +01:00
atcuno
020005f43c
Address feedback from ikelos
2024-07-03 09:55:07 -05:00
ikelos and GitHub
ac5769cf86
Merge pull request #1178 from dgmcdona/dgmcdona/windows_poolscan_layer_bug
...
Windows: fixes scanner bug for versions < win10
2024-06-23 11:08:39 +01:00
Mike Auty
7ece5fb1bf
Windows: Improve Virtmap error messages slightly
2024-06-23 00:16:32 +01:00
ikelos and GitHub
351db0e573
Merge pull request #1171 from Abyss-W4tcher/crash_layer_issue_509
...
fix #509 and simplify logic in crash layer _load_segments
2024-06-22 09:30:02 +01:00
David McDonald
898c0844c4
Windows: fixes scanner bug for versions < win10
...
This commit fixes a bug where the `layer_name` gets discarded when
constructing objects. Previously, it was assumed that we would not want
to construct an object for a module with a layer_name different from that
of the module. However, because we switch to scanning the memory layer on
samples where the version is < 10, but still construct kernel executive
objects based on the result of the memory layer scan, we actually do
sometimes need to specify a different layer.
2024-06-21 18:47:48 -05:00
atcuno
ed140e9ac4
placeholder
2024-06-20 13:06:43 -05:00
Abyss Watcher
c688744f66
revert useless for-else
2024-06-20 04:16:32 +02:00
Abyss Watcher
a68a482632
fix #509 and simplify logic in _load_segments
2024-06-20 04:00:20 +02:00
ikelos and GitHub
b187dd9686
Merge pull request #1165 from volatilityfoundation/notes_bleed_through
...
The notes variable is not reset for each VAD, allowing bleed through …
2024-06-15 10:51:46 +01:00
atcuno
59f6a05068
The notes variable is not reset for each VAD, allowing bleed through of a previously set note value to VADs enumerated afterwards
2024-06-14 16:45:54 -05:00
ikelos and GitHub
07794c7b29
Merge pull request #1164 from volatilityfoundation/fix_ads_rendering
...
Prevent backtrace in ADS scanning when contents cannot be recovered. …
2024-06-14 00:11:36 +01:00
atcuno
04ca0214eb
Prevent backtrace in ADS scanning when contents cannot be recovered. Fix missing parantheses as well as format_hints call on bad value
2024-06-13 15:24:32 -05:00
Mike Auty
0ee3573be2
Revert "Intel layer: Fix. This if statement will never be executed unless "minimum_address > maximum_address" which doesn't make sense to me."
...
This reverts commit e5a5b89577
2024-06-12 23:14:45 +01:00
ikelos and GitHub
0808e873fa
Merge pull request #1141 from gcmoreira/layers_several_fixes
...
Layers - Several fixes around maximum_address and chunk sizes
2024-06-11 23:15:18 +01:00
ikelos and GitHub
05ba1f9f8f
Merge pull request #1160 from eve-mem/windows_ldrmodules_issue_1158
...
Windows: ldrmodules update exception handling to InvalidAddressException
2024-06-11 23:02:42 +01:00
Eve
e4aac0c976
Windows: ldrmodules update exception handling to InvalidAddressException
2024-06-10 11:30:15 +01:00
Gustavo Moreira
77fb0b7b26
Update the output filename (preferred_filename) so that we can notify it correctly to the user
2024-06-10 18:37:38 +10:00
Gustavo Moreira
ab84070df3
Revert "Store the real/final output filename so that we can notify it correctly to the user"
...
This reverts commit d7aae3a982
2024-06-10 17:25:05 +10:00
Gustavo Moreira
a72062f288
Revert "LayerWriter plugin: Fix --output argument. It's referenced in the code but never mentioned as a requirement"
...
This reverts commit 6d22347ce6
2024-06-10 17:20:47 +10:00
ikelos and GitHub
543a39485b
Merge pull request #1149 from volatilityfoundation/getcellroutine
...
Add a new getcellroutine plugin that reports hooked GetCellRoutine ha…
2024-06-09 23:21:35 +01:00
ikelos and GitHub
faadfab481
Merge pull request #1151 from volatilityfoundation/feature/linux-replace-intunsignedlong
...
Linux: Replace uses of specific types with the more generic pointer
2024-06-09 23:20:04 +01:00
ikelos and GitHub
7c2eca4932
Merge pull request #1150 from volatilityfoundation/feature/vmscan
...
Generic: Add vmscan plugin
2024-06-09 23:17:57 +01:00
Mike Auty
771ed10b44
Core: Bump to 2.7.1
2024-05-29 20:44:04 +01:00
Mike Auty
35122df27d
Infra: Upgrade deprecated githubs actions 2
2024-05-29 20:42:25 +01:00
Mike Auty
57b3a99a1e
Infra: Upgrade deprecated githubs actions
2024-05-29 20:40:44 +01:00
Mike Auty
08493e9c3a
Automagic: Do some slight gymnastics to get the true value of the pointer
2024-05-21 23:13:31 +01:00
Mike Auty
c6d207d170
Generic: Fix code scanning issue with vmscan
2024-05-21 09:06:01 +01:00
Mike Auty
c5a45f91fc
Linux: Replace uses of specific types with the more generic pointer
2024-05-20 21:09:00 +01:00
Mike Auty
3eab0671b4
Generic: Add vmscan plugin
2024-05-20 20:47:12 +01:00
atcuno
901b0fd6ba
Fix year in header
2024-05-19 15:11:06 -05:00
atcuno
bc8666b64a
Fixes for black
2024-05-19 14:24:53 -05:00
atcuno
4ed7d40ecb
Fixes for black
2024-05-19 14:23:21 -05:00
atcuno
47eb42204e
Fixes for black
2024-05-19 14:21:03 -05:00
atcuno
c2b2321622
Add a new getcellroutine plugin that reports hooked GetCellRoutine handlers of memory mapped Windows registry hives
2024-05-19 14:09:14 -05:00
ikelos and GitHub
dc7a3878fa
Merge pull request #1147 from eve-mem/windows_handles_debug_logging
...
Windows: add extra debugging messages to handles plugin
2024-05-16 23:09:24 +01:00
Eve
5d5fa96e36
Windows: add extra debugging messages to handles plugin, ref #1146
2024-05-16 09:19:59 +01:00
ikelos and GitHub
1b3ba6ab2e
Merge pull request #1145 from volatilityfoundation/handles_bad_read_check
...
Correctly check for a failed read
2024-05-09 22:37:15 +01:00
atcuno
2b165a56be
Fix pre-existing formatting issue from black checks
2024-05-09 14:53:24 -05:00
atcuno
4c937a922d
Correctly check for a failed read
2024-05-09 14:47:56 -05:00
ikelos and GitHub
1c4fd269d0
Merge pull request #1144 from volatilityfoundation/timerliner_missing_macb_times_fix
...
Add a default 0 value to macb columns to avoid mactime not reporting …
2024-05-09 16:35:40 +01:00
atcuno
3933061551
Add a default 0 value to macb columns to avoid mactime not reporting timeline entries
2024-05-09 09:17:32 -05:00
ikelos and GitHub
a66aa02050
Merge pull request #1143 from volatilityfoundation/dumpfiles_dump_only_once_per_file_object
...
Prevent duplicate processing of the same file object
2024-05-08 21:26:45 +01:00
atcuno
3f3f1a9c0d
Prevent duplicate processing of the same file object
2024-05-08 11:23:01 -05:00
Gustavo Moreira
85052b6238
LayerWriter: Fix missing optional flag for the --output argument
2024-05-07 08:12:31 +10:00
Gustavo Moreira
d7aae3a982
Store the real/final output filename so that we can notify it correctly to the user
2024-05-06 13:11:52 +10:00
Gustavo Moreira
a6c77c4884
LayerWriter: Fix - Last chunk size is wrongly calculated
2024-05-06 13:09:45 +10:00
Gustavo Moreira